Privacy Policy

Fenkil Technologies LTD operates cohero and is the controller of personal data processed to run the platform. A controller decides why and how personal data is used. Contact hello@coheroapp.com about this policy, your account data or a privacy concern; you do not need to publish the concern in a dream or contact another user to exercise your rights against us.

This policy covers account creation, browsing and publishing dreams, backing, milestone reviews, membership, chat, reports, support and the security of our service. It applies whether you are a Dreamer, a Backer or use one account for both roles. Some information is necessary for a particular feature, while other information is supplied at your choice.

Our payment partner processes payment information and may also act as a separate controller for its own legal, fraud prevention and payment-network obligations. Its privacy information applies to that independent processing. Other users are responsible for their own use of information they receive, and a copy saved outside cohero may not be under our control.

Read this policy with the Terms of Service, Cookie Policy, Backing & Gift Policy and Membership & Billing Terms. Those documents explain the service rules rather than replacing this explanation of personal data use. The Community Guidelines, Trust & Safety and Intellectual Property Policy also describe processes that may involve reviewing submitted material.

We collect the information you provide when creating and maintaining an account, including your email address, sign-in credentials, real-identity information and profile details you submit. Accounts use email and password sign-in, and one person may maintain one account. You must be at least 18 years old to use the service.

Profile information can include the name, photograph, description or other details you choose to provide through the available fields. Information displayed on a profile can be seen by the audience for that profile and associated dreams or interactions. Avoid putting private contact details or sensitive information into fields intended to introduce you to others.

We maintain account settings and status information, including language and light or dark theme preferences, membership status and account deletion requests. We also record account changes so that we can support users, investigate unauthorised activity and administer the service. A request to correct your profile does not require altering an accurate historical transaction record.

Where information is necessary to create an account, process a payment or review an issue, not providing it may prevent us from providing that feature. You can decline optional profile details and avoid submitting information that is not needed for your chosen use. Do not provide someone else's identity or credentials as your own.

We collect draft and published dream descriptions, goals, milestone amounts, status information and changes you make to that content. Dream statuses include draft, pending review, live and rejected. Our team reviews every dream before it goes live, and review may involve the description, profile, supporting material and relevant communications about the submission.

Proof submitted for milestones may include photographs, videos, documents and written descriptions. We process that material to present it for milestone review, establish the order of milestones and record decisions or requests for more information. A document or image may reveal more than its author intends, such as a name, a face, an address or details about another person's circumstances.

Uploaded photos, videos and proof are stored privately and displayed using expiring or signed links. These technical restrictions help control access to stored files but do not make content confidential from its intended audience. A published dream is intended to be discoverable in the service, and users who can view material may be able to save or capture a copy.

Drafts are private rather than published to the discovery feed, but authorised personnel and providers may process them as needed to operate, support and secure the service. If membership lapses, dreams are hidden from the feed, while existing Backers and chat partners can still see them and milestone reviews continue. Hiding a dream from discovery is therefore not the same as deleting it or removing access from everyone.

Dreams about health, education, home or personal circumstances may reveal sensitive information. Share only what is needed, redact unnecessary details in proof and obtain permission before submitting another person's data. Where applicable law requires explicit consent or another additional legal condition for sensitive data processing, we must have that condition; ordinary contractual necessity alone does not remove those protections.

We collect records of backings, including the supporting account, dream, amount, timing, anonymity choice and transaction status. We also maintain milestone allocations, proof submission times, release decisions, requests for information, payouts and returns of unreleased funds. These records enable the platform to distinguish money already released from money still held for review.

Backings are gifts rather than investments, loans or purchases, and the records reflect that model. A 15% platform fee is deducted from the amount chosen by the Backer, not added on top. We retain transaction information necessary to account for that fee and for the remainder allocated across milestones, including when unreleased funds are returned.

Payments are charged in USD, while some displayed amounts are approximate conversions. We process relevant amount and currency information to show payment history and investigate discrepancies. Your bank or card issuer may separately process exchange rates, fees and transaction information under its own terms and privacy practices.

