How Cochild collects, uses, and protects your personal data.
This Privacy Policy explains how Cochild Pte. Ltd. collects, uses, stores, and protects your personal data when you use the Cochild Application. It should be read alongside the Cochild End User Licence Agreement.
Cochild Pte. Ltd. (UEN: 202547888Z), 36 Carpenter Street #02-01 Carpenter Haus, Singapore 059915 is the data controller for the purposes of this Policy.
This Policy is written in plain language by design. If anything is unclear, please contact us.
We collect the following categories of data when you use the Application:
Your name, email address, encrypted password, profile photo, and profile details provided during registration. You sign in to Cochild with your own email and password; Singpass is never a sign-in method. Where you choose to verify your identity through Singpass, the additional information described under "Singpass and Myinfo" below is also collected.
Singpass is used only to verify your identity. It is never a sign-in method for Cochild, and you always sign in with your own email and password. Verification is optional for most of the Application, but is required before you can link your Account to your co-parent's family record, so that both parents on a shared family record are verified identities.
If you verify your identity through Singpass, then with your consent we retrieve the following from Myinfo, which is provided by the Government Technology Agency of Singapore (GovTech): your name, alias, NRIC number, email address, mobile number, registered address, and the records of your children held in Myinfo. We do not request your marital status, or any Myinfo field beyond this list.
Each field is used as follows: your name, alias, email address, mobile number, and registered address are used to pre-fill your registration details; your name and alias are matched against the parties named in any court order you upload, to confirm you are the parent named in it; and the records of your children held in Myinfo are offered to you for selection when you set up your family record. Myinfo returns all of a parent's registered children, not only those relevant to this family — only the children you select are added to your family record, and any records you do not select are discarded at the end of your Singpass verification session and are never stored. See Section 5 for how your children's data is otherwise handled.
Your NRIC number is used to establish your identity to a high degree of fidelity and to match your records, and is not stored in readable form: we keep only a keyed one-way hash (HMAC) of it, which lets us match records without being able to recover the number. The other Myinfo fields are stored encrypted. Cochild receives only the data you choose to share on the Singpass consent screen, and never your Singpass password or other Singpass credentials — these are never shared with, or visible to, Cochild.
Children's names and dates of birth, access schedules, court order details, compliance events, and records relating to access that you enter. When you upload a court order PDF, it is sent to Anthropic for parsing. The PDF itself is not kept in a document vault. We store the details you review and confirm, such as parties, children, schedules, and maintenance terms.
You can enter your co-parent's details and a court order before they have joined Cochild. This means we may hold personal data about a person who has not yet created an account or seen this Policy. Please enter only information you are entitled to share. Once your co-parent joins, they have the same rights as any user, and a person whose details were entered before joining can contact privacy@cochild.com to ask what we hold and to request correction.
If you upload a receipt or proof of payment, the image is read by Anthropic using Claude Haiku to extract details such as the amount, date, and payee. Please remove anything you do not want processed before you upload.
If you subscribe to Cochild Monthly, we receive your subscription status (for example, active, trialling, or cancelled) from the App Store or Google Play, so the Application can unlock the features your subscription covers. We never receive your payment card or other payment instrument details — these are handled directly between you and Apple or Google.
When a parent records a pickup, a drop-off, or takes an emergency action in the Application, we capture that parent's GPS position and IP address at that moment. This record is visible to the co-parent as part of the shared access event log. It is separate from the Child Location feature described below.
Depending on the features you use, we also collect: wellbeing check-ins recorded by parents; Hopes & Goals entries; Conflict Resolution content, which is text you choose to share with your co-parent; visit journals; photos added to the family album; the content of messages sent and received through Email Hub; push notification tokens for your devices; and profile photos.
Messages sent through the platform, subject to the AI moderation process described in the Cochild EULA. Once a message has passed moderation (or been rewritten and approved by you), it is encrypted and stored as part of your conversation history so that you and, for shared conversations, your co-parent can read it. A blocked message's text and the reason it was blocked are also stored, encrypted, so you can review the decision — a blocked message is never delivered to your co-parent. Message content is never used to train AI models. Message text is processed by Anthropic for moderation (see Section 6), and Cochild holds the encryption keys. Cochild staff do not read messages as a matter of routine and access content only where strictly necessary to investigate a reported problem, or where required by law.
