Privacy at COICILY.

This explains how this early version handles your data.

Sign-in and accounts

Google provides your account identity, name, email, and email verification status. We store these to recognize your account. Your email is not public. We do not request access to Gmail or Google Drive.

Community content

Your username, display name, bio, profile photo, banner, published posts, images, replies, and published artworks are public, including older publications. Anyone can read them without signing in. Search engines may index them and others may copy or share them. Private communities, direct messages, group chats, and unpublished editor drafts remain restricted. Interacting requires an account. Blocking an account cannot prevent logged-out reading of public content. Removing a publication stops new public reads on Coicily but cannot recall copies saved elsewhere. Exported PNGs can be shared outside COICILY. Deleted or removed posts are hidden from community view but retained in the database for moderation. Reports and account warnings are available to authorized admins and moderators; you can see your warnings in Settings.

Workspace cloud projects

Saved Workspace projects, including unpublished drafts and their assets, sync privately to your account. Authorized admins can inspect and download these cloud projects and generate an addon for review. These actions are recorded in the admin activity log. Moderators and other members cannot access your private Workspace files. Unapplied editor forms and changes still offline on your device are not included. Conflict recovery copies are retained for up to 30 days, limited to three per project and 100 MB per account; older copies may be removed sooner to keep within these limits.

Sessions and images

Session cookies keep you signed in. Sessions are stored in our database along with their expiry, available device details, and IP address. Authorized admins can inspect session IP addresses and user-agent strings to investigate abuse; those inspections are audited. Device details may be inaccurate. Session metadata expires with the session (normally seven days). Sign-in IP and device history is kept for up to 90 days and cleaned by the maintenance worker; network bans and administrative decisions remain recorded for review. Signing out ends that account’s session on this browser. You may save up to five accounts using signed HttpOnly session cookies. Switching accounts applies across tabs; drafts remain scoped to their original account. Remove an account from the switcher to end its saved session. Uploaded images are processed into WebP and stored separately from the database. Posted images, profile images and published artwork are visible immediately without prior approval. Staff review reports and may remove content; repeated eligible reports can temporarily hide content pending review. Live canvas frames are shared with signed-in members immediately and cannot be pre-reviewed. You can appeal image and content decisions in Settings. No external image classification service receives your uploads.

Link previews

When a message contains a link, COICILY may retrieve public page metadata and an image from that destination to show a preview. These requests use our server, without forwarding your session cookies or message text. Preview metadata may be cached briefly. Opening the link takes you to the destination website.

Canvas

Saved canvas documents and editable layers are accessible only to their owner. Broadcasting is off by default. Choosing Start live shares periodic flattened PNG canvas images with signed-in members. Stop live or leave the studio to end the broadcast. The latest live image is held temporarily in server memory; live frames are not saved as recordings. Camera, microphone and other browser content are not shared. Moderators can stop a live session and restrict hosting. Unsaved changes may be kept in local browser storage for recovery. Publishing shares a flattened image, title, and description in the Canvas gallery; editable layers stay private. Undo history lasts for the current editing session and can be restored after using Save and reload for an app update on the same device and account. Update recovery copies expire after seven days. Invited collaborators can view the shared canvas and draw on their own layers. Shared strokes are stored for synchronization and recovery and saved into the host’s project. Cursor positions are temporary. Deleting a canvas does not delete an already published artwork.

Your feed

For you uses follows, likes, hashtags, and recently viewed posts to suggest conversations. Viewed-post history is retained for up to 90 days; aggregate view counts remain on posts. Repeat views can count after a cooldown. Feed selections expire after two hours, and hidden suggestions expire after 90 days.

Following, presence, and notifications

Your message settings control who can contact you directly, send a request, or not contact you. Messages are stored in our database and are not end-to-end encrypted. Unfollowing applies your current message settings; existing history remains available. Only specific messages reported by their recipient are shown to moderators. Your online status is visible to other community users unless disabled in Settings. Public text statuses disappear after 24 hours; private replies follow your message settings. Consenting conversation partners can see a short-lived typing indicator; it contains no keystrokes or message text. Removed messages remain available as moderation evidence but are hidden from conversations.

Push notifications are optional and configured per device. Message previews include the sender and message text unless you turn previews off. Your browser’s push service delivers notifications. Signing out revokes that session’s push subscriptions. The app does not cache private pages or messages for offline browsing.

Communities and chat attachments

Public Communities are discoverable; private Communities require an invitation. Members can read the conversation history. Community owners and Community moderators manage only their own Community. Site staff can review specific reported messages and their attachments, including private ones. Images are re-encoded without their original metadata. Leaving or being removed revokes access to private Community images; recipients may already have saved a copy. Deleted messages display a notice and are retained as moderation evidence. Mentions identify an account and can generate a notification without including private message text. Live viewer lists show your public profile while you are present.

Total online

The public online total estimates active guest browsers and signed-in accounts within the last 75 seconds. It never lists identities. Multiple tabs share one browser presence; signed-in devices using the same account count once. A signed session cookie and a short-lived hashed identifier support this operational count, including when marketing measurement is disabled. Presence expires from the total after inactivity; the maintenance worker deletes rows older than two minutes. This total is an estimate, not a count of unique people, and does not reveal your individual online status.

Usage and service statistics

We count visits and page views to operate COICILY. A signed, first-party cookie identifies a browser for up to 30 days; a new session is counted after 30 minutes of inactivity. Statistics store the broad application area, not private message text, search terms, draft contents, or full URLs. Anonymous visits with Do Not Track enabled are excluded. Daily visitor identifiers are hashed and do not include IP addresses.

Only admins can view who is currently active and which broad application area they use, including accounts whose public online status is hidden. Recent visit sessions are deleted after one day; daily statistics lose their account association after 90 days. Aggregate daily counts remain. Moderators cannot access visitor analytics, server metrics, session IPs, or device history.

Discovery and growth measurement

A separate signed first-party cookie, coicily_growth, lasts up to 30 days and estimates a browser, not a unique person. We record broad page categories, guest/authenticated state at the time of each event, onboarding stage, coarse mobile/desktop device type, categorized referrer and bounded campaign labels. We do not store full URLs, search terms, message contents or editor drafts in these events. Do Not Track and Global Privacy Control exclude this measurement for both guests and accounts. Known automated user agents are excluded, but detection is imperfect. Campaign labels must never contain personal information.

Login links the current measured browsing session to the account; earlier events retain their guest state. Logout, switching accounts or 30 minutes without measured activity starts a new session context. Successful follows, replies, publications, account creation and onboarding are measured from server outcomes when measurement is available. Raw event identifiers and account associations are retained for up to 90 complete days, then the maintenance worker removes them. Daily aggregate counts remain. Short-lived hashed rate-limit keys help prevent abuse; raw IP addresses are not stored in growth analytics.

Admins can grant specific accounts aggregate growth-report access. That permission does not grant access to private messages, individual reading histories, active-account lists, IP records or administrative tools. Operational visitor statistics are a separate historical series and are not used to reconstruct earlier marketing funnels.

Development stage

Self-service account deletion and data requests are not yet available. Retention policies and data request procedures need to be completed before public launch.