Our payment partner handles card details; cohero never stores full card numbers. We receive payment-related references, status information and other information needed to connect payments, refunds, membership and payouts to the appropriate account. The partner may need further information for payment security, identity checks or legal compliance, as explained in its own notices.

For Dreamer membership, we process the plan, billing status, renewals, cancellation and paid-period information needed to provide access. A cancelled membership can remain active until the end of the paid period, so the cancellation record and access status may differ. Do not send full card details, passwords or unnecessary payment documents to support or another user in chat.

When you use chat, we process message content, participants, timestamps and delivery or read information. The service includes typing indicators, online status and Seen receipts, which reveal aspects of your activity to the relevant conversation participant. Opening a chat with a Dreamer from a dream also saves that dream, creating an association in your account.

Messages are available to their recipients and may contain personal information you choose to share. We process them for delivery, conversation history, support and safety purposes where appropriate, including investigation of reported content. Do not assume that a private conversation prevents a recipient from copying a message or sharing it independently.

We collect reports about dreams, users and messages, including the reporting account, reported material and explanations or evidence supplied. Our team reviews reports and may need relevant surrounding context to understand what happened. We do not promise absolute confidentiality for every report, because fair investigation, safety measures or legal obligations may require limited disclosure.

We process block relationships to prevent blocked users from messaging you and to hide their dreams from you. Blocking does not erase earlier messages, reverse gifts or make all earlier interactions disappear from records. The existence or practical effect of a restriction may be apparent to the other person even without disclosure of a private explanation.

Notification records may relate to a new message, a new paid backing, a completed milestone or approval or rejection of a dream. In-app notices and service emails help communicate those events. Email delivery involves our email delivery provider, and notification content should be treated as potentially visible to anyone who can access your device or mailbox.

On our own servers we record sign-ins, sign-outs, failed sign-ins, account changes, dream changes, reports and errors. These logs include IP addresses and device or browser type. We use this information to detect suspicious activity, troubleshoot problems, support users and investigate misuse of the service.

Security logs can connect a technical event with an account, time and action. An IP address or device description can help identify unusual access but does not conclusively establish which individual performed an action. We consider the relevant context rather than treating a single log entry as proof of misconduct.

When you contact support, we process the contact information, correspondence and attachments you provide, together with relevant account and transaction information needed to respond. We may record the issue, steps taken and outcome so that follow-up requests can be handled consistently. Avoid sending sensitive information unrelated to the problem.

You may request a copy of your account history through hello@coheroapp.com. We may need to check that the requester controls the account and remove information that would compromise another person's privacy or platform security. A history response and a broader data-access request can overlap, but some information may require a separate explanation or lawful restriction.

We do not use third-party advertising trackers. Analytics, if used, are self-hosted and privacy-friendly, with collection limited to a legitimate operational purpose. The absence of advertising trackers does not mean that no technical data is processed: sign-in sessions, error records and security logs remain necessary parts of running the platform.

Where data protection law requires a legal basis, we identify a basis for each purpose rather than treating account registration as consent to every use. Contractual necessity applies to processing objectively needed to provide the service you request. Legal obligations and legitimate interests support separate activities where their requirements are met; consent is used where the law requires a genuine choice.

• Contractual necessity: create and administer your account, authenticate sign-ins, save settings, prepare and publish dreams, deliver chat, present proof, process backing allocations and releases, administer membership and respond to service requests.
• Legitimate interests: protect accounts and users, investigate reports and fraud, troubleshoot errors, maintain reliable service, enforce platform rules and handle or defend legal claims. These interests are assessed against your rights and reasonable expectations.
• Legal obligations: maintain required financial records, respond to valid legal demands, meet applicable payment and compliance requirements and fulfil data protection duties.
• Consent: process information where consent is required by applicable law, including an additional permission for sensitive information where relevant. You may withdraw consent for future processing without making prior lawful processing unlawful.

