Cosmo Privacy Policy

Overview

This Privacy Policy explains how Cosmo collects, uses, discloses, and retains information in connection with Cosmo, a privacy-forward, AI personal assistant for coordinating plans and keeping useful context over time. Cosmo is operated by Obvi Labs, Inc. Cosmo is actively developing, and this policy may be updated as the service changes.

Information We Collect

We may collect the following categories of information:

• Account and contact information, including phone numbers, display names, login codes, session records, and consent records.
• Message and service content, including texts, replies, group chat content, requests, preferences, details you choose to provide, decisions, and agent-generated messages.
• Connected account and calendar information when you choose to connect a calendar, including encrypted OAuth tokens stored by Cosmo, Google account identifiers, calendar connection records, calendar metadata, and Calendar event details that Cosmo accesses transiently when needed to provide calendar features.
• Messaging metadata, including sender and recipient phone numbers, timestamps, delivery status, carrier or provider identifiers, conversation identifiers, opt-out records, and support requests.
• Technical information, including IP address, user agent, request logs, environment metadata, device or browser details, and diagnostic information.

How We Use Information

We use information to operate, maintain, test, secure, and improve Cosmo; authenticate users; send login codes; route and deliver messages; generate AI-assisted replies; summarize conversation context; maintain useful context; assist with user requests; detect and honor opt-out requests; debug issues; enforce terms and policies; and comply with legal, carrier, platform, and service-provider requirements.

Connected Google Calendar Data

Google Calendar access is optional. If you choose to connect Google Calendar, Cosmo requests Google permissions so Cosmo can help with scheduling in chat. These permissions may allow Cosmo to view events on calendars you can access, including primary, work, shared, and subscribed calendars, and to see, create, change, or delete events on calendars you own. Cosmo does not create, change, or delete events on calendars you do not own.

Cosmo uses read-only Calendar event access to answer calendar questions, check availability, find openings, identify scheduling conflicts, show relevant appointments, and provide scheduling context. Cosmo uses owned-calendar write access only for scheduling actions you explicitly approve in Cosmo, such as creating a calendar event with a title, time, calendar, location, description, and attendees. Before Cosmo creates, changes, or deletes a calendar event, Cosmo shows you the proposed action for approval. If you do not approve, Cosmo does not make the Calendar change.

Cosmo requests Google Calendar event details from Google only when needed to provide calendar features, such as answering calendar questions, checking availability, finding openings, showing relevant appointments, or preparing a calendar event you approve. Cosmo does not store Google Calendar event details in Cosmo databases. Event details are processed transiently to provide the requested feature and are not retained by Cosmo after that feature is completed, except where you separately include calendar information in a Cosmo message or instruction, in which case that message or instruction may be retained as message content under this Policy.

Cosmo stores encrypted OAuth tokens and limited calendar connection metadata, such as your Google account identifier, granted scopes, calendar identifiers, calendar names, time zones, access roles, and selected-calendar status, as needed to maintain the integration and honor your calendar settings.

When Cosmo accesses Calendar event details from Google, those details may include titles, dates, times, locations, descriptions, attendees, organizers, status, meeting links, recurrence details, and related Calendar links.

Cosmo uses connected calendar data to check conflicts, find openings, show relevant appointments, create calendar events you confirm, troubleshoot the connection, and provide scheduling and coordination features.

Cosmo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Cosmo does not sell Google Calendar data, use it for advertising, use it to determine creditworthiness or for lending purposes, or use or retain it to create, train, or improve generalized, non-personalized, foundation, or frontier AI or machine-learning models. Calendar event details may be processed by Cosmo's infrastructure and AI service providers only as needed to deliver user-facing scheduling features, secure and support the service, or comply with law, and only under restrictions consistent with this policy.

Cosmo personnel do not review Google Calendar event details except where necessary and permitted: with your explicit consent for support, to secure or debug the service, to investigate abuse, to comply with law, or using aggregated or anonymized data for internal operations.

You can disconnect Google Calendar in Cosmo or revoke access from your Google Account. Disconnecting removes Cosmo's stored Google OAuth tokens and calendar connection metadata and stops new Calendar access. Disconnecting does not delete messages, support logs, or Google Calendar events already created through Cosmo. You can contact us to request deletion of retained Calendar connection records, subject to legal, security, and operational retention needs.

AI Processing

Cosmo may process message content, service information, and related context using AI models, automated systems, and AI infrastructure providers, including Amazon Bedrock, OpenAI, and Google. Those systems may help classify messages, infer relevant details, generate suggested or automated replies, remember useful context, and decide when to follow up.

Cosmo's product direction is to reduce unnecessary exposure of identifiable details as its memory system becomes more capable. Unless a specific feature notice says otherwise, you should assume information you provide may be processed by the service providers needed to operate Cosmo as described in this policy.

