Your data at CoopCouch

Account and sign-in data

A CoopCouch account can link Steam, Discord, and Google identities. We store the verified provider identifier, display name, avatar when available, link timestamps, tracked games, and opaque server-side sessions in Cloudflare D1. We do not request or retain provider email addresses, provider passwords, Steam Guard codes, or OAuth access tokens. Session and authentication secrets are stored as hashes where the service needs to verify them later.

Steam libraries and private planning

Steam library sync is optional. When requested, CoopCouch imports the account's owned-game list from Steam and stores access records, sync state, and privacy-check timestamps in D1. Group membership, invitations, manual access choices, Tonight contexts and recommendation snapshots are private to authorized group members. Decision Room data can include reactions, ranked ballots, availability, session plans, and RSVP state. Private planning data is not sent to product analytics or placed in ads.

Optional analytics and advertising

Product analytics is off until you grant analytics consent. If allowed, explicit, bounded product events can be sent to PostHog EU with pseudonymous identifiers. We do not use autocapture, session replay, contact data, provider identifiers, raw IP addresses, full query strings, or free-form planning answers in those events.

Advertising is a separate choice. Google AdSense can load only on registered public discovery pages after both analytics and advertising choices are granted and the runtime gates allow it. Private group, Tonight, Decision, invite, tracked, account, and availability surfaces do not contain ad slots. Google may present an additional region-specific consent message.

Essential storage, security, and providers

Essential cookies keep signed-in sessions and authentication challenges secure. Browser storage holds privacy choices and limited session state. Cloudflare hosts the application and D1 database and provides security and aggregate operational metrics. Steam supplies catalog and opted-in library data; Steam, Discord, and Google verify their respective sign-ins. Operational diagnostics are redacted and bounded; they exclude passwords, tokens, contacts, provider identifiers, and private planning contents.

Early-access applications

If you submit the separate early-access form, it stores controlled application answers, referral attribution, and the email you explicitly provide for up to 90 days. The email is encrypted in D1 and is not silently linked to a signed-in account or analytics consent. It is therefore outside account export and account deletion.

Retention, export, and deletion

• The profile security panel can export account data and permanently delete the account after recent reauthentication. Account deletion removes provider links, live sessions, tracked games, imported library data, memberships, and owned groups from the live database.
• Imported Steam library data can be exported or deleted separately. Deleting it keeps the Steam sign-in identity and manual access entries.
• Soft-deleted groups are purged after 30 days; live-group audit records are retained for 180 days. Tonight snapshots remain only for the lifetime of their group.
• Terminal Decision workflows become eligible for deletion after 180 days; Decision audit records are retained for 365 days and notification rows for 180 days. Expired poll response data is removed after 30 days when no live session depends on it.
• Cloudflare's encrypted recovery history may temporarily contain an older database state for its platform backup window. Independent deletion tombstones are retained for 45 days so a recovery must reapply account deletions before restored data is served.

Your choices and contact

You can reopen Privacy settings in the site footer at any time. Rejecting optional uses does not disable the catalog or private planning features. For privacy questions or a request concerning separately submitted contact data, email: