Privacy Policy · Coetio

This Privacy Policy describes what personal information Coetio™ collects, why it is collected, on what basis, who can access it, and how long it is kept. It applies to the service operated at coetio.com. The address coevio.com is retired, redirects to coetio.com, and serves no page of its own. “Coetio” is used in this document as the defined name for the service. This policy is incorporated into and forms part of the Terms of Service.

Coetio serves two kinds of organization: student clubs, and volunteer programs that host student volunteers. “Organization” in this document means either, and a statement about an organization applies to both unless it names one. Most account holders are minors. Collection is limited to what is required to operate an organization, and records are kept inside the organization they belong to.

Summary

Personal information is not sold, and no advertising is served.
A phone number is optional at every point of collection. If provided, it is visible only to the organization's owner and to accounts with platform administrative access.
A volunteer program also records a volunteer's school and grade, a parent or guardian's name and phone number, and two paperwork records about age and consent. A guardian's phone number is visible only to the owner. Volunteer programs below has the full detail.
Date of birth is visible to nobody but the account holder and accounts with platform administrative access. It is never stored on an organization's membership record.
Most information entered into the product is visible only inside the organization it belongs to.
Organizations retain a record of task and work activity: who created a task, who assigned it, each reminder sent, and who completed each step. Where a leader marks a task complete on behalf of every assignee, the record identifies that leader. This record is available to the organization's leaders and to the other members assigned to the same task. Task and work records below has the full detail.
Account holders can turn off email from their organizations, export their data, correct it, or delete their account, from their own account settings.
Analytics are anonymous and cookieless. No cookie consent banner is shown because no non-essential cookie is set.
An account may be held only by a person who is 13 years of age or older. Coetio does not knowingly collect personal information from anyone under 13.

Information collected

Account information

Name, email address, and graduation year. Creating a password-based account requires these three fields. An account created through Google sign-in begins with only the name and email address Google provides; the remaining fields can be completed afterward on the Profile page.
Date of birth, collected at account creation to confirm the account holder is 13 years of age or older, as described in Children's privacy below. This requirement took effect August 24, 2026 and applies to a new account created directly on Coetio, whether by password or by completing a Google sign-in, from that date forward. An account created before that date was not asked and has no date of birth on file. A roster entry a leader creates for a person with no account, and a guest event check-in, are not accounts and are not subject to this requirement. Date of birth is visible to nobody but the account holder and accounts with platform administrative access, not an organization's owner, not an officer, not in any roster export or organization backup. It is stored on the account record and, for an account created with a password, in the authentication provider's account metadata. It is never written to an organization's membership record, which is the record a roster, an export, and an organization backup each read. It is retained for as long as the account exists and is deleted with the rest of the account profile on account deletion.
Phone number, which is optional. It may be left blank at account creation and when joining an organization; joining does not require it. A leader may request it to reach members about meetings. If entered, it is validated for format and stored. If left blank, nothing is stored.
Optional profile fields: grade level (derived from graduation year, and editable), pronouns, and a profile picture.
Password. Authentication is handled by Coetio's authentication provider, which stores passwords only in hashed form. Coetio's own database does not hold account passwords, and passwords are therefore not included in a data export.
Google sign-in: Google authenticates the account holder's identity and provides a name and email address. Coetio does not receive the Google account password and does not access any other Google account data.
Account settings: notification preferences, the default landing page, whether organization email is enabled, whether the account has opted into an organization's member directory, and whether the account holder has asked leaders not to include them in photos.

Organization membership

Roster record: memberships, status, role and title, join date, dues-paid status, the answer given to the organization's join question, a private note a leader may keep about the member, and a buddy pairing where the organization uses one. Title grants and removals are timestamped.
Organization-defined roster fields: an owner may create custom roster columns and populate them for members. Because these fields are defined by the organization, their content is not limited or reviewed by Coetio and can hold sensitive information such as allergies, a birthdate, a guardian contact, or an address. What a given organization collects in these fields is decided by that organization.
Kiosk PIN, if a short code is set for tap-in attendance.

