Privacy Policy
Version: 2026-10-09
Version of 9 October 2026. For accounts created before that date it takes effect on 23 October 2026; until then the previous version of 29 September 2026 applies to them, except that accounts created before 29 September 2026 remain on the version of 22 July 2026 until 13 October 2026.
This Policy explains what personal data Coordio collects, why, on what legal basis, and what you can do about it.
1. Who is responsible
The controller of personal data is Andrii Ursolov, Ukraine — the operator of https://coordio.net.
Data requests: support@coordio.net. We answer within 30 days.
2. What we process
| Category | What exactly | Source |
|---|---|---|
| Account | email, name, username, password (bcrypt hash only), avatar, bio, skills | you |
| Authentication | Google/Facebook identifier (if you sign in that way), phone number and one-time code (if you sign in by phone), time and IP of last sign-in, sign-in attempt log | you and the sign-in providers |
| Your content | messages, notes, tasks, events, boards, files, comments, reactions, bookmarks | you |
| Usage | settings, themes, language, channel read state, streaks and focus sessions, markers of key steps completed (first note, first idea and so on) | you |
| Technical | request IP address and User-Agent (abuse protection), error logs | automatically |
| Notifications | your browser's push subscription | you, after granting browser permission |
| Invitations | the email address of someone you invite to a channel, project or call | you |
| Waiting list | the email address (and an optional note on what you want to use Coordio for) you leave when sign-up is by invitation only; the campaign tags of the link you came from | you |
| Integrations | access tokens for services you connected (network drives, publishing platforms, Telegram) and the settings of those connections | you and those services |
We do not use advertising trackers, do not set third-party analytics cookies, and do not buy data about you. The cookies we do set are functional: your sign-in session and your language choice.
3. Why, and on what basis
| Purpose | Basis (GDPR art. 6) |
|---|---|
| Providing the Service: account, chat, files, tasks | performance of a contract |
| Account emails (address verification, password reset) | performance of a contract |
| Abuse protection: rate limiting, sign-in log, IP blocking | legitimate interest — security of the Service and its users |
| Handling content reports | legitimate interest + performance of a contract |
| Push notifications about activity | your consent — the browser permission (revocable in settings) |
| Keeping you on the waiting list and sending you an invitation when your turn comes | your consent — you submit the address and the note yourself |
| An invitation email to someone whose address you entered | legitimate interest — yours as the inviter, and the recipient's in learning of the invitation; the address is used for that invitation only |
| First-party usage statistics — which key steps users go through, with no third-party analytics | legitimate interest — improving the Service |
| Meeting legal requirements | legal obligation |
4. Who receives the data
We do not sell data. We use processors that handle data only on our instructions:
| Processor | Role | Location |
|---|---|---|
| Vercel Inc. | application hosting, storage of uploaded files (Blob) | US / global |
| Neon Inc. | PostgreSQL database | EU / US |
| Upstash Inc. | Redis for rate limiting (stores counters only) | EU / US |
| Inngest Inc. | background job queue (running AI agents and scheduled actions) — record identifiers only, never their content | US |
| PartyKit (Cloudflare) | real-time server — message delivery and presence | global |
| LiveKit Inc. | video calls (media streams, for the duration of the call) | global |
| Resend Inc. | delivery of transactional and invitation emails | US / EU |
| Twilio Inc. | SMS one-time codes, if you sign in by phone — the number and the code | US |
| Google LLC, Meta Platforms | Google / Facebook sign-in, if you choose it | US |
| Browser push services (Google, Mozilla, Apple, Microsoft) | push notification delivery; the notification content is encrypted for your device | US / global |
| Anthropic PBC, OpenAI OpCo LLC, Google LLC | processing AI-feature requests — scope set out below | US |
What an AI model receives. Only when an AI feature has been invoked:
- an AI agent mentioned in a channel — the message that mentions it, up to the 50 most recent messages of that channel (text and author names, including other members'), the channel's name and description, and notes the agent saved earlier;
- a task assigned to an AI agent — the task's title, description and comments with author names.
Email addresses are not sent to the model. Under their API terms, the model providers we use do not train models on data sent through the API.
An agent's owner may set their own API key or their own model server (Ollama, for example). The same data then goes where the agent's owner pointed it and is handled under that provider's terms — it is not our processor and we do not control it.
Services you connect yourself. If you connect a network drive (Google Drive, Microsoft OneDrive, Dropbox), a platform for auto-publishing (Telegram, Discord, Slack, Facebook, Instagram, Threads, WordPress, a webhook), or mirror an external source, we send that service what the action you started needs: a file, a post, a read request. From there the data is handled under that service's rules.
Separately, we disclose data where the law requires it (a court or authority order), or to protect the rights and safety of users.
5. Transfers outside Ukraine and the EEA
Some processors are located in the US. Transfers rely on Standard Contractual Clauses (SCCs) and/or the provider's participation in the EU-U.S. Data Privacy Framework.
6. How long we keep it
- Content and account — as long as the account exists.
- Sign-in attempt log (email, IP, User-Agent, outcome) — 90 days, including after account deletion: it exists for abuse protection; older entries are deleted automatically.
- Waiting list (email, note, campaign tags) — 6 months from the request, then deleted automatically; we delete it earlier on request (support@coordio.net).
- Technical logs — up to 90 days.
- Rate-limit counters — from a minute to a day, depending on the rule.
- After account deletion — data is deleted within 30 days; older backups roll over within 90 days.
- Messages you posted in a shared channel may remain visible to its other members as part of the conversation history — anonymised once your account is deleted.
7. Security
- Passwords are stored as bcrypt hashes; we cannot read them.
- Message bodies are encrypted in the database.
- The browser-side cache is encrypted (AES-GCM) and cleared on sign-out.
- All traffic goes over HTTPS.
- Access to data inside the Service is bounded by channel permissions; administrative technical access is used only for support and troubleshooting.
- Two-factor sign-in (TOTP) is available and can be enabled in security settings.
No system is perfectly secure. If a breach occurs that puts your rights at risk, we notify you and the supervisory authority within 72 hours of becoming aware of it.
8. Your rights
You have the right to:
- know what data we process about you and get a copy of it;
- correct inaccurate data — most of it is editable directly in settings;
- delete your account and data ("right to be forgotten");
- restrict processing or object to it;
- take your data in a machine-readable form (export);
- withdraw consent to notifications — in settings, with no effect on the rest of the Service;
- complain to a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, your country's data protection authority.
To exercise a right that has no button in the app, write to support@coordio.net.
9. Children
The Service is not intended for people under 16. If we learn that an account was created by a child below that age, we delete it.
10. Automated decisions
We make no decisions with legal effect on you by automated means alone, and we do not profile you for advertising.
11. Changes to this Policy
We announce material changes in the app or by email at least 14 days in advance. The effective date of the current version is at the top of this page.