CoParent — Privacy Policy

DRAFT — requires review by an Australian privacy lawyer before publication.
Last updated: 17 October 2026

CoParent ("we", "us", "the app") helps separated parents manage shared parenting logistics. We take the privacy and security of your family's information seriously. This policy explains what we collect, where it is stored, who it is shared with, and your rights under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Because CoParent handles health information, we treat ourselves as bound by the Privacy Act regardless of business size.

This policy covers users in Australia and New Zealand. It is built around the Australian Privacy Principles (Privacy Act 1988 (Cth)) and the New Zealand Information Privacy Principles (Privacy Act 2020); the two regimes are closely aligned. If you are located outside Australia or New Zealand (for example in the EU/UK), please do not use the service until we expressly support your region.

1. What we collect

We do not collect your home address, and we do not store card or bank-account numbers. Subscription payments are handled by the Apple App Store / Google Play and RevenueCat, or by Stripe for subscriptions bought on the website; we never see your card details.

2. Where your information is stored

Your information is stored in Supabase (PostgreSQL database and file storage) hosted in Sydney, Australia (AWS ap-southeast-2). Uploaded files (documents, photos, voice notes) are kept in a private storage bucket, accessible only through short-lived signed links to people you have authorised.

For New Zealand users, storing data in Australia is a cross-border disclosure under Information Privacy Principle 12. Australia provides privacy protections comparable to New Zealand's, and your data remains subject to this policy and the safeguards described below.

Access to your data is enforced at the database level by Row-Level Security, and within families by a per-child, per-adult permission model — step-parents, grandparents and professionals only see what you grant them.

3. Who we share information with (and overseas disclosure — APP 8)

We do not sell your information. We use the following service providers. Some process data outside Australia (in the United States); by using the relevant features you consent to that disclosure.

| Provider | Purpose | Data they receive | Location | |---|---|---|---| | Supabase (AWS) | Database, file storage, auth | All app data | Australia (Sydney) | | Anthropic (Claude AI) | Optional AI: message tone check, receipt scanning, reading old records you add from other apps, the in-app helper, checking whether a new medicine you type is already in your child's list, reading a court order, parenting plan or a photo of a written arrangement you choose so it can suggest a care schedule, reading a school letter, newsletter or calendar you choose so it can suggest school holidays and pupil free days | Only the content you submit to those features (message text, receipt image, the text of old records you add together with your first name and your co-parent's first name, the question you ask the helper and the records it looks up on your device to answer it, or a medicine name you type together with the names of the medicines already in that child's list, names only, or the document you choose to have read for your care schedule: the whole document or the pages you pick, including anything else written in it, with your first name, your co-parent's first name and your children's first names and birth years, or the school letter you choose to have read for your school holidays: the pages you pick, with your children's first names and, where their school's name says it, whether it is a primary or secondary school). The medicine check runs only once AI features are turned on, and only when the app can't tell on your device. Old records are read only by AI, so adding them needs AI features turned on; what comes back is sealed with your own key before it is stored, and it is not used to train their models. When a document is read for your care schedule, CoParent keeps nothing: the document is sent to Anthropic (US) to be read, and the suggested schedule comes back to your device only, for you to check; nothing changes until you send it and your co-parent agrees. When a school letter is read, the letter is sent to Anthropic (US) to be read and CoParent keeps nothing unless you keep a copy in your Documents, which is sealed like any other document; the dates come back to your device only, and nothing is added until you check them. Anthropic handles it under its own terms, which may include keeping it for a short time for safety monitoring | United States | | Deepgram | Optional voice typing (speech to text) | Only the short audio clip you record while voice typing; the audio is not stored by us | United States | | Stream | Voice/video calls and, where a call is recorded, the recording | Your name, avatar, call metadata, call audio and recordings | United States | | Expo | Push notifications | Push token and notification text (may include your name) | United States | | Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) | Delivering incoming calls to your phone, and Android notifications that Expo cannot deliver | Your phone's push token, the caller's name, and the notification text (may include your name) | United States | | Your browser's push service (Google, Apple or Mozilla, depending on the browser) | Browser notifications from the web app, only if you switch them on | A subscription address for your browser and the notification, which is encrypted so the push service cannot read it | United States | | RevenueCat | Subscription management (App Store and Google Play) | An anonymous user ID and subscription status | United States | | Stripe | Card payments for subscriptions bought on the website | Your email, card details (entered on Stripe's page, never seen by us) and payment history | United States (Stripe holds Australian card data under its own PCI compliance) | | Resend | Emails from CoParent: invitations, sign-in and new-device codes, password and start-over notices, and security alerts | Recipient email, the recipient's and sender's names, codes and links, and the device name and reported place in security notices; never your password or records | United States | | Cloudflare (Turnstile) | Checking that a new sign-up is a person, not an automated program | Your IP address and technical signals from your browser or device during sign-up | United States / global | | Vercel | Hosting the coparent.au website and the web app | Your IP address, browser details and the pages you load, in standard web server logs. Your records are not stored by Vercel; the web app sends them straight to Supabase | United States / global | | Apple (iCloud), Google or Microsoft (Outlook) | Optional calendar sync, only if you choose to copy your CoParent events to one of their calendars (or connect Google Calendar or Outlook) | A copy of the event titles, times and places you can see in CoParent, sent from your phone straight to that company, outside CoParent's encryption | May be outside Australia (usually the United States) |

