Legal
Privacy Policy
Last updated: 14 October 2026
CoParentOS Privacy Policy
Last updated: 14 October 2026
About This Policy
CoParentOS ("we", "us", "our") is a co-parenting platform operated by Digital Enterprises Pty Ltd (ABN 12 702 191 633). This privacy policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
We built CoParentOS to help separated parents keep a shared, accurate record of expenses, communications, schedules, and child-related administration. The data you enter belongs to you. We handle it with care.
If you have questions about this policy, contact us at privacy@coparentos.com.au.
APP 1 — Open and Transparent Management
We manage personal information openly and transparently. This policy is:
- Published at coparentos.com.au/legal/privacy and linked from every page of the application
- Available free of charge
- Written in plain language
We review this policy at least annually. Updates are posted here with the date of change. If we make material changes that affect your rights, we will notify you by email and through the application.
APP 2 — Anonymity and Pseudonymity
An account is required to use the private workspace. We verify access to your email address; this is not a government identity check. You can start independently and invite your co-parent to join a shared household.
You may browse public pages (home page, pricing) without providing personal information.
APP 3 — Collection of Solicited Personal Information
What We Collect
We collect information you provide when you create an account, organise your household, contact support or use the service. Parents may also supply information about children, a co-parent or other people through invitations, shared records, uploaded documents and imported correspondence. This can include personal or sensitive information about someone who does not have an account.
Account information:
- Email address
- Display name
- Relationship to the household (parent, admin)
Household information:
- Household name (the family group)
- Children's names and dates of birth (entered by a parent)
Platform data you create:
- Expense records (merchant, amount, category, due date, payer/ower)
- Evidence files (receipts, invoices, screenshots)
- Messages between parents
- Calendar events (care schedules, appointments, handovers)
- Notes (private reflections and shared factual notes)
- Legal documents (court orders, solicitor correspondence, police reports)
- Financial disclosure documents (bank statements, tax returns, superannuation statements)
- Parenting plans (living arrangements, decision-making agreements)
- Handover check-in data (timestamps, GPS coordinates, distance from agreed location)
- Child inbox data (provider emails forwarded from school, medical, and activity contacts)
Private Conversation Review:
- When you import a supported conversation, its original file, parsed messages, source hash, notes and review results are uploaded and autosaved to private account storage.
- These reviews are accessible through your account, not shared with your co-parent or added to shared household records. Authorised service administration remains possible; this is not end-to-end encrypted storage.
- You can close and resume a saved review or explicitly delete it. Deletion removes the active payload; minimal deletion metadata is retained to prevent delayed saves restoring it. Backup retention and separately downloaded copies are not affected immediately.
- External AI review is separately controlled. Importing, saving or resuming does not itself send messages to an AI provider. Where enabled, the provider notice and explicit consent apply before a selected range is sent.
Billing information:
- Payment method details are processed by Stripe. We do not receive or store your full card number. We receive a token, the last four digits of your card, and its expiry date.
Automatically collected:
- Authentication logs (login timestamps, IP addresses)
- Audit logs (who changed what and when — these are essential for the platform's evidence function)
Optional Website Analytics
If you select Analytics only or Allow both, we use Google Analytics on public marketing pages to understand visits and improve the website. It uses analytics cookies and processes information such as a pseudonymous browser identifier, public-page categories, approximate location and browser/device information. Google receives network information needed to provide the service. Data may be processed outside Australia, including in the United States.
Analytics is off until you opt in. Selecting No thanks does not affect access to CoParentOS. You can change your choice using Analytics preferences on public pages; declining stops collection and removes the analytics cookies available to this site. Previously collected data is not automatically deleted by opting out.
We do not run this analytics tag in the signed-in workspace, authentication, invitation, shared-record or support-form pages. We do not send names, email addresses, household identifiers, message or document contents, or URL query strings. Individual article URLs are grouped into a public article category. Advertising personalization, Google Signals and automatic form/link measurement are disabled. Our consent preference is stored locally in your browser.
Read Google's privacy policy for information about its processing.
Optional campaign measurement
Selecting Allow both also lets us link an approved campaign source and creative label to a verified new-account registration and first paid subscription invoice. We may retain the ad-click identifier supplied by Google, Meta or ChatGPT with that record. We do not record search terms, arbitrary URL parameters, names, email addresses, family details, messages or documents in campaign measurement. This is separate from Google Analytics; existing analytics consent does not enable it.
Campaign attribution is stored in your browser for up to 30 days and, after signup, linked privately to your account for up to 90 days, with daily cleanup. These campaign records currently remain within CoParentOS; advertising-platform conversion forwarding is not enabled. Choosing Analytics only or No thanks clears local campaign attribution and removes linked campaign measurement on your next signed-in request. You can also contact privacy@coparentos.com.au for deletion. Withdrawing measurement does not remove billing records retained for accounting or change your subscription.
Sensitive Information
Some data you enter may be sensitive under the Privacy Act — for example, health information about a child, or information in legal documents. We only collect sensitive information when you choose to provide it, and only where it is reasonably necessary for the platform's function.
