Privacy policy

The controller of your data is the publisher of Cosmose, Corentin Deleuse, sole proprietor (EI), identified in the legal notice. For any question or request about your data: privacy@cosmose.app. Cosmose has not designated a data protection officer.

• You enter with a nickname: Cosmose asks for neither a name, nor a postal address, nor an identity document.
• Cosmose knows the town you choose, never your position: no geolocation is requested from your device, and others only see a distance in whole kilometres.
• No advertising, no advertising tracker, no sale of data. A cookieless audience measurement counts page views without knowing who sees them; your browser can object to it (section 8).
• Your photos and videos are automatically compared against a database of already known child sexual abuse material, and against nothing else. Nobody at Cosmose reads your private conversations, unless a message is reported.
• You can delete your account at any time, in a minute, from Settings, and download your data beforehand.

For each use: the data concerned, why we process it, on which legal basis of the GDPR, and how long we keep it. Durations are summarised in section 6.

Entering and holding an account

Your profile and what others see

Other members (temporary accounts included) see: your nickname, your gender or your couple with its two genders, your age, your town, the distance between you in whole kilometres, what you are looking for, your account level, whether you are online, your bio and your profile photos. They never see your e-mail address, your date of birth or your coordinates. You can disappear from the “People” list (invisible mode) from Settings; your conversations continue.

A Cosmose account’s profile stays visible in “People” while you are not connected, for thirty days after your last visit, with how long ago that visit was, to the hour (“Active 2 hours ago”). For this we keep the time you were last present; until you come back after this feature started, the date of your last session (the one used to delete inactive accounts) stands in for it. You can refuse at any time by turning off “Stay visible while I’m offline” in Settings: you then only appear while you are online, and the time kept is erased. A temporary account never appears offline, and nothing is kept about its presence. Basis: legitimate interest (so that members can find and write to each other even when they are not connected at the same time), with a right to object through this setting. Duration: while the option is on, at most the life of the account.

Profile photos are uploaded to a private space; the displayed versions are served through temporary signed addresses, after removal of metadata (including position). Basis: contract. Duration: until they are deleted or the account is.

Private conversations, rooms, posts

Age verification

To share or view photos and videos, or to broadcast and watch a live, you verify your age with AgeVerif, an independent provider, on its own site. Cosmose receives neither your documents, nor your identity, nor your country: only a verification identifier, the assurance level, the verified age threshold and the dates. Basis: legitimate interest and obligations to protect minors. Duration: life of the account; the verification holds until moderation revokes it, in which case the trace of the revocation is kept.

Detection of child sexual abuse material

Every photo and video you upload (profile, private conversation, room, post) is transmitted, before any publication, to Shield, a service of the Canadian Centre for Child Protection (Project Arachnid), which compares it against the fingerprints of content already identified as child sexual abuse material. The file is transmitted without your identity or any information about your account. Nothing is kept for a file that is not recognised, apart from the version of the database used. Published content is checked again as that database grows.

For private conversations, this detection is carried out under Regulation (EU) 2026/1881, which temporarily allows messaging services to voluntarily detect such content, subject to conditions; it covers images and videos only, does not read your texts, and uses only fingerprints of known content. Basis: public interest and legitimate interest, within that legal framework. If content is recognised, it is quarantined, a case is opened, and the following are kept: the classification given by the provider, the fingerprints of your file, the file itself as evidence, and your account identifier. These data alone are kept for twelve months after the detection; for the duration of the procedure when the authorities are involved.

Reports and moderation

Reports are examined by people on the moderation team, who only access the reported content and its immediate context, never all of your conversations. Each of their reads is logged. The media of a case involving a minor are never displayed to the team.

Security of the service and fight against abuse

Legal obligations: identification data

French law (law for confidence in the digital economy, article 6-II, and decree no. 2021-1362) requires hosting providers to keep, for the sole needs of criminal proceedings and at the sole disposal of the judicial authorities, the data that identifies the author of content. Cosmose keeps for that purpose, in a separate space the application does not access:

• the e-mail address and date of birth of a Cosmose account: five years after the closure of the account;
• the nickname or nicknames used: one year after the closure of the account;
• the full IP address and connection port when the account is created and when each content is published (message, comment, post, room, media): one year from the event.

Basis: legal obligation. This data serves nothing else; it is only consulted to answer a legal request, and each consultation is logged.

Write to us

When you write to the team from the app: your message, the address you want an answer at (your account’s, or the one you give), the page you write from, the language, the window size and the browser, to understand a problem. Basis: legitimate interest (answering you and improving the service). Duration: one year after your request is closed. If you delete your account, your message is kept without your identity.

Audience measurement

To know which pages are visited and improve the site, Vercel Web Analytics counts page views: the page’s address, without any person, room or appeal-link identifier, the referring page, the country, the device type, the browser and the operating system. No cookie is set. To count visitors, Vercel computes a fingerprint from your IP address and your browser, forgotten every day; your IP address is not kept. Vercel Speed Insights likewise measures how fast pages display (load time, responsiveness, layout stability), with the page’s address cleaned the same way, the device type, the browser, the operating system, the country and the connection type. Only anonymous statistics result, which Cosmose combines with no account data. Basis: legitimate interest. If your browser signals a refusal of tracking (Global Privacy Control or Do Not Track), no page view or measurement is sent.

On the home and invitation pages, Cosmose also measures by itself how people arrive: the campaign named in the link (“utm” parameters), the name of the site you come from, the device type, and whether the page was really shown and read. No cookie or storage, no account identifier: your browser is counted through a fingerprint of your IP address and browser, computed with a key drawn every day and destroyed after two days; neither the address nor the fingerprint is kept. If you enter the chat from these pages, the campaign goes with your entry for 24 hours, only to count how many newcomers from each campaign send a first message; it is never recorded with your account. Basis: legitimate interest. Your browser’s refusal of tracking (Global Privacy Control or Do Not Track) also stops this measurement.

