Privacy Policy

Coohoo is an independent product operated by an individual developer based in Ukraine (“Coohoo”, “we”, “us”). It consists of the website at coohoo.app, the dashboard, and an embeddable visual-feedback widget. For any privacy question or request, contact hello@coohoo.app.

For your Coohoo account (your email and project settings) we are the data controller.

For feedback collected through the widget on your site, you — the site owner who installed it — are the data controller, and Coohoo acts as a processor handling that data on your behalf. You are responsible for having a lawful basis to collect it and for telling your reviewers that their feedback is collected and visible to you.

Feedback data (via the widget): the name a reviewer types on a comment, the comment or reply text, the URL of the page it was left on, and basic environment metadata (browser, operating system, and screen size). No account or login is required to leave feedback. The widget is designed to auto-disable on production domains, so it does not run for your live visitors.

Account data (site owners): your email address (for magic-link or Google sign-in) and the projects and settings you create.

Technical data: we process IP addresses transiently to rate-limit and prevent abuse of the public write endpoints. IP addresses are not stored alongside comments.

The dashboard uses a single essential authentication cookie to keep you signed in. We use no advertising cookies and no cross-site tracking, and the widget sets no cookies at all.

Product analytics & error tracking: in the dashboard we use PostHog (EU region) to understand usage and catch errors. It is configured cookie-free — it stores an anonymous identifier in your browser’s local storage (not a cookie), and for signed-in owners we associate events with your account email. It may also capture the URL and stack trace of an error to help us fix it. PostHog is not present in the embeddable widget.

The widget stores a small identifier in the host page’s local storage to remember a reviewer’s display name and which of their own comments they can edit. It is not used to track people across sites.

Under the GDPR (where it applies), we rely on:

• Performance of a contract — to provide the dashboard and widget and to send your sign-in email.
• Legitimate interests — to keep the service secure, prevent abuse of public endpoints, and understand product usage and diagnose errors (privacy-friendly, cookie-free analytics).

We never sell your data or use it for advertising.

We share data only with the providers needed to run Coohoo, each acting under its own terms. As of the effective date these are:

• Convex — backend and database hosting (comments, replies, projects, accounts).
• Cloudflare — dashboard hosting, widget CDN, and DNS.
• Resend — sending transactional sign-in emails.
• PostHog (EU region) — product analytics and error tracking in the dashboard (not in the widget).
• Google — optional OAuth sign-in, if you choose it.

We operate from Ukraine, and our infrastructure providers may process data in the European Union and the United States. Where personal data is transferred across borders, those providers rely on appropriate safeguards (such as the European Commission’s standard contractual clauses) within their own agreements.

Feedback is kept until the project owner deletes it. Deleting a comment removes its replies; deleting a project removes its comments, replies, and memberships. Account data is kept while your account exists. Sign-in emails and abuse-prevention logs are short-lived.

Data is transmitted over HTTPS, and access to a project’s comments is limited to the owner and members they invite. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

Depending on where you live (including under the GDPR, UK GDPR, and CCPA), you may have the right to access, correct, delete, restrict, export, or object to our processing of your personal data, and to withdraw consent. To exercise any of these, email hello@coohoo.app. For feedback left through the widget on someone else’s site, that site owner is the controller — contact them, and we will help them respond. If you are in the EU or UK, you also have the right to complain to your local data-protection supervisory authority.

Coohoo is not directed to children under 16 and is not intended for collecting feedback from them. Please don’t use it to do so.

We may update this policy; the “last updated” date above always reflects the current version, and we’ll flag material changes by reasonable means.

Questions or requests? Email hello@coohoo.app.