Privacy Policy

App Name: Cozysand

Published: 2026-08-18 · Effective: 2026-08-18

Contact: support@cozysand.com

Related documents: Terms of Service · Location-Based Services Terms · 한국어 개인정보처리방침

1. Introduction

Cozysand ("we," "our," or "us") provides an AI-assisted alarm and accountability mobile application (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, the legal basis for processing, how long we keep it, and who we share it with. It also describes your rights under the EU/UK General Data Protection Regulation (GDPR/UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), the Republic of Korea Personal Information Protection Act (PIPA), and U.S. state biometric-privacy laws including the Illinois Biometric Information Privacy Act (BIPA).

Cozysand is operated from the Republic of Korea and is distributed worldwide on the Apple App Store and Google Play. By using the App you acknowledge that your data may be processed in Korea, the United States, and other countries where our sub-processors operate (see Section 8).

If you do not agree with this policy, please discontinue use of the App.

2. Who Is the Data Controller

Cozysand, which operates Cozysand, is the controller (PIPA: "personal information controller") responsible for the personal data described here.

Data protection officer / 개인정보 보호책임자 (PIPA Art. 31)

Location information manager / 위치정보관리책임자 (Act on the Protection and Use of Location Information)

Requests to access, correct, delete, or suspend the processing of your personal data are received at the addresses above. We respond within the statutory deadlines (GDPR: one month; CCPA/CPRA: 45 days; PIPA: 10 days for access requests). We have not appointed a separate EU/UK representative; if your request requires one, contact us and we will handle it directly.

3. Summary Data Map

The table below summarizes the personal data we process. Sections 4–8 give detail.

4. Information You Provide

• Account information: display name, email, password (handled and hashed by Firebase Authentication), or a social-login identifier if you sign in with a provider.
• Tasks, habits, schedules: content you enter, including alarm times, force levels, and completion status.
• Saved places: names and GPS coordinates of locations you save for geofencing.
• Voice input: spoken audio for voice task entry or a voice alarm mission. Audio is processed by the device/OS speech-to-text service; we receive only the resulting text. We do not store raw audio.
• Lock-screen media: videos you choose from your library as a lock-screen background (stored locally; not uploaded by us).
• Release-notice signup: if you enter your email address in the signup form on cozysand.com, we keep it only to send one email on release day.

5. Information Collected Automatically

• Precise location, in the foreground and continuously in the background, to power geofencing, location-based alarms, automatic actions (such as silencing at school/work and gym reminders), and public-place dwell detection. Background location is collected even when the App is closed; it is essential to these features and is enabled only with your explicit permission.
• Motion and barometric sensors (accelerometer, gyroscope, compass, barometer) for stillness/sleep detection, shake-to-dismiss, and indoor floor estimation. Indoor floor estimation using the barometer runs for all users and, for that calculation, sends your coordinates to a weather API to obtain local sea-level pressure.
• Calendar events read from your device when you enable calendar features.
• Device and push identifiers (FCM token; iOS VoIP token) to deliver alarms and notifications.
• Diagnostics via Firebase Crashlytics to detect and fix crashes.

6. Biometric Features (Face and Voice) — Important Notice

The App offers optional alarm-dismissal missions that use your camera (face detection) or microphone (voice). These are off by default and run only if you choose a face or voice mission.

• Face and expression detection uses Google ML Kit / MediaPipe running entirely on your device. The camera frames are analyzed locally to confirm a face or expression is present, then immediately discarded. We do not create or store a faceprint or facial-geometry template, and no face image or biometric identifier is transmitted to us or any third party for these missions.
• Voice is converted to text by the device/OS speech service. We do not store or transmit raw audio.

Missions that do send a photo off your device. Two optional features work differently, and we want to be explicit about it:

• Intention-proof mission. If you choose this mission, the App asks you to photograph what the mission describes (for example, your prepared desk). Each photo you take is transmitted to Google Gemini through our Cloud Functions so the AI can judge whether it matches the instruction. The photo is used for that single judgment; we do not store it, and it is not written to your photo gallery. If a person appears in the frame, that image is transmitted — we do not run face recognition on it, do not identify anyone, and do not derive or keep any biometric template from it.
• AI coach character. If you set your coach to a photo you pick, that photo is transmitted to Google Gemini to generate stylized expression variants of the character. The generated images are stored only on your device; we do not retain the source photo.

Both features are off by default and require you to choose them. You can stop using them at any time by selecting a different mission or coach character.

Illinois residents (BIPA) and other U.S. state biometric laws: To the extent face detection is considered to involve biometric identifiers, by enabling a face mission you provide informed written consent to the on-device capture and immediate, real-time analysis of camera frames solely to verify a face is present. No biometric identifier or biometric information is collected, stored, sold, leased, traded, or otherwise disclosed; camera frames are destroyed immediately after analysis and are never retained. You can disable the face mission at any time in Settings. The intention-proof and coach-character features described above transmit a photo, but no biometric identifier or biometric template is created from it, retained, sold, leased, traded, or otherwise disclosed.