Service statistics

To run and improve Cosmose, we count how it is used: connections, messages, room entries, lives, reports, never their content. These figures are totals that name nobody and never say who visited which room. To know whether members come back, we keep the days you used Cosmose (present, or active: a message, a room entry, a reaction…), with the account type, for one hundred days. They are shown to nobody, not even the team, which sees totals only, and they are deleted with your account. Basis: legitimate interest.

E-mails

Cosmose only sends necessary e-mails: entry and reset codes, security confirmations (password changed, Google account linked or unlinked), moderation notices, acknowledgements and answers to your reports and messages, a warning before an inactive account is deleted, confirmation of deletion, and the digest of unread messages described below. No marketing, no newsletter.

Being told of messages

If you turn notifications on for a device, your browser gives us a delivery address at its notification service (Google, Mozilla, Apple or Microsoft, depending on the browser) and encryption keys; we keep them with the device’s language and the session that registered them. When a private message reaches you while you are not in the app, we send “New message on Cosmose” there, encrypted: the notification service cannot read it, and nothing says who wrote to you or what. Basis: your request on that device. Retention: until you turn them off, that session ends (signing out included), the notification service refuses the device, or thirty days without opening the app.

A Cosmose account also receives, at most twice a day, an e-mail saying how many messages are waiting, when messages stayed unread for a quarter of an hour without you coming back; never their author or content. Basis: legitimate interest (giving your conversations a chance to go somewhere). You stop it in Settings or with one click from each e-mail. Your choice is kept for the life of the account.

Beta and Premium

During the beta, the date of your first session and your account type are recorded so that participants can be thanked later. Premium is granted by Cosmose; no payment data exists. Basis: contract. Duration: life of the account.

Two pieces of information you may choose to show may reveal a sexual orientation or a sex life, which the GDPR counts among sensitive data (article 9): the genders of a couple’s two members, and “a casual encounter” in what you are looking for. Your gender alone, your age, your town, “chat”, “friendship”, “dates” or “a serious relationship” are not among them.

Cosmose does not require them: you give them if you wish. Only then does a box, separate from the acceptance of the terms, ask for your explicit consent to their being shown on your profile and used in other members’ searches; for a couple, it is ticked on behalf of both members. Cosmose records the date, the version of the accepted text and every withdrawal. Without this consent, this information is neither shown nor found by searches.

You can withdraw this consent at any time from Settings › Privacy: this information is then erased from your profile, and nothing else changes. Withdrawal does not call into question what was done before.

Entering a room, whatever its theme, asks for no consent: Cosmose keeps no history of the rooms you visit and infers nothing from them, and your presence is visible only to the members there at the same time. What you write in a room, your bio is published by you for the other members: put nothing there you do not want to make public.

• Other members, for what you make visible (section 3, “Your profile”) and what you send them.
• The Cosmose team, within what moderation, support and security require; access to a case’s content is individual, justified and logged.
• Our providers, which process data on our behalf and under our instructions (section 7).
• The authorities, when the law requires it: judicial requests, requests from the competent administrative authorities, reporting of illegal content provided for by law.

Cosmose does not sell, rent or pass on your data to anyone.

Cosmose relies on providers that process data on its behalf, bound by a processing contract compliant with article 28 of the GDPR, except those acting on their own behalf, marked in the table. Your data is hosted in the European Union. Some providers are established outside the Union or may route data through it; the table gives, for each, the safeguard that frames the transfer.

Cosmose only uses cookies and local storage that are strictly necessary to the service or limited to your display preferences. None of them serves to track you or deliver advertising. The audience measurement (section 3) sets no cookie and no storage: it is limited to anonymous statistics of the site, Cosmose’s own, and your browser can object to it. The law therefore does not require your consent, and Cosmose shows no banner.

You can delete these cookies and this storage from your browser; Cosmose will then ask you to sign in again.

You have the rights provided by the GDPR and the French Data Protection Act:

• Access and portability: download your data from Settings › Data and account, in a readable file (JSON). Once a day.
• Rectification: change your profile, your town, your e-mail address and your password from the app. Gender and couple status cannot be changed from the app: write to us.
• Erasure: delete your account from Settings › Data and account; the effect is immediate (section 6). What must be kept by legal obligation or for an ongoing procedure is kept, and only for that.
• Withdrawal of consent to sensitive data: Settings › Privacy (section 4).
• Objection and restriction: for processing based on our legitimate interest, write to us explaining your situation.
• Post-mortem directives: you can tell us what should become of your account.
• Complaint: with the CNIL (cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

To exercise a right that is not available in the app, write to privacy@cosmose.app from your account’s address, or from the app while signed in to your account. We answer within one month, extendable by two months for a complex request, and may ask you to confirm your identity with a code sent to your address. A temporary account, which has no address, exercises its rights from the app while its session is open.

Cosmose is for adults only and does not knowingly collect data about minors. If you learn that a minor is using Cosmose, report them with the reason “Minor or person in danger” or write to us: the account is closed and its data erased, subject to what the law requires us to keep.

Encrypted exchanges (HTTPS), passwords hashed with a resistant algorithm (Argon2id), sessions and codes stored hashed, photos and videos reachable through temporary signed addresses, compartmentalised team access with a second factor and a log of every access, providers chosen for their guarantees. No system is infallible: in case of a data breach likely to affect you, we inform you as the law provides.

Version 2026-10-07. This policy evolves with the service. A change that alters what we do with your data is shown to you the next time you enter; others are published here with their date.