We do not collect:
- Government identifiers (Tax File Number, Medicare number, driver's licence number) unless you voluntarily include them in uploaded documents. We recommend you redact these before uploading.
- Biometric information
- Information about your political opinions, religious beliefs, or sexual orientation
APP 4 — Dealing with Unsolicited Personal Information
If we receive personal information we did not ask for (for example, if you email us supporting documents we didn't request), we will assess whether we could have collected it under APP 3. If not, we will delete or de-identify it as soon as practicable.
APP 5 — Notification of Collection
When we collect personal information, we take reasonable steps to notify you of:
- Our identity and contact details
- The purposes of collection
- Who we may disclose it to
- How you can access and correct it
- Whether the collection is required by law
- The consequences if you do not provide the information
- Any cross-border disclosure
This privacy policy serves as that notification. Where we collect information through the application, we provide contextual notice at the point of collection.
APP 6 — Use and Disclosure
How We Use Your Information
We use your personal information only for the purposes for which it was collected, or for related purposes you would reasonably expect:
- To provide the co-parenting platform (expense tracking, messaging, scheduling, child inbox, evidence retention)
- To facilitate lawyer and professional access when you grant it
- To process payments (via Stripe)
- To send service emails (password reset, subscription notifications, security alerts)
- To maintain the audit trail required for the platform's evidence function
- To improve the platform (de-identified usage patterns only)
- To comply with legal obligations
Who We Share It With
Authorised household members: Shared household records, including expenses, messages, calendar entries and shared evidence, can be accessed by authorised household members. Private notes and private conversation reviews are not automatically shared with your co-parent.
Lawyers and professionals you authorise: You may grant time-limited, read-only access to specific financial disclosure documents. Access is logged and can be revoked at any time. A professional does not receive access merely because someone names them in a record.
Our service providers:
- Supabase Inc. — Database, authentication, and file storage (hosted in Singapore)
- Vercel Inc. — Application hosting (global edge network)
- Stripe Inc. — Payment processing (card data tokenised; we do not receive full card numbers)
Legal obligations: We may disclose information if required by Australian law, a court order, or a law enforcement agency with proper authority.
What We Don't Do
- We do not sell your data. Ever.
- We do not use your data for advertising.
- We do not share your data with data brokers.
- We do not use your data to train AI models unless you explicitly opt into an AI feature (e.g., document analysis).
APP 7 — Direct Marketing
We send only service-related emails (account notifications, subscription receipts, security alerts) and, with your express consent, an optional co-parenting newsletter. We do not use personal information for third-party direct marketing.
APP 8 — Cross-Border Disclosure
Where Your Data Is Stored
Personal information you provide is stored with:
| Service Provider | Location | Data Stored |
|---|---|---|
| Supabase | Singapore (ap-southeast-1, AWS) | All platform data (database, files, auth) |
| Vercel | Global edge (US, Europe, Asia-Pacific) | Application code and serverless function logs |
| Stripe | Global (primary processing in United States) | Payment tokens and transaction records |
By using CoParentOS, you acknowledge that your data may be stored in Singapore and processed in the United States.
We take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the APPs. Supabase, Vercel, and Stripe each maintain industry-standard security certifications (SOC 2, ISO 27001).
APP 9 — Adoption, Use, or Disclosure of Government-Related Identifiers
We do not adopt, use, or disclose government-related identifiers (Tax File Numbers, Medicare numbers, Centrelink reference numbers, driver's licence numbers) as our own identifiers. Our internal record identifiers are UUIDs generated by the system.
If you upload documents that contain government identifiers, we do not extract or index them separately. We recommend redacting identifiers you don't need to share before uploading.
APP 10 — Quality of Personal Information
We take reasonable steps to ensure the personal information we hold is accurate, up-to-date, and complete.
- You enter and maintain your own information — you are best placed to ensure its accuracy
- The platform provides status workflows (e.g., expense queries) that let either parent flag potential inaccuracies
- You can update your profile information at any time through the Settings page
- Audit logs capture who made what change and when — errors can be identified and traced
APP 11 — Security of Personal Information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security practices are documented in our Security Policy. Key measures include:
- Encryption: AES-256 at rest (Supabase); TLS 1.3 in transit
- Access control: Row Level Security ensures each household's data is isolated; multi-factor authentication required
- Audit logging: All data changes are logged with timestamps and actor identification
- Vendor assessment: All service providers assessed for security (vendor details available on request)
If we become aware of a data breach that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.
APP 12 — Access to Personal Information
You have the right to access the personal information we hold about you. Most of your information is accessible directly through the application — you can view your expenses, messages, calendar, documents, and settings at any time.
If you need information beyond what's available in the application, or if you want a structured export, contact us at privacy@coparentos.com.au. We will respond within 30 days. We may need to verify your identity before releasing information.
There is no charge for making an access request. We may charge a reasonable fee for providing access if the request is complex or resource-intensive — we will let you know before proceeding.
We may refuse access in limited circumstances permitted by the Privacy Act (for example, where access would unreasonably impact another person's privacy). If we refuse access, we will tell you why in writing.