Our own staff analysis. CoParent staff look at app usage statistics (Section 1) in totals, for example how many people used the import this week, to run and improve the service. Staff can ask an AI assistant (Anthropic's Claude, United States) questions about those totals. It receives only aggregated, pseudonymous figures (counts, durations, versions and random identifiers, never names, email addresses or anything you wrote or saw in the app) and returns an answer to the staff member; Anthropic does not use it to train its models.

The AI features (Anthropic and Deepgram) are opt-in: the first time you use one, we ask for your consent and explain that your content is sent to the United States. Anthropic uses the content only to return your result and does not use it to train its models.

Calendar sync is also opt-in. By default it copies your events only into a calendar kept on your phone. If you choose an iCloud, Google or Outlook calendar instead, or connect Google Calendar or Outlook, the app first tells you that your events will be copied to that company's servers, which may be outside Australia, and copies nothing there unless you agree. Signing out or switching account removes the copy we made. Connecting Outlook asks Microsoft for access to your calendars, because Microsoft has no narrower permission; CoParent only ever adds to and changes the one CoParent calendar it makes.

A synced calendar can hold things other people in your family shared with you, like an event your co-parent added. So each person decides whether the events they add can show in other people's synced calendars, and until they say yes, theirs stay out. Care schedule days always show. You can change your answer any time in App preferences, Calendar sync.

4. How we protect your information (APP 11)

If you forget your password

Your password is the only key to your sealed records. We do not hold it, we cannot reset it, and we cannot open your records for you, for a court, or for anyone who asks. That protection has a cost, and this is it in plain words.

If you are still signed in somewhere. On any phone or browser where you are still signed in, you can set a new password. We email a six-digit code to your account address and, on a phone, ask for Face ID or fingerprint as well. Your records are re-sealed on your device with the new password; we never see either password. Every device on your account is told, by notification and by email, which device made the change, and for seven days the old password can undo it from any of your devices.

If you are signed in nowhere. You can ask to start over. We email a single-use link to your account address. On the start-over screen you choose a new password, and your screen shows six numbers. Someone who already shares your family's records with you then confirms it is really you and lets you back into them:

They ask you for the six numbers, by a phone call or a text between the two of you, and type them into their own app. CoParent never sees or stores anyone's phone number, and never sees the six numbers travel. Once they confirm, your records open again with your new password. A helper learns nothing new by doing this: they could already see your family's shared records, and they never see your password, your hint or your private vault.