A single record may serve different purposes at different stages, such as a backing record used first to perform a transaction and later for mandatory accounting. We do not rely on a continued contractual relationship to keep all data indefinitely after an account closes. The purpose, lawful basis and retention need must remain applicable.

For legitimate interests we consider necessity, the amount and sensitivity of data, likely effects on people and safeguards such as access controls or limited disclosure. You may object to processing based on legitimate interests, and we will consider whether we must stop or can demonstrate grounds permitted by law. We do not treat a general interest in growing the business as unlimited permission to use private communications.

If we propose a materially different use, we will assess whether it is compatible with the original purpose and provide any additional notice or choice required by law. We do not sell personal data or use it for third-party advertising tracking. Mandatory rights apply even where a feature is provided without a membership charge.

You can choose to back anonymously so that the Dreamer and the public do not see your identity as the Backer. This changes the identity displayed to those audiences; it does not make the transaction untraceable to the platform. Administrators can see the supporting account and relevant backing information.

We and our payment partner still need transaction information to process the backing, administer milestones, return unreleased funds and meet applicable obligations. The anonymity setting does not erase financial records or prevent lawful disclosure to competent authorities. It also does not remove your ability to request access to your own data.

If you choose to chat with the Dreamer, the interaction may reveal who you are despite your anonymous backing choice. The content of messages, your profile or circumstances you describe can also identify you. Avoid including identifying information in a conversation if you want to preserve anonymity toward its recipient.

Anonymity does not alter the gift rules or milestone review obligations. The platform must still associate your decisions with your held funds to apply the 14-day review window and any automatic return correctly. We do not publish the administrative association merely because it is required to operate the transaction.

We share information only for defined service, legal or safety purposes and do not sell personal data. Relevant staff receive access according to their responsibilities, including dream review, support, security and report handling. Internal access to sensitive records should be limited to what is needed for the task rather than available to all personnel by default.

• Our payment partner receives information needed for payment processing, membership billing, payouts, returns, fraud checks and legally required compliance. It may process some information independently under its own legal duties.
• Our hosting provider processes data needed to store and deliver the service, including accounts, content, private uploads and technical infrastructure records.
• Our email delivery provider processes recipient and message information needed to deliver service notices and support communications.
• Competent authorities, courts or other legally entitled recipients may receive information where required by law or necessary and lawful to protect rights, investigate fraud or address serious safety concerns.

Service providers acting on our behalf are engaged for the relevant service and subject to appropriate confidentiality, security and data protection requirements. They are not authorised by us to sell your information or use private platform data for unrelated advertising. A provider's independent processing, where applicable, must be distinguished from processing carried out solely on our instructions.

Other users receive information inherent in the features you choose: a published dream, a message addressed to them, proof made available for milestone review or identity information associated with a non-anonymous backing. We do not need to classify that necessary feature delivery as a sale to explain that another person can see the information. Review the audience and avoid sharing details beyond what you intend that audience to receive.

If a lawful organisational transaction affects the operation of the service, relevant data may need to be handled as part of that transaction subject to applicable law, confidentiality and purpose limits. This is not permission to disregard this policy or transfer all data for an unrelated purpose. We will provide notice where required if responsibility for your data changes.

Providing a digital service may involve processing or access in countries different from the country where you live, including through our hosting, payment and email delivery providers. The laws in another country may offer different protections or permit different forms of government access. This policy does not promise that all records remain exclusively in your home country.

Where applicable law restricts international transfers, we use a lawful transfer mechanism before making the transfer, such as an applicable adequacy decision or approved contractual safeguards. We assess additional protections where required in light of the data, purpose and destination. A provider contract alone does not remove the need to consider mandatory transfer requirements.

You can contact hello@coheroapp.com for information about safeguards relevant to your personal data and how to obtain a copy or description where available. We may redact confidential commercial information or security-sensitive details while still explaining the protection relied on. We do not name an unverified storage location or imply that a particular legal transfer regime applies to every user.