Timestamps, frequency of interactions, schedule change requests, and moderation events. This is structural data about how the platform is used. It is not the content of your communications.
Device type, operating system, and app version, used solely for maintaining and improving the Application.
Where a parent has enabled Child Location sharing for their child, we collect the child's device location while the Kids Mode app is open, or when the child sends a manual "I'm here!" check-in. Outside of a scheduled access period, only an approximate location (accurate to roughly 3 kilometres) is ever calculated or stored — the precise position is never retained. Precise location is calculated and stored only during an active, scheduled access period. Location sharing is off by default, opt-in, and governed by permission tiers based on the child's age: for children under 13, a parent controls sharing; for children aged 13–15, sharing changes require both parents' agreement and the child's request; for children 16 and over, the child alone controls their own sharing. The trail of past locations is retained for 7 days and then automatically and permanently deleted; your child's single most recent shared location is kept only for as long as location sharing stays enabled, and is replaced each time a new position is shared. Cochild does not perform continuous background location tracking — location is only ever captured while the Kids Mode app is open in the foreground, or on a manual check-in.
The Application may use your device's built-in biometric authentication (such as Face ID or fingerprint) to unlock the app or confirm a payment. This authentication is performed entirely by your device's operating system. Cochild never receives, collects, or stores any biometric data itself.
Cochild makes the following unconditional commitments:
These commitments are permanent and form a core part of Cochild's identity as a Social Enterprise.
We use your data for the following purposes and no others:
Kin is an optional AI assistant available to parents within the Application. It provides supportive conversation and can proactively check in based on signals like an upcoming access handover or an overdue maintenance payment. Kin is never available to children.
To respond helpfully, every message you send Kin is accompanied by a pseudonymised summary of your family's situation: your access schedule, your compliance and maintenance payment status, and your current harmony score (the score shown on the Harmoniser screen) — each child identified only by a placeholder such as "child_1" with an age, never a full legal name. Kin never receives the content of your conversations with your co-parent.
Every message you send to Kin is checked by an automated wellbeing signal. If it detects language suggesting you may be in crisis, Kin responds with a fixed, calm message pointing you to appropriate support services (such as Singapore's National Care Hotline), and Cochild logs that a crisis-level message occurred. That log records only a hashed, non-reversible reference to your account and the time — never the message content itself — and is used solely to help us understand and improve this safety feature. It is not read by Cochild employees as a matter of routine and is never shared with your co-parent.
You may turn Kin off at any time from Settings or from within your Kin conversation, except while a crisis-support message is actively being shown to you.
Children's information entered into the Application — names, dates of birth, schedule details — is treated with the highest level of protection. This data is used solely to provide the co-parenting features of the Application. It is never shared with any third party other than the processors listed in Section 6, never used in aggregated analytics in any identifiable form, and never processed for any purpose other than delivering the service to you and, where applicable, your child — for example, your child's name and date of birth are sent to Anthropic only when a court order naming your child is parsed, as described in Section 6.
If a parent verifies their identity through Singpass, Myinfo may return records for all of that parent's registered children, not only those in this family. These are shown to the parent for selection only — only the children they select are added to the family record, and any records they do not select are discarded at the end of the Singpass verification session and are never stored. See "Singpass and Myinfo" in Section 1 for detail.
If a parent sets up a Kids Mode account for their child, the Application additionally collects: a display name and a parent-set username and passcode for the child's sign-in; messages the child sends to and receives from their own parents; photos and other items shared to the family album; and, only if a parent has separately enabled it, the child's location, exactly as described under "Location Data" above. Kid Mode does not currently include a mood or wellbeing check-in feature. If we introduce one, we will update this Policy to describe what is collected and how before it is switched on, and any such feature will be optional.
Your child's data is visible only to the two parents or guardians verified on that child's family record inside the Application. It is never visible to a co-parent on a different family record, a third party, an advertiser, or an analytics provider, and it is never used to build advertising profiles. This boundary is enforced in how our systems are built, not only in this Policy: the underlying access rules are structured so that a child's messages, location, and account details can only be read by the verified parents linked to that specific child, and by the child's own Kids Mode account for its own data — never a sibling's.