Participation

Attendance: check-in date, exact time, and the answer to an organization's optional check-in question. Check-in occurs by scanning a QR code a leader displays, by tapping a name in kiosk mode, or by a leader recording attendance manually. Coetio does not access device location; no field in the product records it. An event may carry a street address, and checking in to that event does record that the account holder was present at that address at that time.
Guest check-in: attendance at a public event does not require an account. The guest option stores the first name and last initial entered, the event, and the time. No email address or phone number is requested from a guest, no account is created, and no location is recorded. The owner and the organization's officers can view that list on the event page. Guest check-ins are stored separately from member attendance and are not counted toward any member's attendance record.
Attendance change requests submitted to a leader, and the leader's decision.
Events: RSVP and waitlist status, check-ins, a rating and comment on a past event, a live-meeting rating, and any note written about contribution to an event.
Declining an event: where a member declines an invitation, the decline is stored with their name and, where they write one, the reason they give. The organization's leaders see that reason as written, for as long as the event exists.
Excused absences: a leader may record that a member's absence on a given date is excused, together with a note. The note is written by the leader, not by the member, and is visible to the organization's leaders. It appears in the member's own data export.
Event acknowledgements: where an event requires a sign-off, the acknowledgement is recorded, together with a parent or guardian's name if the form requests one.
Work and duties: committee membership, sign-up claims and any accompanying note, rotating duty assignments, and event checklist items. Task records are described in Task and work records below.
Service hours: date, duration in minutes, and description as logged, plus approval status and the identity of the approving leader.
Votes: election and poll votes are stored together with the voting account's email address, so that each account votes once. Ballots are not disclosed to other members: the interface renders only aggregate totals and the viewer's own choice, so voter identity cannot be determined from the page. An organization's data export omits voter identity. Underlying database rows remain accessible to accounts with platform administrative access, as with every record described in this policy.

Content and uploads

Posts and messages: announcements, meeting minutes and agendas, replies to announcements (subject to leader approval before other members can see them), reactions, mentions of other members, handoff notes, and ledger entries where the organization tracks money.
System-generated notices: when a leader cancels an upcoming event and elects to notify the organization, the product posts an announcement containing the cancelled date and the reason entered, and sends a push notification to active members who have not muted the organization or its announcement alerts. Rescheduling an event offers the same option. The activity log records which leader issued the notice.
Audience targeting: a leader may direct an announcement to the whole organization, to a committee, or to named individuals. Where an announcement targets a member by name, that targeting is stored with the post.
Read receipts: opening an announcement is recorded, with a timestamp. The owner and the organization's officers see a view count and can expand it to the identities of members who opened it.
Files: profile pictures, organization banners, event photos (subject to leader approval before publication), images embedded in announcements, files attached to an announcement or to meeting minutes, and files in an organization's Documents area. Photo-gallery images uploaded before August 29, 2026 remain in storage and in an organization's data export; no page displays them, and no new one can be uploaded. Access is described in Photos and files.
Suggestions: the suggestion box is anonymous. The submitted text is stored with no name, email address, or account link, so a leader cannot identify the submitter. A separate rate-limit counter records that an account used the box, without recording its content; that counter is deleted after two days, and until then only an account with platform administrative access could correlate it with a submission.
Financial records: where an organization tracks dues or a budget, its ledger entries and any budget request submitted to a leader, together with the stated reason and the leader's decision. Coetio does not process payments and does not store payment card numbers.

Messages and notifications

Push notifications: if enabled, the browser subscription for that device (an endpoint address and two cryptographic keys) is stored to deliver the notifications requested. Disabling notifications removes the stored subscription.
Account email: sign-in links, confirmations, and reminders, plus a weekly summary of activity in the account holder's organizations. For accounts created on or after August 6, 2026, the weekly summary is enabled by default and can be disabled on the Profile page. Accounts created before that date retain their existing setting.
Organization email: a leader may elect to send an announcement by email to every active member; the message contains the announcement text and a link to any attached image. Leaders may also send a dues reminder and an automatic welcome message on approval, both in Coetio's standard wording. Each recipient is sent a separate message, so members do not see one another's email addresses.
Unsubscribe records: every such message carries a one-click unsubscribe link, compliant with the unsubscribe mechanism supported by major email clients, in addition to a link in the message body. Unsubscribing is recorded against the email address, independent of whether that address has an associated account, because a leader may add a roster entry by email address alone. The unsubscribe link is cryptographically signed and affects only the address it was issued for.
Platform messages: an account with platform administrative access may send a message to an individual account or to an organization; it appears in the recipient's notification feed. A record of the message sent is retained.