We keep personal data only for as long as reasonably needed for the purpose for which it is processed, subject to legal requirements and the account deletion process below. Retention depends on the type of record, whether a transaction or complaint is open and whether a law requires a particular record. We do not apply one indefinite retention period to all information.

Account and profile information is generally needed while the account remains active. Dream content, proof and communications may remain necessary while a dream, milestone review or conversation is ongoing. Payment, fee, refund and payout records may be subject to legal accounting and compliance requirements even after feature access ends.

Security and error logs are retained according to their operational, fraud prevention and investigation needs. A record relevant to a particular incident or legal claim may need to be preserved longer than an ordinary troubleshooting entry. We limit the retained information and its accessibility to what the continuing purpose requires.

When identifiable information is no longer needed, we delete it or irreversibly anonymise it rather than merely hiding it in the interface. Anonymisation means information no longer identifies a person; replacing a visible name while retaining an accessible identifying link is not enough to claim full anonymisation. Aggregated or genuinely anonymous information may be retained because it is no longer personal data.

If you want to know why a particular record remains, ask us to explain the relevant category, purpose and legal requirement. We do not invent a fixed statutory period that may differ by jurisdiction. A lawful restriction on deletion should be confined to the necessary records, not used to preserve an entire account without justification.

To make sure each person receives only one free membership period, we keep a record of when your free period started and ends together with a one-way coded (hashed) version of your normalised sign-in email. This record is kept after account deletion and anonymisation, cannot be turned back into your email address, and is used only to check whether a free period has already been given.

You can request account deletion from your profile. The request starts a 30-day grace period, during which signing in and choosing keep my account cancels deletion. Signing in alone should not be confused with making that choice; follow the account flow to confirm that you want the account retained.

After 30 days, the account and personal data are deleted. Necessary records such as backings, payments, refunds and messages sent to others are retained only in a form that no longer identifies you, and to the extent required by law for purposes such as accounting or fraud prevention. If law specifically requires identifiable information to be kept, that limited information is retained under the legal requirement rather than treated as anonymous.

Anonymisation preserves necessary transaction or conversation continuity without retaining an identifying account association. We must also consider whether free-text content, attachments or surrounding context would still identify you, rather than assuming removal of a profile label is sufficient. Any identifiable data that remains subject to a legal exception continues to receive privacy and access protections.

Deleting your account does not necessarily erase copies another user has already independently saved, nor does it withdraw a message from every recipient's own records outside our control. We can address data we control and explain any applicable limitation. Contact us if retained content exposes your information so that we can assess redaction or another appropriate response.

Deletion does not reverse money already released to a Dreamer or eliminate outstanding payment administration. Held funds and milestone records must be handled under the Backing & Gift Policy, including applicable return rules, while unnecessary identity links are removed. If you need help with both account closure and an unresolved transaction, explain both issues to hello@coheroapp.com.

We use technical and organisational measures appropriate to the data and risks, including access restrictions, private media storage and expiring or signed links for uploaded files. Security logging supports detection of suspicious sign-ins and investigation of account changes. Our payment architecture leaves full card-number handling to our payment partner rather than storing those numbers at cohero.

No online service can guarantee absolute security or prevent every unauthorised copy by an intended recipient. Signed links can limit access over time but do not prevent someone who is allowed to view a file from capturing what they see. Do not post information that would create an unacceptable risk if another user saved it.

Protect your email account and password, use a password you do not share with others and sign out on devices you do not control. Contact hello@coheroapp.com promptly about suspected unauthorised access or an exposed file, giving a description rather than sending passwords or full card details. We may need to verify account control before changing access or disclosing records.

Where a personal data breach occurs, we assess the incident and take appropriate containment and remediation steps. We notify competent authorities and affected people when applicable law requires it. An investigation may require preservation of relevant logs, but that does not authorise unrelated or indefinite retention.

