Cozee Privacy Notice

Last Updated: August 5, 2026

This Privacy Notice explains how 4TH.VISION d.o.o. (“Cozee,” “we,” “us,” or “our”) collects, uses, and shares personal data, and how you can exercise your privacy rights.

This Notice applies to personal data processed by Cozee across our websites, mobile/desktop applications, and other online or offline offerings. We call these collectively the “Services”.

Personal Data We Collect
How We Use Personal Data
How We Disclose Personal Data
User Content and Public Sharing
Automated Decision-Making and Profiling
Your Privacy Choices and Rights
How to Delete Your Data
International Transfers of Personal Data
Retention of Personal Data
Supplemental Notice for EU/UK GDPR
Supplemental Notice for U.S. State Laws
Children’s Privacy
Third-Party Websites/Applications
Contact Us

Personal Data We Collect

The categories of personal data we collect depend on how you interact with Cozee and the applicable laws. We collect data you provide, data we collect automatically, and data we receive from others.

A. Personal Data You Provide

Account & Profile. Username, email address, password/SSO identifier, optional profile fields (e.g., avatar).
Billing & Purchases. If you make purchases directly through the App Store (iOS) or Google Play (Android), the app store processes your payment. We receive a transaction receipt/confirmation to validate your purchase, but we do not receive or store your credit card information or billing address.
Device & Log Data. IP address (coarse location), device model, OS version, app version, language, timestamps, crash logs (via Sentry), and Push Notification Tokens (to facilitate message delivery).
User Experience & Interaction Data. To improve app usability, we use Microsoft Clarity and Firebase Analytics. This may include data on screens visited, taps, scrolling behavior, and visual session replays (heatmaps/recordings) of your interactions within the app. These recordings are masked to exclude sensitive text input.
Content & Usage Within the Service. Designs, comments, votes or other content you upload or create in Cozee, settings and preferences.
Support & Communications. Information you share when you contact support, respond to surveys or research, or give feedback.

B. Personal Data Collected Automatically

When you use the Services, we automatically collect:

Device & Log Data. IP address (coarse location), device and browser type/version, OS, app version, language, timestamps, pages/screens viewed, referring/exit pages, crash logs, diagnostic data, in-game activity.
Product Interaction Data. Clicks, features used, session duration, and similar telemetry to keep the Service reliable and secure.

C. Cookies & Similar Technologies

Essential cookies are used for core functions like authentication, security, and load balancing.
Non-essential cookies/SDKs (e.g., analytics) are used only with your consent where required (EEA/UK). You can change your preferences any time via our cookie banner or settings.

D. Personal Data from Other Sources

SSO/Identity Providers (if enabled). We receive identifiers and profile fields you authorize (e.g., name, email).

We do not intentionally collect special category data (e.g., health, biometric) through the core product. Please avoid uploading such data unless your contract with us explicitly allows it and we provide appropriate safeguards.

2) How We Use Personal Data

We use personal data for the purposes below. Under GDPR, each purpose has a legal basis.

Provide & Secure the Services

Create/manage accounts, authenticate users, operate core features, provide support, and maintain availability and security (including fraud/abuse prevention and incident response).
Legal bases: Contract (to provide the Services); Legitimate interests (service security and reliability); Legal obligation (where applicable).

Product Improvement & Analytics

Understand how features are used to fix bugs, improve performance, and guide product decisions using aggregated or data that has been processed to prevent it from being linked to a specific individual.
Legal bases: Consent for non-essential cookies/SDKs in EEA/UK; Legitimate interests where consent is not required.

Communications

Transactional/service emails (e.g., security alerts, feature or policy updates), and where permitted optional product news.
Legal bases: Contract (service notices); Legitimate interests or Consent for marketing depending on region.

Compliance & Protection

Comply with legal obligations (tax, accounting, regulatory requests), enforce terms, and protect rights, safety, and property.
Legal bases: Legal obligation; Legitimate interests.

We do not sell personal data and we do not share it for cross-context behavioral/targeted advertising. We may share limited data for advertising measurement/attribution (e.g., SKAdNetwork/App Events) when permitted.

3) How We Disclose Personal Data

We disclose personal data in these situations:

Service Providers (Processors). Trusted vendors that host infrastructure, provide analytics, and offer support tooling. They act under contract and only on our instructions. Our specific third-party processors include:
- Google Firebase: Used for analytics, A/B testing, and delivering push notifications (FCM).
- Sentry: Used for real-time error tracking and crash reporting to improve app stability.
- Microsoft Clarity: Used to analyze user experience patterns, heatmaps, and session interactions to improve app design.
- Meta (Facebook): used for advertising measurement/attribution (App Events / SKAdNetwork).