Reports, appeals, and support

Bug reports and feedback: the message submitted, the page it was submitted from, and the submitter's email address if signed in or voluntarily provided.
Abuse reports: the content of the report and the reporter's email address if signed in or voluntarily provided. Reports are routed to accounts with platform administrative access.
Suspension appeals: where an organization is suspended, its owner may appeal. The appeal text, the owner's email address, and the outcome are retained.
Moderation notes: a private note may be kept about an account or an organization for support and moderation purposes. These notes are not shown to users.
School outreach records: where Coetio contacts a school, the school's name, the staff contact's name and email address, the status of the conversation, and an internal note are retained. These records contain staff information only, never student information, and are not shown to users.

School verification (school staff only)

A school staff member may claim their school at no cost. The claim form collects a name, job title, work email address, the school's name, address, and website, and a link to a staff directory page listing that person. Coetio compares the work email domain to the school website domain and records whether they match, for administrative review. No request is sent to the school's website in the course of that comparison. This form does not collect student information.

Technical and security records

IP address: processed during a session for security, rate limiting, and abuse prevention, and stored inside short-lived rate-limit records. It is not used to build a profile of an individual or to determine their location.
Bot detection: public forms such as sign-up and join pages may present a Cloudflare Turnstile challenge. Cloudflare receives the request, including the IP address, to distinguish a human from an automated request. Cloudflare states that Turnstile does not track individuals across websites.
Activity log: each organization retains a log of leader actions, including settings changes, posts, and roster edits, for accountability among leaders. This log is visible to the owner. As a single exception, the entries recording that a leader marked a task complete for every assignee, or reopened it, are also shown in that task's history to the organization's leaders and to a committee chair with access to that task. The activity log contains leader actions only; member activity records are described in Task and work records.
Crash reports: the error message, the affected page path, and the account's email address if signed in at the time, retained to diagnose and correct the underlying issue.
Operational counters: aggregate numeric counters, such as monthly email volume, used to remain within provider limits. These counters contain no personal information.
Usage analytics: anonymous, aggregate analytics through Vercel Web Analytics. Vercel states that it records page views, referring site, device, operating system, browser type, and a coarse geographic region such as a country. This data is not linked to an account and is not used for advertising.

Coetio does not collect precise geolocation, does not use advertising identifiers, does not serve advertising, and does not sell personal information.

Volunteer programs

A volunteer program is an organization on Coetio whose members are volunteers and whose events are shifts. Its leaders are called coordinators, and they are leaders as this policy uses that word. Everything above applies to a volunteer program. A program records the following in addition.

