Privacy Policy
Costori is a personal cosplay planner — your ideas, checklists, and progress photos are yours, and we built the app so they stay that way. This policy explains, in plain words, what data Costori handles and why.
1. Who we are
“Costori” (“we”, “us”) means the Costori mobile app and the Costori website, including its waitlist. When we say “the service”, we mean both. Costori is an independent, solo-built product.
2. What we collect
- Account data. Your email address and password. Authentication is handled by Supabase Auth — your password is stored only in hashed form and we never see it in plaintext. If you use Sign in with Apple or Google, we receive the identifier (and email, where the provider shares it) needed to create and recognise your account.
- Profile data. Your display name and your preferences: currency, theme, and language.
- Your content. Everything you create in the app: cosplays, tasks and checklists, notes, reference images and links, progress photos, shopping items, and events.
- Credits and referral data. A ledger of AI-credit grants and spends, your referral code, and — if you signed up with someone’s code — that referral attribution.
- Feedback. Messages you choose to send us through the in-app feedback form or the website’s support form.
- Waitlist email. If you join the waitlist on the website, we store the email address you submit (with your chosen language) so we can invite you.
- Usage data. Basic, pseudonymous product-analytics events — such as opening the app, completing onboarding, creating a cosplay, or viewing the credits screen — linked only to a random account identifier, never your name or email. We use these to understand how the app is used and to improve it. See “Where your data lives” for the provider.
The website stores your theme and language choice in your browser’s local storage. That data stays on your device — it is not a tracking cookie and is never sent to us.
3. AI features (Tori)
Tori’s suggestions are strictly opt-in. No image leaves your device for AI processing unless you have switched on the Privacy & AI toggle and explicitly triggered a suggestion.
- When you do, the reference photo you chose is sent through our server to Google’s Gemini API to generate checklist and shopping suggestions.
- Your images are not used to train AI models and are not stored by the AI provider after processing.
- You can turn AI processing off at any time in the app’s settings.
4. Where your data lives
Your account, content, and images are stored with Supabase, hosted in the European Union (Stockholm, region eu-north-1). This covers the database, authentication, and image storage, all protected by per-user access controls — your rows and files are only accessible to your account. The website is hosted on Vercel.
Product-analytics events are processed by PostHog on its European Union cloud. These events are pseudonymous — linked only to a random account identifier — and carry no additional personal data.
5. Feedback relay
When you send feedback in the app or a support message on the website, the content of your message is forwarded to the team via Telegram so we can read and act on it quickly.
6. What we don’t do
- No advertising.
- No selling or renting your data — ever.
- No advertising, ad-tracking, or cross-app tracking SDKs. Our only analytics is first-party, pseudonymous product usage (PostHog, EU) — see section 4.
We only share data with the service providers named in this policy (Supabase, Vercel, PostHog for product analytics, Google’s Gemini API when you opt in, Telegram for feedback relay, and Apple or Google if you sign in with them), and only to the extent needed to run the service.
7. Deleting your data
You can permanently delete your account at any time in the app: Profile → Account & security → Delete account. This removes your account, all of your content, and your stored images. If you can’t access the app, or want your waitlist email removed, contact us and we’ll take care of it.
8. Children
Costori is not directed at children under 13, and we do not knowingly collect data from them.
9. Changes to this policy
If we change this policy, we’ll update this page and its effective date. For meaningful changes, we’ll let you know in the app or by email.
10. Contact
Questions about your data? Write to us at costori.app@gmail.com — we read everything.