Privacy Policy
Effective October 17, 2026. Juschin Labs (Brentwood, California, United States) is the controller of personal data processed through Cotrest. Questions or requests: privacy@cotrest.com.
Summary
- We only send update emails (for example, when a creator confirms a pitch you follow) if you tick “Email me”. Every one has a one-click unsubscribe. Sign-in and security emails are always sent.
- We collect what's needed to run your account and keep Cotrest safe: email, password (stored only as a salted hash), profile, what you do on the site, and the IP address and device you use (IP addresses are stored encrypted).
- We don't sell or share personal information, show behavioural ads, or use third-party trackers.
- Who backed what is private. Counts are public.
- If you tell us which fields you watch or how you found Cotrest, we use it only to choose what to show you on Cotrest. You can turn personalization off in settings. We never use it for advertising or share it with advertisers.
- You can download, correct, deactivate or delete your data yourself in settings.
What we collect, why, and our legal basis
| Data | Purpose | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Email address | Account, sign-in, verification and reset codes, security and service messages | Contract |
| Password | Sign-in. Stored only as a salted PBKDF2 hash; we can't read it | Contract |
| Google account ID and the email Google shares (if you use Google sign-in) | Sign-in; we never receive your Google password | Contract |
| Handle, display name, bio, account type | Your public profile | Contract |
| Pitches, topics, backing, reports, appeals, claims, support requests | Providing the Service, moderation, support | Contract; legitimate interests |
| Actions on the service: what you did (for example signed in, pitched, backed, commented, reported, changed a setting) and when, with country and device class | Security, fraud and abuse prevention, legally required transparency reporting | Legitimate interests; legal obligation |
| IP address (stored encrypted) and approximate location derived from it (country, region, city), with your network provider | Security, fraud and abuse prevention, responding to valid legal requests | Legitimate interests; legal obligation |
| Device and browser (user agent), sign-in method, sign-in and session times, last activity | Keeping you signed in; letting you sign out other devices; spotting account takeovers | Contract; legitimate interests |
| Messages we show you in the app, and whether you viewed, dismissed or clicked them | Service notices; not showing the same message too often | Contract; legitimate interests |
| Images you upload to a creator page you manage | Showing your page | Contract |
| Age confirmation and acceptance of Terms (with version and time) | Eligibility and proof of agreement | Legal obligation; legitimate interests |
| Fields you say you watch, creators you follow, and what you pitch and back (interests) | Choosing which pitches to show you first. Only on Cotrest, never for ads. You can switch it off with “Personalize my feed” in settings, and you then get the same ranking as everyone else | Contract; legitimate interests |
| How you found Cotrest (if you answer, or from the link you arrived on), sign-up method, the page you started from, country and region | Understanding which channels bring people in and improving sign-up | Legitimate interests |
| Unsent drafts: a pitch, back, follow or comment you started before having an account, tied to a random device ID in a first-party cookie | Posting it once you've signed up, exactly as you wrote it | Contract (steps at your request before an account exists) |
| Sign-up steps (for example “viewed sign-up”, “confirmed email”, “pitch sent”), with time and device ID | Measuring where sign-up gets stuck, as aggregate counts | Legitimate interests |
| Your privacy choices (with time and policy version) | Proof of what you chose | Legal obligation |
We store IP addresses encrypted, separate from the rest of your account data, and keep them for 180 days. Only authorised staff can decrypt them, and only to investigate security or abuse or to answer valid legal process. Location derived from an IP address is approximate (city or region level); we don't collect precise location. When you choose a password, we check it against known breaches using a privacy-preserving method: only the first 5 characters of a one-way hash leave our servers, never your password. We don't make decisions with legal or similarly significant effects about you by automated means.
Cookies
We use one strictly necessary cookie to keep you signed in, and local storage to remember small preferences (such as a dismissed banner). If you open a link that someone shared with their username in it, we set a first-party cookie for 7 days so we can credit them on their profile if you back a pitch; it is never shared with anyone else. Cloudflare Turnstile may set a technical cookie to tell humans from bots. When you start a pitch, back, follow or comment before you have an account, we set a first-party cookie with a random device ID for 30 days, so we can post it once you sign up; it is strictly necessary for what you asked us to do. We use no advertising or analytics cookies, so we don't show a cookie banner.