School and grade. The school a volunteer attends and their grade are stored on the membership record. Both are visible to coordinators who can view the roster.
Parent or guardian contact. A guardian's name and phone number. The phone number is visible only to the program's owner. The guardian's name appears on the volunteer's own page to any coordinator who can view the roster. A roster export or program backup produced by a coordinator who is not the owner omits the guardian's name and phone number, the volunteer's own phone number, and the consent note.
Two paperwork records, kept separately. The first is a coordinator's attestation that the volunteer is 13 years of age or older, stored as a date together with the identity of the coordinator who gave it. The second records that a signed paper consent form from a parent or guardian is held by the program, stored as a date with an optional note written by a coordinator. Both are required before a volunteer can be made active. They answer different questions and are never combined into one status.
Coetio has no guardian e-signature flow. Nothing is signed inside the product. The consent record states what the program's own paper file holds. That paper is kept by the program. Coetio never receives it, stores it, or verifies it.
Applications. Where an organization accepts applications, its public form collects a name, an email address, an optional phone number, and answers to questions that organization wrote. A coordinator can record an interview time, a note about the interview, and a private note about the applicant. Where the applicant confirmed on that form that they had read the Terms of Service and were 13 or older, the date of that confirmation is stored. That confirmation is the applicant's own statement and does not stand in for either record above. Applying does not create an account. Retention is described in Data retention.
Sign-in and sign-out times. Where a volunteer taps in at a kiosk, the moment of each tap is stored, together with whether the row was measured by a kiosk or entered by hand, and which coordinator entered or last corrected it. A sign-in with no sign-out counts zero hours. A session longer than 12 hours is recorded as 12 hours and marked as capped. A session still open after 16 hours is closed automatically the following day, marked, and left unapproved for a coordinator to review.
Shift activity names. A shift is named by choosing from a list of activities the program itself sets, not typed in each time, and that choice is checked on the server.
Kiosk devices. A tablet at a front desk is paired to the program rather than signed in as a person. Pairing stores a label the coordinator chooses, the email address of the coordinator who paired it, the time it was last used, and a one-way hash of the device's token. The token itself is held only by that tablet, in its own browser. A paired tablet can list who is scheduled that day and record their taps. It cannot open a roster, a phone number, another page, or another organization. A coordinator can revoke a device at any time, which takes effect on its next request.
Service-hour letters. A volunteer's hours letter carries a verification code. A counselor checking that code at Coetio's public verification page enters an email address, an hours total, and the code. The check is arithmetic performed against the code itself and reads no record. The email address, total, and code are not stored, and the result discloses only whether the code matches and the date the letter was issued. A short-lived rate-limit counter keyed by the requesting network address is written, as on every public form.

Task and work records

When an organization assigns work, Coetio records who did what and when. Each task has a dedicated page, and the record below is what that page displays.

Who created the task, and when.
Who assigned each person, and when. Where an assignment is made after a task's creation, the record reflects the actual assignment date.
Every reminder sent about the task. Each reminder is a separate, dated entry identifying the leader who sent it; two reminders sent within one afternoon appear as two entries. Leaders may send a reminder no more than once per hour per task. Muting task notifications stops delivery to a device; it does not remove the record of the reminder. Automated overdue reminders are not attributed to a person and are recorded without a sender.
When an assignee's portion of a task was marked complete, and, if unmarked, that completion record is cleared. An assignee ordinarily marks their own portion.
When an entire task was marked complete, or reopened, on behalf of every assignee. A leader with task-management access, or a committee chair granted that capability, may mark every unfinished portion of a task complete at once. That action is recorded with the acting leader's identity and the time, and the task's history states that each assignee's portion “was marked complete” under that leader's name, so the record does not represent that each assignee completed their own portion when they did not. Reopening a task clears every assignee's completion status, including portions an assignee completed themselves, and is recorded in the same way. No entry is written when a status does not change.
Who marked each step complete, and when. Steps are shared among assignees; whoever completes a step first is recorded as having completed it. Reversing a step clears that record.
Which sub-step is assigned to which person, where a task is divided.
Event checklist items record, as plain text at the moment of completion, the name of the person who completed the item.

Access to this record. A leader with visibility into the task sees the complete record. Where an owner has enabled chair task access, which is disabled by default, a committee chair sees this record for a task on which every assignee belongs to their committee. An active member assigned to a task can open its page once the task has been assigned, and sees who created the task, who is named on each shared step, and the full record concerning their own participation: when they were added, who added them, and every reminder sent to them. Where a task was marked complete on behalf of every assignee, an assignee's own view shows their portion as complete but does not show the identity of the leader who applied that mark, which is recorded only in the organization's activity log and visible only to leaders. An assignee does not see other assignees' identities, reminders, or assignment dates on that task, only a count of how many people are assigned. Members who are not assigned to a task cannot open its page.