APP 13 — Correction of Personal Information
You have the right to correct personal information we hold about you. You can correct most information directly through the application. Changes are logged in the audit trail and may be visible to the other parent in your household.
If you believe information is incorrect and cannot correct it yourself, contact us at privacy@coparentos.com.au. We will respond within 30 days.
If we refuse to correct information, we will tell you why. You may request that we attach a statement of your view to the information.
Data Retention
See our Data Handling and Retention Policy for the launch policy:
- Active subscriptions: Records remain available within the account's household and privacy permissions.
- Expired trials or subscriptions: Existing records remain readable and exportable within those same permissions. Paid changes are restricted after paid access and any applicable payment grace period end.
- No automatic cutoff: At launch, subscription expiry alone does not trigger a 90-day access cutoff, cold storage or deletion. We do not promise lifetime storage or a fixed seven-year or youngest-child-age archive.
- Deletion requests: Contact support to request deletion. Requests are reviewed with regard to shared records and applicable retention obligations; cancelling a subscription is not a deletion request.
Children's Privacy
CoParentOS does not allow children to create accounts, log in, or interact directly with the platform. All child-related data is entered by an adult parent. See our Child Safety Policy for more information.
APP 11 — Death, Incapacity, and Data Access
Under APP 11, we must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. The death or permanent incapacity of a co-parent presents a unique challenge: the surviving parent, the child's guardian, and the deceased parent's estate may all have legitimate interests in accessing the records.
Surviving Co-Parent
Shared household records (expenses, calendar, messages, parenting plans, child inbox) remain accessible to the surviving co-parent through their own account. No special request is required for shared data — it belongs to the household, not to an individual parent.
Deceased Parent's Personal Records
Personal records belonging to the deceased or incapacitated parent (private notes, personal settings, personal messages not shared with the household) are archived. Access may be granted to:
- A nominated Legacy Contact: Each parent can designate a Legacy Contact in Account Settings. Upon verified death or permanent incapacity, the Legacy Contact receives read-only access to the deceased parent's personal records.
- The executor or administrator: Upon presentation of a Grant of Probate or Letters of Administration, the estate's legal representative may access the deceased parent's records. This is particularly relevant for financial records needed for estate administration, outstanding expense claims, or Family Court proceedings.
- Pursuant to a court order: Records may be released under subpoena or court order.
Verification
To protect against unauthorised or premature access, we require:
- A certified copy of the death certificate, or
- A medical certificate of permanent incapacity from a treating specialist, or
- A Grant of Probate or Letters of Administration, or
- A court order
We will respond to verified requests within 10 business days. Access is read-only — no changes can be made to a deceased parent's records.
Notification
When a death or permanent incapacity is verified:
- The surviving co-parent is notified (if not the applicant)
- Any nominated Legacy Contact is notified
- The deceased parent's account is marked as archived (not deleted)
- Data retention continues according to the standard retention schedule (see Data Handling Policy)
If Both Parents Are Deceased
Where both parents are deceased and the child is a minor, the child's legal guardian or a court-appointed representative may apply for access to the household records. Verification requires a court order, guardianship order, or equivalent legal documentation.
Complaints
If you have a complaint about how we have handled your personal information, contact us at privacy@coparentos.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
- Mail: GPO Box 5218, Sydney NSW 2001
Contact
Privacy Officer CoParentOS Email: privacy@coparentos.com.au
UK Users
Digital Enterprises Pty Ltd operates CoParentOS from Australia. Where the UK GDPR applies to our handling of your information, your rights may include access, correction, erasure, restriction, portability and objection, subject to the conditions and exceptions in that law. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.
Contact privacy@coparentos.com.au or use our privacy enquiry form to make a privacy request. We may need to verify your identity and consider other people's rights before providing information. We respond within the applicable legal time limit; where an extension is permitted, we will explain it.
Parents may provide information about children, a co-parent or other people through records, invitations, correspondence and imports. Having an account does not automatically give a person access to every record about someone else. We consider the relevant person's rights, household permissions and safety concerns when handling requests.
You may raise a concern with the UK Information Commissioner's Office. You do not have to complete our internal complaints process before contacting the regulator.
South African Users
Digital Enterprises Pty Ltd operates CoParentOS from Australia. Where South Africa's Protection of Personal Information Act (POPIA) applies, you may request access to your personal information, correction or deletion where permitted, and object to processing on the grounds available under that law.
Use our privacy enquiry form or email privacy@coparentos.com.au. We verify the requester's identity and consider shared records, other people's privacy and applicable retention requirements before releasing or changing information. Providing information about a co-parent or child does not give unrestricted access to their private records.
You may raise a privacy complaint with the South African Information Regulator. Our overseas-provider and retention information above also applies; choosing South Africa does not move your records to South African hosting.
Legal Framework
This policy is written to comply with:
- Privacy Act 1988 (Cth)
- Australian Privacy Principles (APPs), Schedule 1 of the Privacy Act
- Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth)
- Office of the Australian Information Commissioner (OAIC) guidance for health service providers and small businesses