Depending on applicable law, you may have rights of access, correction, deletion, restriction, portability and objection, as well as a right to withdraw consent and complain to a competent authority. These rights are subject to the conditions and exceptions established by law, not to whether you have a paid membership. We explain a refusal or limitation where required rather than treating every request as automatically available or automatically denied.

• Access: ask whether we process your personal data and request a copy and information about its purposes, recipients and retention. You may also request your account history.
• Correction: ask us to correct inaccurate information or complete incomplete information. Historical records may need an explanatory correction rather than a misleading rewrite of what occurred.
• Deletion and restriction: ask us to erase data or limit use where the legal conditions apply. Limited records may need to remain for a legal duty, protection of another person's rights or a valid legal claim.
• Portability: where applicable, request data you provided that is processed automatically on the basis of consent or contract in a structured, commonly used, machine-readable format, and transmission where technically feasible.
• Objection: object on grounds relating to your situation to processing based on legitimate interests. We must assess the objection and stop unless the law allows continued processing on applicable grounds.
• Consent and complaint: withdraw consent for future processing where consent is the basis, and complain to the competent data protection authority, including an authority in your place of residence, work or alleged infringement where applicable.

Send requests to hello@coheroapp.com and identify the relevant account and right or issue. We may ask for proportionate verification before disclosing, deleting or changing information, particularly where a request involves financial records or another person's account. We will not request more identifying information than reasonably needed for that verification.

We respond within the time required by applicable law and explain any lawful extension or refusal. Requests are generally handled without charge, subject to lawful exceptions for manifestly unfounded or excessive requests. We may protect another person's information or security-sensitive details while still providing the information you are entitled to receive.

You do not have to contact us before complaining to an authority, although we welcome the opportunity to address your concern. Raising a request does not require you to abandon a payment dispute, close an account or waive another right. Where we cannot resolve an issue, we will explain the available next steps as required by law.

cohero is intended only for people aged 18 and older. People below that age must not create an account, publish dreams or give backings through the service. We do not knowingly offer accounts to children below the minimum age.

If you believe that someone below 18 has created an account or supplied personal data to us, contact hello@coheroapp.com with enough detail to identify the concern. We will investigate and take appropriate steps to remove the account or data, subject to necessary legal and safety obligations. Do not send additional sensitive information about a child unless it is needed to assess the concern.

An adult's dream or proof can still contain information about family members or other people who do not have accounts. Do not upload their information unless you have the necessary authority and a lawful reason to share it. Take particular care with images, health details and documents involving children, even when the account holder meets the minimum age.

We use strictly necessary cookies and local storage for sign-in sessions, language choice and light or dark theme preferences. These functions allow authentication and keep the interface consistent with your choices. We do not use third-party advertising cookies or advertising trackers.

Our payment partner's checkout page may set its own necessary cookies for payment functionality and security. Those cookies are handled in the checkout context and should be explained by the partner's relevant information. A payment page can have technical requirements separate from your theme or language settings on cohero.

Read the Cookie Policy for further information about these technologies and available controls. Browser controls may allow you to remove or block stored items, but blocking necessary session storage may prevent sign-in or disrupt payment-related functions. Removing cookies does not by itself delete an account, cancel a membership or erase transaction history.

We may update this Privacy Policy to reflect service changes, legal requirements or changes in data handling. Material changes are notified in the app or by email in advance. Continued use after an update takes effect constitutes acceptance of updated service terms where lawful, but does not replace consent where privacy law requires a specific consent or reduce rights granted by law.

Translations may be available in English, Hindi, Arabic, Spanish, French, Portuguese and Chinese. The English version prevails in the event of conflict, except where mandatory law requires otherwise. Contact us if a translated explanation appears inconsistent so that we can clarify the handling of your information.

For privacy requests, account-history requests, questions about retention or a concern about disclosure, contact hello@coheroapp.com. Describe the issue and the relevant account without including passwords or full payment credentials. We will route the request to the appropriate function and provide the response or explanation required by applicable law.