These records are retained for as long as the task exists. If a leader deletes a task, the associated records are permanently deleted after the 30-day trash retention period described in Data retention. One category of record outlives the task itself: the log entry recording that a leader marked a task complete for every assignee is written to the organization's activity log and remains with the organization after the task is deleted. Account deletion does not remove all of these records; see Account deletion.

Use of information

Information collected is used only to operate the service, specifically to:

display organization pages, rosters, events, and records to authorized viewers;
record attendance and participation for organizations using those features;
send account email and the notifications an account holder has enabled;
maintain security, prevent abuse, and enforce the Terms of Service;
diagnose and correct errors, and improve the product;
respond to support requests;
comply with a legal obligation, where one applies.

Personal information is not used for advertising, is not sold or rented, is not disclosed to any party outside the service providers identified below except where required by law or requested by the account holder, and is not used to train an artificial-intelligence model.

Access and disclosure

Coetio distinguishes several account types within an organization. Their definitions govern the access described in this section:

Owner: the account that created the organization, or to which it has been transferred. The owner has complete access to the organization's records and settings and cannot be removed by another member.
Officer: an account granted the officer role by the owner. An officer's access is determined by the organization's capability configuration, a per-organization setting the owner controls capability by capability. An officer can hold no management access at all, or every capability the owner holds. At a volunteer program an officer is called a coordinator.
Advisor: an account granted the advisor role by the owner. By default an advisor has read-only visibility into the organization's information, and the owner can grant an advisor any additional capability available to an officer.
Member: an account on an organization's roster holding neither the officer nor the advisor role. By default a member has no management access, and the owner can grant a member any capability available to an officer. At a volunteer program a member is called a volunteer.
Leader, as used in this policy, means the owner, every officer, and any advisor or member who holds at least one management capability in that organization. A given leader's specific access depends on which capabilities that account holds; holding one capability does not imply holding all of them.

Access to personal information is as follows:

Phone number: visible to the organization's owner and to accounts with platform administrative access. Not visible to officers, advisors, or members. A roster export or organization backup produced by an officer omits the phone column; only an export produced by the owner includes it. A guardian's phone number at a volunteer program follows the same rule.
The owner and officers holding the relevant capability can view membership details, attendance, participation, tasks and their full history, dues status, custom roster fields, and per-member announcement read status, for their own organization only. A leader granted the export capability can download the organization's records, including attendance and the service-hours log with member names and email addresses. The phone column is withheld from such exports as described above.
Members assigned to the same task can access that task's page, subject to the access described in Task and work records. A committee chair may access a task where every assignee belongs to their committee, if the owner has enabled that access.
Advisors holding no additional capability receive a read-only view limited to an organization's announcements, meeting and event counts, dues completion rate, and semester and year reports. Those reports identify members with the highest meeting attendance, alongside their attendance counts, and summarize the organization's finances. Elsewhere in the product, an advisor with no additional capability sees what any other member sees.
Other members see an individual member's records only where the owner has enabled that visibility, which is disabled by default. A leaderboard is a separate setting, also disabled by default. Where it is enabled, every member sees a ranked list of names and point totals derived from attendance, completed tasks, approved service hours, and sign-ups, and no member can be excluded from it individually. Where an account has opted into an organization's member directory, other members also see that account's name, grade level, pronouns, and any title held in that organization.
The calendar view shows a leader every event and task deadline in the organizations they lead. It shows a member only the events of their own organizations and their own deadlines.
Meeting minutes are visible only to leaders until a leader shares them with the organization. A leader's document export of minutes includes the day's attendance list; a member's export of the same minutes does not, because members do not see who else checked in to any event.
Preview as a member. An owner can view the product as one of their own members sees it, to answer questions about member-facing navigation without requesting account credentials. Only the owner of an organization can start this view, and only for a member of that organization. It never shows the owner information beyond what they already had access to, no write operation of any kind can occur while it is active (no check-in, vote, task completion, or post), and the previewed member is not notified.
An anonymous visitor can reach four kinds of address without signing in. An organization's own join address shows its name, school, and icon, and a way to request to join or sign in. An organization's application form, where it accepts applications, shows the questions that organization wrote. The service-hour verification page shows a form for checking a code. The demonstration organizations show sample records Coetio created for that purpose. None of the four displays a real roster, event, announcement, leadership list, or photo. The join address, the application form, and the demonstrations are excluded from search indexing. The verification page is listed for search, so that a counselor can find it, and it displays nothing about any person until a code is entered. Sharing any Coetio address in a chat application shows the generic site preview.
Organization visibility is set to public, school-only, or unlisted. Only school-only has a present effect: it limits who can submit a join request to signed-in, active members of another club at the same school, and offers everyone else an invite code or a sign-in link. Public and unlisted behave identically, because Coetio publishes no directory, sitemap entry, or search listing of organizations for either setting to govern.
A verified school. A school staff member may verify their school at no cost, at /schools/verify. Verification adds a note on that club's own Settings page, visible to its own leaders. It creates no login, dashboard, or console, and grants no visibility into any club's roster, records, or member data.
Accounts with platform administrative access can reach the full database, including phone numbers, ballots, and every record described in this policy, for the purpose of operating, moderating, backing up, and repairing the service.
Service providers, identified below, process data under Coetio's instructions to perform their function in the service.
Law enforcement or a court, where legally compelled, or where disclosure is believed in good faith to be necessary to prevent serious harm.