If nobody can let you back in. If you have no co-parent and no helper who counts yet, the start-over screen says so before you ask. You can then start again with an empty account after a seven-day wait, and we tell you every day during that wait — by notification to every device on the account and by email — so that a start-over you did not ask for can be stopped. Your older records stay sealed and are not recovered by this — not by you and not by us. That is not a limitation we can lift later. Because of this, the app offers a download of your records before you sign out and at the start-over screen, and asks you once a year to take one. Keep it somewhere safe, and save your master password in a password manager so you never lose it.

Anyone can stop a start-over they did not ask for. Whenever a start-over is asked for on your account, you are told by notification and by email, and your Home screen lets you stop it ("That wasn't me") at any point before it finishes.

We keep no copy. We do not keep a copy of your password or of anything that would open your records without it. Letting you back in works only because a co-parent or helper who can already read your family's records re-shares them with you from their own device.

Email is a notice channel, not a key. No email link signs you in, and no email can change your password. Emails only tell you what is happening and let you stop it. If the address on your account is no longer one you read, you will not receive those notices; every device still signed in is still told, and your Home screen still lets you stop it. Keep the address on your account current.

What is recorded. Every one of these events is written to your account's history and shown to you there: a sign-in from a device we have not seen before (with the device name and the place the network reported, both of which can be wrong), a password change and which device made it, an undo of one, a start over requested, paused, resumed or finished, a device removed, a family key handed back, and a recovery refused. Each entry names who acted, on what device, and when. Your co-parent sees the entries that concern shared records — that you started over and that a key was handed back — because those events change what the two of you can read. They are not told your password, your hint or anything about your private vault.

What is emailed. A recovery notice contains your name, the device name and reported place, the time, and a link to stop or continue. It never contains your password, your hint, a key, or any of your records.

Your private vault. Records in your private vault are sealed with a key only you hold. No co-parent can hand that one back. If you forget your password and have no device still signed in, vault records are gone.

If your subscription has lapsed. Recovery works exactly the same way on an unpaid or lapsed account. We never hold your records hostage to a payment: you can always start over, always receive the notices, and always download your records.

5. Sensitive information

Some information you enter — health and medical records, and details that may reveal religion, ethnicity or similar — is "sensitive information" under the Privacy Act and receives a higher level of protection. We collect and use it only with your consent and only to provide the service to you and the people you authorise. You can withdraw consent for optional uses (such as AI features) at any time.

6. Shared records and multi-user accounts

CoParent exists to keep a shared record between co-parents (and the family members or professionals they authorise). As a result, much of the information in the app — messages, calendar entries, expenses, documents, and related metadata — is the personal information of more than one person at the same time, and other users may rely on it for personal recordkeeping or for legal/evidentiary purposes.

For this reason:

Where we retain a shared record that is mainly about you, we apply data-minimisation and, where feasible, de-identification to limit the impact.

Readers: support people added to a conversation

Either parent may add a person from their own Care Network (for example a new partner, a grandparent, a lawyer or a therapist) as a reader of a one-to-one conversation or a mail. A reader can read that conversation and its attachments; they cannot write in it, cannot export it, and the app's AI Helper does not read it on their behalf. A reader can read only messages sent after they were added, never earlier ones.

The other parent's agreement is not required, but the disclosure is never hidden: the reader's name and their role in the family are shown in the conversation, a line written by our server is added to the conversation when a reader is added or removed, the change is recorded in the audit log, and both form part of any record exported from the app. A reader's reads are shown separately from the other parent's read receipts.

Adding a reader is a disclosure of your personal information, and of the personal information of the other parent and your children, to a third party. We disclose it because you or the other parent instructed us to. Adding a reader gives that person no other access to your account, your children's records or your documents.

Drafts

A message or mail you have started but not sent is saved so that you can finish it on another device. Drafts are encrypted on your device with your personal key before they are stored; nobody else, including the other parent, holds that key. Drafts are visible only to you, are deleted when you send or discard them, and unsent drafts are deleted automatically after 30 days. A draft you never send is not part of the shared record and is not included in an export.