If you are uncomfortable with the camera or microphone missions, simply choose a different dismissal method (rhythm game, movement/destination, math, or pattern).

7. Background and Precise Location — Important Notice

The App collects precise location in the background, including when the App is closed or not actively in use, to monitor geofences and trigger location-based alarms and automatic actions. This data is used solely to operate App features. We do not sell your location data and we do not share it for advertising. Coordinates are sent to our sub-processors (Section 8) only to provide the feature you requested (e.g., mapping, geocoding, weather/floor estimation, public-place lookup).

You can disable background or precise location at any time in your device settings. Doing so will disable location-based alarms, geofencing, and automatic actions.

7-A. Korea — Location Information (위치정보의 보호 및 이용 등에 관한 법률)

For users in the Republic of Korea, the following applies to personal location information ("개인위치정보"):

• What we use it for. Geofencing and arrival/departure alarms, automatic actions you configure for a place (such as silencing at work), detection that you have stayed at a place, indoor floor estimation, travel-time and route information for your own tasks, and identifying the venue you are at so the lock screen can be about that place.
• Who receives it. Only the sub-processors in Section 8, and only to perform those functions on our behalf. We do not provide your personal location information to any third party for that third party's own purposes, and we do not sell it.
• Consent and withdrawal. Location collection requires your consent and can be withdrawn at any time by turning off location permission in your device settings or by disabling location features in the App. Withdrawing consent stops future collection; features that depend on location will no longer work.
• Guardians. We do not knowingly collect personal location information from a child under 14 without the consent of a legal guardian.
• Records of use (Act Art. 16(2)). We automatically record and retain, for six months, data confirming that location information was collected, used, or provided — the date and time, the purpose, and the processor entrusted. The coordinates themselves are not recorded. You can read these records yourself in the app at Settings → Location Use History, and you may also request them at support@cozysand.com.
• Requests. To ask what location information we hold, why it was used, to have it corrected, or to have it deleted, contact support@cozysand.com.
• Location information manager. 위치정보보호팀 (담당 부서) · support@cozysand.com
• Filing. Location-based service filing number: 제1451호

📄 The full statutory terms for our location-based services — including your right to withdraw consent, to require temporary suspension, and to inspect the records above — are set out in the Location-Based Services Terms (한국어), which you accept when you sign up.

8. Third-Party Sub-Processors and International Transfers

We use the following sub-processors. Most are operated by Google LLC and Apple Inc. and may process data in the United States and other countries. Because Cozysand is operated from Korea, using the App involves international transfer of personal data, including transfers from the EU/EEA/UK and Korea to the United States. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms, and on your consent for transfers necessary to provide the service.

Each sub-processor operates under its own privacy policy. We encourage you to review them. We do not use third-party advertising SDKs and we do not sell personal information, and the App shows no ads. If you installed the App after seeing one of our advertisements, Google's advertising ID may be used to measure that campaign. You can reset or delete it at any time in Android Settings → Privacy → Ads.

9. How We Use Your Information

We use the data above to: create and secure your account; deliver time- and location-based alarms and reminders; operate the mandatory/forced lock-screen and dismissal missions you enable; provide AI task and alarm suggestions; calculate streaks, statistics, and achievements; deliver push notifications; manage subscriptions; and detect and fix crashes and bugs. We process your data only for these purposes and the legal bases listed in Section 3.

10. Data Retention

• Most personal data is retained until you delete the relevant item (task, habit, saved place) or delete your account.
• AI prompt context (including calendar titles/times sent for a suggestion) is used to generate the response and is not separately retained by us beyond the resulting task. The AI provider may retain request data for its own abuse-monitoring and service-operation purposes under its terms; that retention is outside our control.
• Camera frames used for face, expression, and brushing missions, and raw voice audio, are not retained (real-time, on-device/OS processing).
• Photos you capture for an intention-proof mission, and a photo you choose as your coach character, are transmitted to the AI provider for that single request and are not stored on our servers. The AI provider handles them under its own terms; we do not receive or keep a copy.
• Sleep sessions, sleep durations, and any sleep rating you enter are stored with your account data until you delete them or your account.
• Crash diagnostics and subscription records follow the retention defaults of Firebase Crashlytics and RevenueCat respectively.
• Accounts inactive for more than 3 years may be deleted.
• You can permanently delete your account and its associated server data at any time in the App (Settings → Delete Account), or from our web page at https://cozysand.com/delete-account. You may also request deletion by emailing support@cozysand.com.