A child cannot register for the Application independently. A parent or guardian consents to the collection and processing of their child's data by accepting the Cochild EULA on the child's behalf when they add the child to their family record or set up a Kids Mode account, and this parental consent is the basis on which we process a child's data generally.
For location sharing specifically, we layer an additional, age-tiered consent model on top of parental consent, consistent with Singapore PDPC guidance on processing children's data: for a child under 13, a parent controls whether sharing is switched on; for a child aged 13 to 15, turning sharing off requires the child's own request together with both parents' agreement, so the child has a genuine say; and for a child aged 16 or over, the child alone controls their location-sharing setting, and a parent cannot override it. Where a child's date of birth is not on record, we apply the most protective, parent-controlled tier by default.
A parent may choose to set up a restricted "Kids Mode" account for their child, giving the child their own sign-in (a username chosen by the parent, and a passcode) to a deliberately limited part of the Application: messaging with their own parents, a shared family photo album, and — only if a parent has enabled it — location sharing as described above. A child's Kids Mode account cannot access payments, court order documents, the co-parent conversation, or any other adult-only data. A parent can reset their child's passcode or pause their child's access at any time. We do not knowingly collect more personal data from a child than is necessary to provide these limited features, and Kids Mode contains no advertising and no Kin AI assistant.
Your child's data is retained for as long as your family's Cochild account is active, subject to the more specific rules described elsewhere in this Policy — for example, the 7-day retention period for location history. A parent can pause their child's Kids Mode account or reset its passcode at any time from within the Application. To permanently delete a child's Kids Mode account and its associated data, or to request a copy of the data we hold about your child, contact us at privacy@cochild.com. As with the other rights described in Section 9, we will action your request within 30 days.
For Kids: What This Means, in Plain Words
If your mum or dad sets you up with your own Cochild sign-in, here's what's true:
Cochild uses a small number of third-party services to operate the Application. Google Firebase, Anthropic, and Twilio SendGrid are data processors acting on our instructions only:
Apple and Google are not Cochild's processors acting on our instructions. They act independently, each in two separate roles: as the platform through which the Application is distributed, and as the payment processor for Cochild Monthly subscriptions, under their own App Store and Google Play terms.
The Government Technology Agency of Singapore (GovTech) is also not Cochild's processor acting on our instructions. When you choose to verify your identity through Singpass, GovTech is the source of the Myinfo data you consent to share with us on the Singpass consent screen. GovTech does not process data on our instructions, and your Singpass session itself is governed by GovTech's own terms, not this Policy.
We do not share your personal data with any other third party without your explicit consent, except where required by law.
This section describes, in plain technical terms, what actually happens when a feature sends your content to Anthropic. It is additional to, and does not replace, the in-app consent the Application separately asks you to give before each of these features processes your content for the first time. If you decline that in-app consent for a feature, your content for that feature is not sent to Anthropic, regardless of what this Policy describes.
Anthropic and Twilio SendGrid are processors based in the United States, so personal data sent to them leaves Singapore. In line with section 26 of the PDPA and the Transfer Limitation Obligation, we require a standard of protection comparable to that under the PDPA from both. For Anthropic specifically, this is secured through Anthropic's Data Processing Addendum, which forms part of our commercial agreement with them. It commits Anthropic to: process our data only on our instructions, and never sell it or combine it with data from other sources; encrypt data to a minimum of AES-256 at rest and TLS 1.2+ in transit; bind its staff to confidentiality; give us notice before engaging a new subprocessor; return or delete our data within 30 days of our agreement ending; and submit to an independent audit of its compliance. It also incorporates the EU Standard Contractual Clauses (Module Two) governing the transfer itself. Google Firebase services may also process data in more than one country.
Under our commercial agreement with Anthropic, none of the content we send to Anthropic — message text, court order text, receipt images, or your Kin conversations — is used to train Anthropic's models. Anthropic uses commercial customer content for model training only where a customer has separately opted in to a programme for that purpose, and Cochild has not done so.
We retain your personal data for as long as your Account is active. The following describes precisely what happens to data when an Account is deleted, reflecting the shared nature of co-parenting records.
