Privacy policy

Draft for adoption; not yet in effect. Effective date: [EFFECTIVE DATE]. Operator: [LEGAL NAME]. Address: [LEGAL ADDRESS]. Contact: [LEGAL CONTACT EMAIL]. Identity, rollout, data procedures and safety preservation must be completed before publication.

Prayer can hold deeply personal concerns. This policy explains what Coro processes, who receives it and how to make choices. Coro uses artificial intelligence to write replies; it is not a human or a confidential clergy or clinical service. See also the Consumer health data policy.

Information and purposes

We process your messages and replies, contact number or web-chat identifier, self-reported residence and age group, language and tradition, consent choices, memberships, delivery records and service usage. Paying accounts also have account, email, plan and payment-status records. Stripe receives card details; Coro does not store full card numbers. Residence and a telephone-region hint are not verified physical location.

Messages can reveal health, religion and family circumstances. We derive topics, dates and safety indicators to respond to the request. Continuing ordinary personal chat requires separate sensitive-data consent (DATA YES). The first prayer uses a local composer without an AI-provider call; the service still temporarily receives and processes the message. Preconsent text and ordinary messages about another person are scheduled for clearing within minutes after a reply, with retry and periodic cleanup. This is not zero collection.

With consent, adults can save personal prayer subjects and request follow-ups. For another person's request, saved follow-up information is limited to relationship and date, not their medical details. Please use generic wording. Safety processing and the limited reporting exception below are separate from ordinary prayer memory.

From January 1, 2027, or an earlier configured date, adults also receive current-request-only context: no earlier conversation, saved personal prayer memory or personalized future check-ins. This restriction does not erase stored transcripts; they remain subject to the retention and deletion rules below.

Children, teens and guardians

Public prayers are for all ages. Under-13 visitors are directed to parent-guided prayers without a child chat account. Public and parent-guided prayer pages suppress optional traffic counts and Cloudflare beacons; essential request and security handling remains. When existing personal chat is known to belong to someone under 13, ordinary chat ends and data is erased, subject to restricted safety evidence. A contact digest helps prevent repeated collection. Self-reported age does not verify adulthood or parental consent.

For ages 13–17, model context contains only the current session, excluding personal information over 12 hours old, saved names and personal prayer lists. A session ends after 30 minutes without an ordinary message. Teens cannot enable persistent personal memory or personalized future check-ins. Generic daily prayers start off and require explicit opt-in. These context limits do not erase stored transcripts at session end.

Teens receive AI/break notices at session start and at least hourly during continuing interaction. The limits are 60 continuous minutes, a 30-minute break, and 120 estimated minutes per local day. The estimate counts spans between ordinary turns, with a one-minute minimum per session; it is not device screen time. Teens can lower limits or pause using controls or CONTROLS. Linked contacts share the allowance; an unrelated number or cleared browser identity is a limitation.

Guardian control requires the teen's invitation and confirmation, an authenticated adult account with verified email, and separate staff verification of identity, adulthood and authority. Payment alone grants nothing. We retain control settings, usage estimates, relationship status and a minimal sealed verification reference. The controls expose no prayers, topics, contacts, activity reports or teen export. Either party can revoke access; a relationship digest preserves revocation after restore. Required reviewer assignments and real-world verification procedures remain prerequisites for operating this draft.

Sharing and service providers

A circle receives only the exact request you separately confirm with SHARE. Members can save or forward it; Coro cannot recall their copies. A payer does not receive another person's conversation. Optional Familia weekly counts are for adults only and require that adult member's opt-in and contain no prayer text. Church administrators receive totals, not members' prayers or phone numbers.

The proposed launch is web and SMS, with WhatsApp off. Anthropic processes consented model requests; Telnyx and carriers carry SMS; Stripe handles payments; Resend handles service email; Cloudflare supports security, backups and supported voice transcription; the hosting provider processes the application and database. [CONFIRMED HOST, PROCESSOR LOCATIONS AND CONTRACT REGISTER] must be completed before publication. Only the providers needed for a particular feature receive its data.

Coro does not use conversations to train AI models. We send Anthropic the excerpts needed for a reply and do not intentionally add the account phone number, although a message can identify its author. Anthropic's published policy describes ordinary API deletion within 30 days, with exceptions for longer-lived features, agreements, covered-model safety work, policy enforcement and law. Flagged content may remain up to two years and classification scores up to seven. No universal 30-day or zero-retention promise is made.