Legal/Safety. To comply with laws, lawful requests, and to protect rights, safety, and security.
Corporate Transactions. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.
Affiliates. Where relevant, within our corporate group under this Notice.
Advertising Partners: We may use advertising measurement partners (e.g., Meta) to measure the effectiveness of our marketing campaigns. We do not show third-party ads in the app

4) User Content and Public Sharing

Cozee is a creative platform where you may upload or create content such as designs, captions, comments, votes, or other user-generated content (“User Content”). Please note:

Public Visibility. User Content you submit may be visible to other users of the Services, and in some cases, to the general public (for example, in community feeds or challenges). Please do not share personal information in your designs, captions, or comments that you would not want others to see.
Sensitive Data. We do not require or intend to process special categories of data (such as health, biometric, or racial/ethnic information). Please avoid including such data in your User Content.
Moderation. We may review, moderate, or remove User Content to enforce our Terms of Service, community standards, and safety obligations.
Responsibility. You are responsible for the User Content you share. By submitting User Content, you understand that others may view, use, or share it in ways outside of our control.

Please be aware that User Content may also appear in public feeds, leaderboards, search results, or promotional features within the Services.

5) Automated Decision-Making and Profiling

Some features of the Services use automated processing to support functionality such as surfacing content in feeds, ranking designs, or awarding in-game medals and rewards. These processes are designed to be transparent, fair, and primarily affect how content is displayed or how in-game rewards are granted.

We do not engage in automated decision-making that produces legal or similarly significant effects about you.

6) Your Privacy Choices and Rights

Marketing emails. Opt out any time via the unsubscribe link. You’ll still receive transactional/service emails.
Push notifications (apps). Control via your device settings.
Cookies/SDKs (non-essential). Manage via our settings.
Account & Data Deletion. You can delete your account and personal data at any time. See How to Delete Your Data below.

Rights (GDPR and similar laws)

Depending on your location, you may have the right to access, rectify, erase, restrict or object to processing, and data portability. Where we process data based on consent, you can withdraw it at any time (this does not affect processing before withdrawal).

To exercise rights, contact info@playcozee.com We will respond within one month (extendable by two months for complex requests, and we’ll tell you if we extend). You also have the right to complain to your local supervisory authority. We may need to verify your identity before processing your request to prevent fraud.

7) How to Delete Your Data

You can delete your Cozee account and the personal data associated with it at any time.

Option 1 — Delete your account in the app

Open the Cozee app and sign in.
Tap the Profile tab in the bottom navigation bar.
Tap the Settings icon in the top-right corner.
Tap Delete Account.
Confirm when prompted.

Your account and associated personal data are deleted immediately upon confirmation. You do not need to contact us.

Option 2 — Request deletion by email

Email info@playcozee.com with the subject line “Delete My Account”, sent from the email address registered to your account, and include your Cozee username.

We verify your identity before acting on the request to prevent fraudulent deletions, then complete the deletion and confirm to you within 30 days.

If you signed up using Facebook Login

Either option above deletes your Cozee account and all data we received from Meta — your Facebook user ID and the name and email address you authorized.

You can also revoke Cozee’s access from Facebook: Settings & Privacy → Settings → Apps and Websites → Cozee → Remove. This stops further data sharing but does not by itself delete the Cozee account you already created.

Deletion is permanent and cannot be undone. Residual copies may remain in encrypted backups for up to 90 days, after which they are overwritten.

What is deleted

Your account and profile — username, email address, login credentials, avatar
All Designs you created or submitted
Your comments, votes, likes, and follow relationships
Your push notification tokens
Your analytics identifiers held by our processors (Google Firebase, Sentry, Microsoft Clarity)

What we may retain

Billing and tax records for App Store or Google Play purchases — up to 10 years, as required by law. We never receive or store your payment card details.
Records of safety or Terms of Service violations, where needed to protect the Services or enforce our agreements.
Aggregated or anonymized data that can no longer be linked to you.

Deleting specific data without deleting your account

To request removal of a specific category of data while keeping your account, email info@playcozee.com.

Problems?

If you have difficulty deleting your account, or do not receive confirmation within 30 days of a verified email request, contact info@playcozee.com.

8) International Transfers of Personal Data

We may process data outside your country. For transfers from the EEA/UK/Switzerland to countries without an adequacy decision, we use the EU/UK Standard Contractual Clauses and apply supplementary measures (e.g., encryption at rest and in transit, access controls). Hosting region and key vendor locations are described in our sub-processor list. More details are available upon request.

