Privacy Policy

Last updated: September 2026

Cognom is a private memory of your relationships. That makes what you put in it some of the most personal data an app can hold, and we treat it that way. This policy explains, in plain language, what we collect, what we do with it, and what we will never do with it.

What we collect

Your account: an email address and password, used only to sign you in and sync your data.
Your notes: the voice notes and written notes you record about your conversations, the transcripts made from them, and the portraits built from those transcripts.
Your photos: the images you attach to moments and people.
Basic diagnostics: crash reports and error diagnostics (via Sentry) so we can fix problems. These do not include your notes or portraits.

How your recordings are handled

Most of the time, Cognom transcribes what you record and then discards the audio — we keep the words, not the voice. Transcription and analysis are performed by our servers, which call OpenAI's API to transcribe audio and summarize notes. OpenAI processes this data to provide the service and, under our API terms, does not use it to train models.

Asking questions about your memories

Cognom lets you ask questions about the people in your life and get answers drawn only from what you've recorded. To answer, our servers assemble the relevant recorded notes — portrait details, open follow-ups, your reflections, and moments — and send them, with your question, to OpenAI's API. When your question is specifically about a photo (for example, what someone was wearing in a picture), the relevant moment photos are included so the answer can describe what's actually in them.

Answers come only from your recorded notes. The assistant is required to cite the note behind each statement, and an answer that can't be traced to a real note is replaced with an honest "that isn't in your notes." Every answer shows you which of your notes it drew from.
Only what's needed for your question is sent, and photos are only ever included when your question is about a picture. Sealed time capsules are never included.
OpenAI does not train on this data under our API terms, and we do not store your questions or answers anywhere except in the chat history on your own account, which you can delete.

Voice keepsakes

A voice keepsake is the one exception to audio being discarded, and it only happens when you deliberately choose it.

A keepsake is never kept silently. After a recording, we ask if you'd like to keep a short (up to 60 second) clip of that voice. Keeping it takes an explicit action and a consent confirmation every single time — it is never a setting you turn on once.
Voice recordings are sensitive data. We treat them that way: keepsakes live in private storage that only you can reach, through short-lived links, and are never used for anything except letting you play them back. We do not analyze them, train on them, or share them.
You can delete any keepsake in one tap, and every keepsake is deleted when you delete that person or your account.

Recording children

Some of the people you keep in Cognom are children. A few things about that:

You record; the child never uses Cognom. Children are subjects in your private memory, never users of the app. There is no kid-facing experience.
Consent for a minor's recording comes from you, as their parent or guardian. When you record or keep a recording of a child, you are confirming you have the right to do so. Cognom asks you to confirm this each time you keep a child's voice.
When a child is old enough to understand, tell them. Best practice — and, where you live, sometimes the law — is that an older child or teen should know their voice and words are being kept. We ask you to honor that.
Everything recorded about a child is stored the same way as everything else: private to you, encrypted in transit, and deleted completely when you delete the child or your account.

Nothing in Cognom is shared unless you share it, and anything you share can be revoked.

Sharing a moment sends only that moment (its photos, title, and note) — never your private reflections or recordings. If you share it by link, anyone holding that exact link can view the moment in a browser; the link is unguessable and you can revoke it at any time from the app.
Comments on a shared moment are visible to the person who shared it and everyone else it was shared with, and each comment shows the name of whoever wrote it. Only people the moment was shared with can comment; a moment you never shared has no comment thread. You can delete your own comments at any time.
You cannot send someone the portrait you keep of them. We removed that on purpose. A portrait is your private record of a person, and handing it to its subject is closer to showing them your diary entry about them than to sharing a photo. What you can send is a single "About" answer — for example how you two met, or what you admire about them — addressed only to the person it is about, with no recipient picker. Anything that does leave your device passes an explicit allowlist of fields: your private reflections and raw transcripts are never shared, and every new kind of data we add is private by default.
Connections and @-handles. You can claim a short handle so people can find you without exchanging email addresses. Your handle, display name, and profile photo (if you set one) are visible to anyone who looks you up by that exact handle; nothing else is. Connecting is mutual — a request has to be accepted, either side can disconnect at any time, and a connection you did not accept grants nothing.
Paired questions are answered by exactly two connected people. Neither answer is revealed until both have answered, so nobody can read yours without giving theirs. Your answer is visible only to that one person.
The memory well. Someone you are connected to can leave you a short memory — text, a photo, or a voice note. It is one-directional and deliberately unlike an inbox: there is no reply, and the giver is never told whether you opened it, so nothing here carries an obligation. You can remove anything from your own well at any time.
Circles: only the memories you explicitly share into a family circle are visible to that circle. Your private portrait of a person is never shared, synced, or exposed by any circle activity — sharing copies the specific snippet you chose, nothing more. Every shared memory shows who shared it and when, and you can un-share any memory at any time, which removes it from the circle for everyone, immediately.
Weekly ritual answers are shared to the whole circle by design. Each week a circle has one shared question. When you answer it — a short voice note or a photo — that answer is posted into the circle's feed for its members, and we tell you plainly, before you post, exactly which circles it will go to. Because every circle shares the same weekly question, one answer can be posted to all of your circles at once; you're shown that list first. Your own voice answer stays hidden from you-versus-others gating until you've answered, so the circle reveals together. You can delete your own answer at any time, which removes it (and its audio) for everyone.
The circle feed — the moments and answers members drop in response to the weekly question, and the text comments on them — is visible only to that circle's members. Photos in the feed are stored as unguessable links; voice answers live in private storage reachable only by circle members through short-lived links, and only after they've answered that week. Comments show the name of whoever wrote them. Deleting a moment or a comment removes it for everyone immediately.
Your profile photo, if you set one, becomes your face inside your circles. When you set your own profile photo, it is shared with the members of circles you belong to, so that someone who already has you on their tree sees your real face instead of a placeholder. It is a photo you chose, shared only with people you are already in a circle with. Clearing your photo removes it everywhere.