A supported voice feature requires age and data-consent checks. Cloudflare transcribes audio; Coro processes it temporarily and keeps no audio in the conversation database. The transcript follows text retention. An originating messaging provider may retain audio separately. Web/SMS launch does not promise voice or WhatsApp access.

We do not sell personal information or consumer health data. We do not sell, rent or share your mobile number or text-message consent with third parties or affiliates for their marketing or promotional purposes. Coro contains no ad pixels or behavioral advertising. Optional promotional messages require separate consent. Providers may process data for permitted security, abuse prevention and legal obligations. Required or legally permitted safety disclosures to authorities are addressed in the Safety protocol.

Cookies, security and usage

If you arrive through a tagged Familia link, we keep its source with your account to count purchases by source; it stays inside Coro.

Essential cookies support sign-in, form security, one-time messages, language, web chat and short-lived teen controls. Optional public-page traffic analytics can be configured outside the protected prayer/chat pages. Internal counts and campaign attribution are separate from conversation text. Security and delivery logs retain operational metadata. Encryption and access controls reduce risk but cannot guarantee security; SMS is not end-to-end encrypted. Authorized access to conversations requires a reason and is audited.

Retention and deletion

Ordinary conversation text is scheduled for deletion after 180 days. Preconsent, third-person and consent- withdrawal cleanup may be earlier. Adults' prayer lists expire on deletion or 365 days of inactivity. Teen chat creates no saved personal prayer list.
Memberships last until departure or deletion. Old consent history is normally pruned after five years, but the latest choice and records still referenced by memberships can remain longer to operate those choices. A keyed contact digest can remain after deletion to honor opt-out. Account and billing records follow account status and applicable recordkeeping obligations. Renewal agreements remain three years or one year after the plan ends, whichever is longer.
Web-account deletion freezes the account for 14 days before erasure. DELETE MY DATA initiates personal-data erasure without that restore window. Neither route proves a provider has erased its copy.
For a specific safety-reporting or preservation purpose, the case workflow keeps relevant disclosures and available contact, age-band and self-reported residence information sealed and access-audited. Reporting and release are separate decisions: a report does not automatically delete evidence. A designated reviewer records the owner, purpose, review deadline, hold and release authority. Only that release authority can delete the disclosure and contact snapshot after any minimum preservation period; a protected decision record prevents older backups from reviving them. Ordinary deletion proceeds separately. Safety evidence is not used for prayer memory, advertising or training. Policy adoption, named human coverage, recovery arrangements and provider-version deletion still require verification before publication.

The proposed deletion commitment is removal from active systems promptly, ordinarily within 30 days after verifying a request, notices to required processors and recipients, and residual backup deletion within six months. Local retention and erasure replay support part of this commitment; downstream handling and deployed backup lifecycles require verification before publication. Restore must apply erasures before ordinary use. A request already transmitted to a provider cannot be recalled.

Your choices and rights

Use DATA NO to withdraw sensitive-data consent, DELETE MY DATA or BORRAR MIS DATOS for deletion, and STOP for messages. Withdrawal clears ordinary conversation and prayer memory and suppresses pending personal replies where possible; limited safety evidence follows the rule above. HELP, privacy choices and crisis resources remain reachable at teen limits. Billing cancellation is a separate choice described in the Terms.

Request access, correction, a complete personal-chat copy or an appeal at [LEGAL CONTACT EMAIL]. Download your personal-chat data from Your chat data using the browser linked to your conversation. The account download covers only the signed-in user's account records, even for a payer. We must verify the relevant identity without disclosing a teen's prayers to a payer. Anonymous web requests require an appropriate browser-identity process; email or payment alone is insufficient. The proposed response standard is within 30 days and no later than the applicable legal deadline, ordinarily 45 days for covered health-data requests. We explain any legally permitted extension before the deadline. You may appeal a refusal by replying and contact your state attorney general. These manual request and appeal procedures must be operational before publication.

Changes

Material changes require an updated effective date and notice before they apply. English and Spanish have equivalent substance; translation differences do not reduce mandatory consumer rights.