SMS And Mobile Consent Data

Cosmo may use your phone number to send one-time verification codes for sign-in. After you consent to the Cosmo SMS program, Cosmo may also send questions, reminders, invitations, scheduling or coordination updates, decisions, follow-ups, and related service messages for direct chats, group conversations, tasks, and requests you start or are included in. Message frequency varies. Message and data rates may apply.

We do not sell or share mobile numbers, SMS opt-in data, or SMS consent records with third parties for their marketing or promotional purposes. We may disclose this information to service providers that help us operate Cosmo, deliver messages, maintain records, prevent abuse, or comply with applicable requirements.

Information We Hold Before You Agree

When you text Cosmo directly or are invited by SMS before having an account, and before you submit the Cosmo consent page at gocosmo.ai/consent, we hold only the minimum information needed to send you that page, prepare you to join what you were invited to, and honor opt-out requests. Specifically, we may retain:

• Your phone number in E.164 format.
• Inbound SMS messages you have sent to Cosmo (so we can audit delivery and honor STOP and HELP).
• A short-lived pending consent record (a one-time token, the entry path, the version of the disclosure shown, and an expiry time, by default 14 days).
• If you were invited to a specific plan or group conversation, your display name (if provided), who invited you, and the plan or group you were invited to, so Cosmo can add you if you consent.
• Your opt-out state, retained indefinitely so we never message a number that has opted out.

In those SMS-first flows, until you submit the consent page, we do not use AI to read or respond to your messages, do not build a broader Cosmo profile for you beyond what is needed to maintain the plan or conversation you were invited to, and do not send anything beyond the consent, invitation, HELP, or opt-out messages needed to complete or honor your choice. If you never submit the consent page, the pending consent record and pre-consent inbound messages remain subject to this Policy's general retention practices described below; opt-out records are kept indefinitely so we never message that number again.

How We Share Information

We may share information with vendors and service providers that support Cosmo, including messaging providers, hosting providers, database providers, observability tools, AI infrastructure providers, payment processors, security providers, and professional advisors. We may also disclose information if we believe it is necessary to comply with law, enforce our terms, protect rights or safety, prevent abuse, or complete a business transaction such as a merger, acquisition, financing, or sale of assets.

For Google Calendar data, Cosmo shares or transfers data only as described in the Connected Google Calendar Data section and only as permitted by the Google API Services User Data Policy, including the Limited Use requirements. If a merger, acquisition, financing, reorganization, or sale of assets would involve transfer of Google Calendar data, Cosmo will obtain explicit prior user consent where required.

Subscription Billing

If you subscribe to a paid Cosmo plan, payment is processed by Stripe, our payment processor. Stripe collects payment-card details and other information needed to process your subscription. Cosmo itself does not receive or store full card numbers; we receive an opaque Stripe customer identifier, the subscription tier and status, renewal dates, and the email address you used at checkout.

Cosmo uses subscription information to grant access to paid features, honor cancellations, retry payments through Stripe, surface your current plan in the billing settings, and reconcile billing disputes. Stripe processes payment information in accordance with its own privacy and security practices.

Group Conversations And Invitees

If you add Cosmo to a group conversation or provide information about other people, Cosmo may process messages and participant information from that conversation to provide service features. You should only include Cosmo in conversations where you have a reasonable basis to do so.

When you invite someone new to a Cosmo plan (such as a trip), Cosmo sends that person one SMS naming you and the program with a link to Cosmo's consent page. Cosmo will not send that person anything further, and will not run AI on their content, until they confirm consent on that page.

When you invite someone new to a group chat, Cosmo delivers that invite by email (if you provided an email) or by a single SMS (if you provided a phone number) with a link that takes the recipient into the Cosmo app to create or sign into their own account and join the group there. Joining and using Cosmo through the app, including AI-assisted replies, happens under that person's own account and is not gated by the separate SMS consent program described elsewhere in this Policy.

Anyone who receives a Cosmo invite or message by SMS can reply STOP to that number at any time to stop receiving Cosmo texts.

Opt Out And Choices

You can stop Cosmo texts by replying STOP, STOPALL, UNSUBSCRIBE, OPTOUT, REVOKE, CANCEL, END, QUIT, or by otherwise asking Cosmo not to text you. Cosmo may retain your phone number and opt-out record so we can honor that request. You may contact hello@gocosmo.ai for help, questions, or privacy requests.

Retention

We retain information for as long as reasonably necessary to operate Cosmo, maintain records, improve and secure the service, comply with legal or carrier obligations, resolve disputes, enforce agreements, and honor opt-out requests. Retention periods may vary depending on the type of information and how Cosmo is used.

Security

We use reasonable technical and organizational measures designed to protect information. No internet, messaging, AI, or storage system is perfectly secure, and we cannot guarantee absolute security.

Children

Cosmo is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information to Cosmo, contact us so we can review and take appropriate action.

Changes

We may update this Privacy Policy from time to time. The updated version will be indicated by the last updated date above or presented through the Cosmo web app.

Contact

Cosmo is operated by Obvi Labs, Inc. Privacy questions or requests can be sent to hello@gocosmo.ai.