Answering together in a circle

Once a week, everyone in a circle is asked the same question. You answer in your own words — typed, spoken, or with a photo — and you choose which of your circles the answer goes to. Two things follow from that, and we want both to be plain.

You read the others once you've answered. Until you've given your own answer for that week, nobody else's is visible to you — and yours is not visible to them until they answer. This is the whole point of the ritual, not a restriction we added afterwards.
Your answer becomes part of what your circle remembers about you. When you post an answer, our servers analyse it — via OpenAI's API, which does not train on it — into a few short statements drawn strictly from what you actually said, each kept alongside your original words. Those statements appear on the page that members of that circle keep about you, marked as coming from your own answer rather than from anything they wrote. They are subject to the same reciprocity as the answer itself: a member who has not answered that week sees neither.
Nothing is inferred. The analysis may only repeat what is in your answer. A statement that cannot be traced back to your own words is discarded rather than shown, and no statement is ever produced from a question you did not answer.
Deleting your answer removes it everywhere. The statements are held as a copy that is rebuilt from your original every time someone opens the app. Delete the answer, or leave the circle, and they are gone from everyone's copy the next time they open it. There is no separate copy to hunt down.
They stay on those devices. What a member keeps about you is private to them — it is excluded from everything Cognom lets anyone send onward, in the same way their own private reflections are.

Time capsules

A sealed capsule is hidden until its unlock date, including from you in normal browsing. You can break a seal early — it's your memory — but it takes a deliberate action.
The content belongs to you until it's delivered: an unlocked capsule surfaces to you on its unlock date, to share with the person yourself.
On account deletion, sealed capsules are deleted with everything else. There is no "held in escrow" content.

When someone passes away

Memorializing preserves their portrait exactly as it is and stops every reminder, prompt, and notification about them — permanently.
The memories remain your personal records, under your control, and are deleted if you delete that person or your account.
Memorializing is reversible for 30 days, then settles as permanent.

What we never do

We do not sell your data. To anyone, ever.
We do not show ads or share your data with advertisers.
We do not train AI models on your memories.
We do not read your notes or portraits except as needed to operate the service or as required by law.

Where your data lives

Your data is stored with Supabase (our database and authentication provider), encrypted in transit. A local copy is cached on your device so the app works offline. Crash diagnostics go to Sentry. AI processing goes through our servers to OpenAI. If you enable notifications, circle updates (for example "Anna answered this week's question", or a short excerpt of a comment) are delivered through Expo's push service and Apple/Google's notification systems — only the short notification text ever travels that way, never your recordings, photos, or portraits. These providers process data only on our behalf.

Deleting your data

You can delete any person, moment, keepsake, or note in the app at any time. Deleting your account (Settings → Delete account) permanently removes your account and everything in it — portraits, transcripts, photos, keepsakes, capsules, shares, and circle contributions — from our servers. There is no retention period and no backup we keep afterward.

Your rights

You can export all of your data from Settings at any time. Depending on where you live (including under GDPR and PIPEDA), you have rights of access, correction, portability, and erasure — the in-app export and delete features exist to honor them directly, and you can also contact us at the address below.

Who we are

Cognom is operated by Cognom Inc., a company incorporated in Canada, which is the data controller for the personal information described in this policy. You can reach us about anything in it at privacy@cognom.com, and we answer privacy requests at that address.

Changes and contact

If this policy changes in a way that matters, we'll say so in the app before the change takes effect. Questions or requests: privacy@cognom.com.