Your personal authentication record and profile are removed from the platform. Shared family records — including access event logs, conversations, access schedules, and compliance records — remain intact for the benefit of the other parent, who retains a legitimate interest in those records. Children's data follows the family unit and is not deleted while either parent's Account remains active. The deleting parent's own 30-day grace period applies first, as described below.
All family data — including all shared records, children's data, documents, and communications — is permanently and irreversibly deleted from our systems within 30 days of the second Account deletion. This is the second parent's own grace period, so deletion completes when that period ends. Apart from the crisis-detection logs described in the retention schedule below, no residual personal data is retained. If we ever create aggregated, de-identified statistics that cannot be linked back to any individual, they may be retained for research and public interest purposes.
Account deletion is initiated from the Settings screen within the Application. You will be asked to confirm with Face ID or your device passcode. A 30-day grace period follows, during which your Account is suspended but not yet permanently deleted. This allows you to reverse the decision if it was made in error. After 30 days, deletion is permanent and cannot be undone. We recommend exporting your data before initiating deletion.
In accordance with your right to data portability, you may request a copy of your personal data at any time by contacting privacy@cochild.com. We are working on an in-app self-service export (conversation history and access event log, in PDF or CSV format); until it ships, we will provide your data manually within 30 days of your request. This right exists independently of Account deletion and may be exercised at any time.
We use industry-standard security measures including:
We will notify you and the relevant data protection authority of any data breach in accordance with applicable law. The Singapore process is set out in Appendix A1.
You have the following rights in relation to your personal data. To exercise any of these rights, contact us at privacy@cochild.com. We will respond within 30 days.
If you are located in the European Union or United Kingdom, you also have the right to lodge a complaint with your local data protection authority.
Singapore residents may address complaints to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
None of this exists yet. No Welfare Signal is generated in the current version of the Application and no data is shared with any agency. This section describes how the feature would work if it were introduced.
Cochild may in future offer a Family Welfare Signal feature, developed in partnership with authorised social service providers including the Family Justice Courts and the Ministry of Social and Family Development. The purpose of this feature would be to identify individual families who may benefit from early intervention support, before situations escalate to crisis. Because it would relate to identifiable families, it would run only with your opt-in consent, and it is separate from any aggregated statistics described in Section 3.
The Welfare Signal is built exclusively on behavioural metadata — for example: repeated access schedule breaches, high frequency of blocked messages, or sustained changes in communication patterns. It does not involve reading, analysing, or sharing the content of any message, document, or communication.
The distinction is fundamental: the Welfare Signal observes what happens, never what is said.
When this feature is introduced:
We will update this Policy before this feature becomes active, and you will have the opportunity to review the updated terms.
We may update this Policy from time to time. When we make material changes, we will notify you through the Application and by email at least 14 days before the changes take effect.
Where a change materially alters the purposes for which we collect, use, or disclose your personal data, continued use alone will not be treated as your consent. We will ask you to review and agree to the change through an in-app consent prompt before it applies to you. For other changes, your continued use of the Application after the effective date means you accept the updated Policy.
The following supplements apply in addition to the main Policy where you are located in the relevant jurisdiction. In the event of any conflict between a regional supplement and the main Policy, the regional supplement shall prevail for users in that jurisdiction.
This supplement applies to users located in Singapore and governs our compliance with the Personal Data Protection Act 2012 (PDPA) and its associated regulations.
This supplement applies to users located in the European Economic Area. The processing of your personal data is governed by the General Data Protection Regulation (EU) 2016/679.
Lawful basis for processing:
You have the right to lodge a complaint with the data protection authority in your EU member state. A list of authorities is available at edpb.europa.eu.
If you are located outside Singapore, Cochild transfers your data to Singapore under appropriate safeguards including standard contractual clauses where required.
This supplement applies to users located in the United Kingdom. The processing of your personal data is governed by the UK GDPR and the Data Protection Act 2018.
The lawful bases for processing are as described in Supplement A2 above, applied under UK law. You may lodge a complaint with the Information Commissioner's Office at ico.org.uk.
This supplement applies to users located in Australia. The processing of your personal data is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
36 Carpenter Street, #02-01 Carpenter Haus
Singapore 059915