Public figure pages (GDPR Art. 14)
Creator pages contain information about public figures that we did not collect from them: name, short public description, official handles and websites, sourced from Wikidata, public podcast charts and moderator-reviewed nominations. We process it on the basis of legitimate interests: letting audiences express demand for public work. We collect no private information or photos. If you're listed, you can object, ask for correction, or have your page removed at any time via the removal form or privacy@cotrest.com, or claim the page to manage it.
Who we share data with
Service providers acting on our instructions: Cloudflare (hosting, database, storage, email delivery, bot protection). If you use Google sign-in, Google processes that sign-in under its own policy. We may disclose information to law enforcement or courts as described in the next section, to protect rights and safety, or as part of a merger or acquisition (with notice to you). Data may be processed in the United States and other countries; for transfers from the EU/UK we rely on the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses.
Requests from law enforcement and courts
We disclose information to law enforcement or courts only in response to valid legal process, such as a subpoena, court order or search warrant, or in an emergency involving an imminent risk of death or serious physical injury. We check each request and push back on requests that are unclear, overbroad or not legally valid. On a valid preservation request we may keep a copy of an account's data for 90 days while the requester obtains legal process; preserved data isn't disclosed without that process. We tell affected users before we disclose their data, unless the law prohibits it, the matter is an emergency or involves child safety, or notice would be counterproductive (for example, it would put someone at risk). See our law enforcement guidelines.
How long we keep data
- Account data: while your account exists.
- Unsent drafts: 7 days, then the draft is deleted; the empty record goes 30 days later. Sign-up step records: 13 months, then counted in aggregate only.
- Verification and reset codes: 15 minutes. Sessions: up to 60 days or until you sign out.
- Access logs (IP address, approximate location, device and browser): 180 days.
- Activity and security logs: 24 months, then deleted or anonymised.
- Your content (pitches, topics, comments, uploads): until you delete it or your account is purged.
- Moderation decisions and statements of reasons: 5 years, for legal and transparency obligations; identifiers are removed when you delete your account.
- Deleted accounts: closed and hidden straight away, then purged after a 30-day grace period (so a mistaken or unauthorised deletion can be undone). Purging erases email, handle, name, bio, password, sign-in methods, backing, sessions and access logs. Pitches you posted remain without your name.
- Legal holds: if we receive a valid preservation request or legal process, or need the data for a legal claim, we keep the affected data until the hold ends, even after the periods above or a deletion request.
- Data packages we prepare for an access request or legal process: deleted from our systems 7 days after they are created.
Your rights
Depending on where you live, you can access, correct, delete or port your data, restrict or object to processing, and withdraw consent.
- Access and export: download your data in settings. For a complete copy, including access logs with IP addresses, write to privacy@cotrest.com.
- Deletion: delete your account in settings. It is purged after a 30-day grace period, unless a legal hold applies.
- Personalization: switch “Personalize my feed” off in settings at any time. We don't sell your personal information or share it for cross-context behavioral advertising, and we don't use your interests for ads.
- Objection: you can object to processing based on our legitimate interests, such as security logging; we will stop unless we have compelling grounds or need the data for legal claims.
For anything you can't do in settings, write to privacy@cotrest.com. We respond within one month (EU/UK) or 45 days (California), and may verify your identity first. You can complain to your data protection authority; in the EU/UK you may also contact your local supervisory authority.
California notice (CCPA/CPRA)
In the last 12 months we collected identifiers (email, account IDs), internet activity on Cotrest, IP addresses, device and browser information, approximate location (city or region), and inferences limited to account security. We use them for the purposes above and for no other purposes. We do not sell or share personal information and do not use sensitive personal information except to provide the Service. You have the right to know, delete, correct, and not be discriminated against for exercising your rights. Authorised agents may submit requests with proof of authority.
Security
Salted password hashing, encrypted connections, hashed session tokens, encrypted provider tokens and IP addresses, rate limiting, breached-password checks and re-authentication before sensitive changes. If a breach affects your personal data, we notify the relevant authority within 72 hours where required and tell you without undue delay.
Children
Cotrest is for people 16 and older and isn't directed at children. We don't knowingly collect data from children under 16; if you believe we have, contact privacy@cotrest.com and we'll delete it.
Changes
We'll post updates here and, for material changes, notify you before they take effect.