11. Data Security

We apply industry-standard safeguards: TLS/HTTPS for data in transit; Firestore encryption at rest; Firebase security rules enforcing per-user data isolation; and server-side storage of third-party API keys (clients call our Cloud Functions proxy rather than holding keys). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Children's Privacy

The App is not directed to children under 14 and we do not knowingly collect personal data from them. Where local law sets a higher age of digital consent (e.g., 16 in some EU/EEA states under GDPR Art. 8; 14 under Korea PIPA; 13 under COPPA in the U.S.), that higher age applies in your jurisdiction. We do not knowingly collect data from a child below the applicable age without verifiable parental consent. If you believe a child has provided us personal data, contact support@cozysand.com and we will delete it promptly.

13. Your Rights

GDPR / UK GDPR (EU/EEA/UK): access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time (without affecting prior processing). You may lodge a complaint with your supervisory authority.

CCPA/CPRA (California): the right to know, access, correct, and delete personal information, and to limit use of sensitive personal information (precise geolocation is "sensitive personal information"). We do not sell or "share" (for cross-context behavioral advertising) your personal information, so there is no opt-out of sale to perform. You will not be discriminated against for exercising your rights.

Korea PIPA: the right to access, correct, delete, and suspend processing of your personal information, and to withdraw consent. Sensitive information (e.g., precise location, biometric-related processing) and personal data of children are handled with the heightened protections PIPA requires.

To exercise any right, contact support@cozysand.com. You can also disable background location, notifications, calendar, camera, and microphone access at any time in your device settings, and delete your account in-app.

14. Website Analytics (cozysand.com)

Our marketing website uses a single, cookieless aggregate visit counter that increments one shared number stored in our database. It does not use cookies, does not store your IP address, and does not collect any personal data or identifiers. No individual visitor can be identified from it.

15. Service Limitations — Please Read

This section is not a privacy disclosure; it describes limits of the App that you should understand before relying on it. It is reproduced here for convenience. The binding version is Chapter 5 (Limits of the Service and Your Undertakings) and Chapter 6 (Liability) of the Terms of Service, which you accept when you sign up.

Alarms and notifications are not guaranteed to be delivered. Cozysand schedules alarms through your operating system. Delivery can fail or be delayed for reasons outside our control, including but not limited to: battery-optimization and "deep sleep" settings applied by your device manufacturer, Android Doze and app-standby buckets, Do Not Disturb and silent/volume settings, permissions being revoked or the app being force-stopped, the device being powered off, restarted, out of storage, or out of battery, operating-system updates, and clock or time-zone changes. Do not rely on the App as your only alarm, and do not use it for any purpose where a missed or delayed alert could result in injury, loss, or other harm (for example medication timing, medical appointments, transport you cannot miss, or any safety-critical activity). Use an independent alarm as a backup.

AI-generated content may be wrong. Suggestions, briefings, lock-screen cards, and mission judgments are produced by an automated system and may be inaccurate, incomplete, or out of date. Business hours, closing times, last-transit times, travel times, place names, floors, and nearby-venue information are estimates assembled from third-party map data and AI output, and can be wrong. Verify anything that matters before acting on it. Nothing in the App is medical, legal, financial, or professional advice.

Location and floor estimates are approximate. GPS accuracy varies with environment, and indoor floor estimation is inferred from barometric pressure and map data. Place identification depends on third-party datasets that may be incomplete or outdated. These features may identify the wrong place or floor.

Sleep features are not a medical device. Sleep detection and statistics are estimates derived from device sensors and your input. They are not intended to diagnose, treat, cure, or prevent any condition, and must not be used as a substitute for professional medical advice.

Third-party services. Map, place, weather, music, payment, and AI providers listed in Section 8 operate independently under their own terms and privacy policies. We are not responsible for their content, availability, or accuracy.

No warranty; limitation of liability. To the maximum extent permitted by applicable law, the App is provided "as is" and "as available" without warranties of any kind, and we are not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, data, or opportunities, arising from your use of or inability to use the App. Nothing in this policy excludes or limits liability that cannot be excluded or limited under applicable law — including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, and any statutory rights of consumers (including under the Korean Framework Act on Consumers and consumer-protection laws in your jurisdiction).

16. Governing Law and Language

This policy is governed by the laws of the Republic of Korea, without prejudice to any mandatory consumer-protection or data-protection rights available to you under the law of your country of residence. Nothing here deprives you of the protection of provisions that cannot be derogated from by agreement under that law.

This policy is published in English and Korean. Where the two conflict, the Korean version prevails for users resident in the Republic of Korea, and this English version prevails for all other users.

17. Changes to This Policy

We may update this policy. For material changes we will provide an in-app notice requiring your acknowledgment before continued use. The "Last Updated" date reflects the latest revision.

18. Contact

Privacy & general: support@cozysand.com

Location information: support@cozysand.com

Billing: support@cozysand.com

Website: https://cozysand.com

Supervisory authorities (Korea). You may report a personal-data concern to the Personal Information Protection Commission (privacy.go.kr / 국번없이 182), the Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972), or, for personal location information, the Korea Communications Commission.