Photos and files

A profile picture, organization banner, gallery photo, event photo, image embedded in an announcement, a file attached to an announcement or to meeting minutes, and a file uploaded through the Documents page are private files. Each is served through a Coetio route that checks the requester before responding: a profile picture requires only being signed in to Coetio; an organization banner, gallery photo, or announcement image requires the same visibility check that organization's own join page runs; an event photo requires active membership in that event's organization; a document or an attachment requires membership, and, for a file attached to meeting minutes, the same sharing state that governs the minutes themselves. The route mints a temporary address behind the scenes, valid for 60 seconds, and never discloses that address to the requester; it streams the file back itself, with an instruction that only the requester's own browser may keep a copy, for five minutes.

This replaced a permanent, unauthenticated public address for a profile picture, organization banner, gallery photo, event photo, and announcement image on August 29, 2026, and for a file attached to an announcement or to meeting minutes on August 25, 2026. A file of an affected kind uploaded before its respective date keeps its old permanent public address, reachable by anyone who has it, including a person outside the organization; only a re-upload moves it behind the private route. A file uploaded through the Documents page is stored privately. Coetio retains an older document path that stores a file at a permanent public address, used only where private storage is unavailable, and a document stored that way keeps that address.

Deleting a photo or file removes it from the product and from the page that displayed it. The underlying stored file may persist beyond that point, and a person holding a still-valid address to a legacy public file may still be able to open it. To request permanent removal of a stored file, contact support@coetio.com with the file's link.

Calendar feeds and external links

Certain features of Coetio are designed to be used outside the product, which means information is transmitted to a party with which Coetio has no data-processing agreement. Those features are:

Personal calendar feed. The dashboard, Profile page, and calendar offer a web address that can be added to Google Calendar, Apple Calendar, or Outlook so an organization's events appear there. The address is a single opaque, encrypted path segment that functions both as the subscriber's identity and as the authentication for the feed; it does not place the account's email address in plain text in the URL. Whichever calendar application receives that address retains it and queries the feed repeatedly. That application receives a live copy of every event in every organization the account is an active member of, including private ones. Revoking a compromised feed currently requires rotating the platform-wide signing key, which invalidates every outstanding calendar feed at once; no per-account revocation exists at this time. That link should not be shared or posted publicly.
Add to calendar. Selecting this option on an event's page opens Google Calendar with the event's title, description, times, and full address pre-filled, transmitting those details to Google. The onboarding checklist an applicant reaches through a mailed link offers the same option for a scheduled step, with no account: a Google Calendar link carrying the step's title, the program's name, and the time, and a calendar file downloaded from Coetio.
Directions. Where an event has a street address, a link opens that address in a mapping service. Selecting the link transmits the address to Google; nothing is transmitted unless the link is selected, and the referring Coetio page is not disclosed to Google.
Link previews. When a Coetio link is shared in a chat application, that application requests a preview image from Coetio. An organization's join address has no preview image of its own, so the generic Coetio site preview is shown, which carries no organization name, event, member, or contact information.

