Privacy Policy

CoMoment is a private map of family moments, operated at comoment.app and in the CoMoment iOS app. This policy describes what those two surfaces collect and what happens to it. It applies to the adult who holds the account.

CoMoment is for adults. Children do not have accounts and cannot sign in. A parent or guardian records moments about their child, and the information about that child exists because an adult chose to add it.

Your account. An email address, and a display name if you set one. We use email to sign you in and to tell you when someone gives you access to an album. There is no password: sign-in is a link or a one-time code sent to that address.

What you record. The content of a moment — photos and videos, a note, a date, the place and its exact coordinates, and which children it is about. Children are stored as a name and, if you enter one, a birth date, which is what lets CoMoment show an age alongside a moment.

Photographs carry more than they look like. A photo taken on a phone usually embeds the time and the precise GPS location. CoMoment reads those to suggest a date and a place while you are adding a moment. The original file is stored as you uploaded it, with that data intact, because it is your original. The smaller copies CoMoment generates for the map and the timeline have the embedded metadata stripped.

Technical information. Crash and error reports, and a small set of product events — that a moment was created, that an album was shared — recorded so we can tell whether the product works. These carry an account identifier, not content. They are covered precisely below. When you share a link, CoMoment also counts how many times it has been opened and when it was last opened; it does not record who opened it.

Usage counts. To keep the service from being abused, CoMoment counts how often an account looks places up with our map provider, groups an import, and emails album invitations, and how often a device opens link pages. A device is counted by a scrambled form of its IP address that cannot be turned back into the address; the address itself is never stored. The counts are deleted within two days.

Private is the default, and it is enforced by the database rather than by a setting you have to find. Photos and videos are stored in private buckets, and CoMoment shows them through signed addresses that expire — after a day for an original file, after a week for the smaller display copies. There is no permanent public address for anything you upload.

• •Your family. Moments belong to a family, not to one account, so the people you add to your family can see them.
• •People you add to an album. You can invite someone by email address, at the permission you choose, or create an invite link. Anyone who opens an invite link sees a short preview first — the album's name, who shared it, how many moments and places it holds, and its latest covers with their titles, dates, and place names, but no children, notes, or coordinates. Anyone who signs in through it joins as a viewer. People you add see that album and nothing else in your family, and you can remove their access at any time. Photos they add to a moment are seen only by you and the people in the albums they added them through, until you choose to show them everywhere.
• •Anyone you send a private link to. You can share one moment, a place's moments, or a selection as a link that opens without an account. It shows those moments' titles, notes, dates, photos, and videos, and the children they are about by name and age — never a birth date. The page names the place, and shows the exact spot only if you chose to include it. A link shows the smaller copies CoMoment makes, which carry no embedded location, and never the original file. A video with no smaller copy to play shows only a still frame.
• •Us. We can reach stored data through administrative access, and we use it to operate the service, fix a fault you report, or comply with the law. We do not browse it.

CoMoment has no public profiles, no feed, and no comments. Link pages are hidden from search engines and cannot be found without the link itself. We do not sell personal information, and we do not share it with advertisers.

Running CoMoment means other companies process some of your data on our behalf. Each is used for one job:

• •Supabase (on Amazon Web Services) — the database, sign-in, and file storage. This is where your photos and moments actually live.
• •Amazon Web Services — an encrypted backup of your original photos and videos and of the database, so a mistake on our side cannot lose them. Nobody browses it; it is read only to restore data.
• •Vercel — serves the website and the API.
• •Google Places — turns a search or a set of coordinates into a place name while you are adding a moment. It receives what you type and the coordinates in question. It does not receive your photos or your account.
• •MapTiler and Stadia Maps — draw the map itself. They receive the areas of the map your device requests.
• •Anthropic — groups an import into moments. See below.
• •Resend — delivers sign-in and album-access emails.
• •Sentry — receives crash and error reports.

CoMoment uses AI for exactly one thing: when you import a batch of photos, deciding which of them belong to the same outing, so a morning at one park becomes a single moment rather than nine.

The model is not shown your photographs. CoMoment first groups the selection by time and location on its own, resolves place names itself, and then sends only the resulting list of place names and time ranges to be merged. An import of photos with no location information never reaches the model at all — those group by calendar date. If the step is unavailable or fails, the import falls back to the grouping CoMoment worked out on its own, and nothing is sent.

This runs as part of importing photos, and it is on by default. There is no per-account switch for it, because there is nothing here to switch off that would change what leaves your account: no photograph, no note, and no child's name is ever sent. Should we ever build an AI feature that does send any of those, it will be off until you turn it on.

Your photos, notes, and children are not used to train any AI model, ours or anyone else's.

Error tracking is deliberately narrow. Reports are scrubbed before they are sent: moment text, place names, children's names, email addresses, coordinates, and references to your media are removed, and screenshots and view-hierarchy captures are switched off. What is left is the shape of the failure — which screen, which function, which version.

Product events record that something happened, never what it contained: that a first moment was created, whether it had a photo, whether it had a location. They are stored with an account and family identifier, and are deleted after 180 days.

Deleting a moment hides it immediately and schedules it for permanent deletion after 7 days, along with its photos and videos. The delay exists so a delete made by accident can be undone; after it passes, the files are gone from storage and cannot be recovered. Our backup copies are removed within 45 days of the delete.

Share links and album invite links stop working when they expire — after 30 days unless you choose a longer period, and never later than 90 — or when you turn them off, whichever comes first.

Otherwise we keep what you record for as long as your account exists, because that is the point of the product — a map of moments is only worth keeping if it is still there in ten years.

You can delete your account yourself, from your profile on the web or in the app. Your family and everything in it disappear at once — for you, and for anyone you shared an album with — and your links stop working. Seven days later it is all deleted permanently, along with your account, and our backup copies follow within 45 days of the request. Moments you added to an album someone else shared with you stay in that album, because they belong to that family, but no longer carry your name.

You can take a copy of everything in your family whenever you like, from your profile on the web: every photo and video exactly as you uploaded it, and a file with each moment's title, note, date, place, children, and albums. The files go straight from storage to your device. If that does not work for you, write to privacy@comoment.app from the address you signed in with, and we will do it within 30 days.

If you live in California, or another place with similar law, you have the right to know what we hold, to get a copy, to have it deleted, and to not be treated differently for asking. The address above is how you exercise all of them. We do not sell or share personal information as those laws define it.

The database and your photographs are stored in the United States, in Amazon Web Services' Northern Virginia region. The backup copy is in Amazon Web Services' Ohio region. Some of the companies listed above operate in other countries as well, so information may be processed outside the country you live in.

Access is enforced in the database itself, with row-level policies that decide what each account can read — not only in the app screens. Media files sit in private storage and are reachable only through signed addresses that expire. Traffic is encrypted in transit. Sign-in uses a one-time link or code, so there is no password of yours for us to lose.

No service can promise perfect security, and we will not pretend otherwise. If we ever discover a breach affecting your family, we will tell you.

If this policy changes in a way that affects what we collect or who can see it, we will say so in the product before the change takes effect, not only by editing this page.

Questions, requests, or something here that does not match what you see in the product: privacy@comoment.app.