9) Retention of Personal Data

We retain personal data only as long as necessary for the purposes described above, including to comply with legal, accounting, or reporting requirements. Typical periods (which we will enforce operationally):

Account & profile data: life of account + 90 days (then deletion or anonymization).
Analytics events: 13 months (then aggregated).
Support tickets: 24 months.
Billing/tax records: up to 10 years (jurisdiction-dependent).

We may retain minimal information to prevent fraud, resolve disputes, or enforce agreements.

10) Supplemental Notice for EU/UK GDPR

We rely on the following legal bases:

Performance of a contract (Art. 6(1)(b) GDPR) — to provide the Services.
Legitimate interests (Art. 6(1)(f)) — e.g., service security, product improvement (where consent is not required).
Consent (Art. 6(1)(a)) — e.g., non-essential cookies/SDKs, certain marketing.
Legal obligation (Art. 6(1)(c)) — e.g., tax, accounting, lawful requests.

11) Supplemental Notice for U.S. State Laws

This section applies to residents of California, Colorado, Connecticut, Utah, and Virginia. These laws give you specific rights regarding your personal data, in addition to the rights described elsewhere in this Privacy Notice.

Your Rights (All States)

If you live in one of these states, you may have the following rights:

Right to Know / Access: Request details about the personal data we collect, use, disclose, and/or sell/share.
Right to Delete: Ask us to delete personal data we collected from you, subject to exceptions.
Right to Correct: Request correction of inaccurate personal data we hold about you.
Right to Data Portability: Request a copy of your personal data in a portable format.
Right to Opt Out of Sale or Sharing: You can opt out of the sale of your personal data or the sharing of it for cross-context behavioral advertising. Cozee does not sell personal data or share it for cross-context behavioral advertising. We may use advertising measurement/attribution partners to understand the effectiveness of our marketing (this is not cross-context behavioral advertising).
Right to Limit Use of Sensitive Data (CA only): We do not use sensitive data for purposes other than those permitted by law.
Right to Appeal (CO, CT, VA): If we deny your request, you can appeal by contacting us at the email below.

Exercising Your Rights

To exercise any of these rights, contact us at info@playcozee.com. We may need to verify your identity before fulfilling your request. You may also appoint an authorized agent to submit requests on your behalf, subject to verification.

Non-Discrimination

We will not deny you services, charge different prices, or provide different levels of service if you exercise your privacy rights.

State-Specific Information

California (CCPA/CPRA)

In the past 12 months, we have collected the categories of personal data described in “Personal Data We Collect.”
We disclose personal data for business purposes as described in “How We Disclose Personal Data.”
We do not “sell” or “share” personal data as defined by the CCPA.
You may designate an authorized agent to act on your behalf by providing us with written authorization.

Colorado (CPA)

You may opt out of targeted advertising and the sale of personal data (we do not engage in these practices).
If your request is denied, you may appeal by emailing info@playcozee.com with the subject line “Appeal.”

Connecticut (CTDPA)

Similar rights to Colorado. You may also opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects. Cozee does not engage in this kind of profiling.

Utah (UCPA)

You have rights to access, delete, and obtain a copy of your personal data, and to opt out of targeted advertising or the sale of personal data. We do not sell personal data or use it for targeted advertising.

Virginia (VCDPA)

You may opt out of targeted advertising, sale of personal data, and profiling for decisions with legal or similarly significant effects. Cozee does not use your data in this way.
If your request is denied, you may appeal by emailing info@playcozee.com with the subject line “Appeal.”

12) Children’s Privacy

Our Services are intended for a general audience and are not directed to children.

To create an account and use Cozee, you must be at least 16 years old, or the minimum digital consent age in your country of residence, whichever is higher.

We do not knowingly collect or solicit personal data from anyone under the age of 13 (or under the applicable digital consent age in your country). If you are under this age, please do not attempt to register for the Services or send us any personal data.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at info@playcozee.com

If we learn that we have collected personal data from a child in violation of applicable law, we will promptly delete that information and close the account unless we are legally required to keep it.

13) Third-Party Websites/Applications

The Services may link to third-party sites or apps. Their processing is governed by their own privacy notices. We are not responsible for their practices. Please review their policies before sharing personal data.

14) Contact Us

4TH.VISION d.o.o.
Registered address: Ulica škofa Maksimilijana Držečnika 6, Maribor, 2000 Maribor
Email: info@playcozee.com

Privacy Policy