7. Retention and deletion

We retain personal information only as long as necessary for the purposes we collected it, including legal, accounting and evidentiary purposes. Retention varies by type:

Because co-parenting records may be required by a court, deleting your account does not erase your data immediately. When you delete your account:

You may also "close" your account (without starting the deletion clock) and reopen it any time. Even if your subscription lapses, you can still export your records — you will not lose access to your evidence because a subscription ended.

When we cannot delete. We may be unable to action a deletion or erasure request where: there is a court order or legal obligation to retain the data; the data is needed for actual or prospective legal proceedings or to obtain legal advice; or the data is a shared record of another user (Section 6). We will tell you when an exception applies.

8. Your rights

You can:

To exercise these rights, contact us below. We aim to respond within 30 days.

9. Automated decision-making

CoParent does not make automated decisions that have legal or similarly significant effects on you. The AI features (message tone check, receipt scanning, reading old records, the medicine list check, reading a document to suggest a care schedule) are advisory only — they help you, and a human (you) remains in control of every action. We do not profile you or use your data for automated decisions about you.

10. Data breaches

If we become aware of a data breach likely to result in serious harm, we will assess it and, where required, notify affected individuals and the relevant regulator — the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and the Office of the Privacy Commissioner (OPC) in New Zealand under the Privacy Act 2020.

11. Children

CoParent is used by adults to manage information about their children. Information about a child is entered by a parent/guardian and shared only with the adults that parent authorises through the per-child permission model.

Children's accounts

DRAFT section (added 3 October 2026) — flagged for privacy-lawyer review, including against

the OAIC's Children's Online Privacy Code (being developed under the Privacy and Other Legislation Amendment Act 2024) and New Zealand's guidance on children's privacy.**

A co-parent can set up a CoParent account for a child from Care Network. It is free and meant for teenagers; there is no set minimum age, and the child's parents decide when their child is ready. Every child's account signs in with an email address (the child's own, or one a parent looks after); there is no way to sign in without one.

12. Professional and extended access

A parent can grant limited or read-only access to extended family (e.g. grandparents, carers, step-parents) and to professionals (lawyers, Independent Children's Lawyers, mediators, therapists) that they authorise. Whenever anyone other than a co-parent is added, the other co-parent is notified; granting full co-parent-level access requires the other co-parent's approval first. Professionals must provide their registration details and are verified by us before they receive access to records beyond messages and calendar; a verification status is shown to the parents. To verify a professional we look up their business number on the public Australian Business Register (ABN) or New Zealand Business Number register (NZBN); only that number is sent. Professionals have read-only access and are responsible for handling any information lawfully.

13. Call recordings

Voice and video calls made in the app may be recorded, depending on each person's own recording setting. Everyone on the call is told before it is recorded, and a notice is shown on screen for the whole call while recording is running. Calls are never transcribed: there is no live transcription and no written transcript is made. Recording is performed by Stream (United States, see section 3). As soon as a participant next opens the app, the recording is encrypted on their phone with the family key, stored with your records in Australia, and Stream's copy is deleted; from then on only participants holding the family key can play it, and CoParent cannot. Older calls keep any transcript they already have, stored the same way. Recordings and those transcripts are kept and deleted with the rest of your records (section 7).

14. Business changes

If CoParent is involved in a merger, acquisition or sale of assets, your information may be transferred to the successor, who must continue to honour this policy. We are committed to data continuity: your records remain exportable and retained for the stated retention period even if the service changes hands or winds down.

15. Contact us

Privacy enquiries and requests: [INSERT CONTACT EMAIL]

If you are not satisfied with our response, you may contact your privacy regulator: in Australia the OAIC (oaic.gov.au), or in New Zealand the Office of the Privacy Commissioner (privacy.org.nz).

16. Changes

We may update this policy. Material changes will be notified in-app.