A note for leaders: an event's street address is visible only to that organization's own signed-in members. It is never published outside the organization, whatever the event's visibility setting.

Cookies and analytics

Coetio sets only essential cookies: a session cookie that maintains sign-in state, a cookie recording which organization is being managed for an account that leads more than one, a language-preference cookie, a cookie that exists only while an owner is using the preview-as-member view, a cookie holding the pairing token on a tablet paired as a kiosk, and a cookie set on a browser where account creation was refused for being under 13, which records only that the refusal occurred and expires after 30 days. None of these cookies are used for advertising or cross-site tracking. Vercel Web Analytics, which records page views, operates without cookies and does not identify individual visitors, so no consent mechanism or cookie banner is required. Analytics run on every page, including while signed in, and remain unlinked to any account. Signing out removes the session cookie. The organization-selection cookie contains only an organization identifier and persists on a device for up to one year unless cleared.

The browser also stores certain data locally on the device: theme preference, reduced-motion preference, and a cached copy of upcoming events and open tasks so the product remains usable without a network connection. On a mobile device, local storage also tracks recent visit counts and dates, used to time the home-screen installation prompt, and a record of each dismissal of that prompt. Where an organization is suspended, the device retains a flag indicating the suspension notice has been shown, to avoid repeating it. None of this local data is transmitted to Coetio, with one exception: an offline check-in is queued on the device and transmitted once connectivity is restored. Clearing browser data removes all of it.

Service providers

Coetio relies on the following service providers to operate. Each processes data under Coetio's instructions, solely to perform its function in the service, and is not permitted to use that data for its own purposes. Each is a United States company, and Coetio is operated from the United States. Some providers operate infrastructure in other countries to deliver the service, so information may be processed outside the account holder's own country.

Supabase · database, authentication, and file storage. Every record Coetio stores resides there.
Vercel · hosting and anonymous usage analytics.
Resend · delivery of account and notification email. It receives the recipient's address and the message content.
Cloudflare · bot detection on public forms, which receives the requesting IP address.
Browser and device push services · where notifications are enabled, each message is handed to the push service built into the account holder's browser or operating system for delivery. The message payload is encrypted for the receiving device, so the push service can observe that a message was sent and when, but not its content.
Google, for sign-in only · where Google sign-in is used, Google authenticates the account holder's identity. Google is not otherwise a service provider to Coetio; fonts on this site are served from Coetio's own infrastructure, not Google's.

Third parties reached by an account holder's own action. These parties do not process data under Coetio's instructions, and their own privacy policies govern what they receive.

Google Maps and Google Calendar · selecting Directions or Add to calendar transmits that event's details to Google.
The calendar application used to subscribe to a personal feed · Google, Apple, Outlook, or another provider, which retains what Calendar feeds and external links describes.

Data retention

Account data: retained for the life of the account. Account deletion removes it as described in Account deletion.
Deleted items: when a leader deletes an announcement, event, set of minutes, task, or committee, it is held in a 30-day trash for possible restoration, then permanently purged.
Task history: assignments, reminders, and step completions are retained with the task for as long as the task exists, with no separate expiry, and are deleted when the task is deleted and its 30-day trash period elapses. The exception is the log entry recording that a leader marked a task complete for every assignee, which is written into the organization's activity log and persists with the organization.
Attendance, service hours, excused absences, votes, and read receipts: retained until the organization or the specific record is deleted. None expire on a fixed schedule. Deleting an account does not remove them; they stay attached to an anonymized membership row, as described in Account deletion.
Crash reports: automatically deleted after 14 days.
Rate-limit records (short-lived anti-abuse counters keyed by an identifier such as an IP address, email address, or account): automatically deleted after two days.
Maintenance logs: logs of scheduled system jobs are retained for 90 days and contain no personal information.
Backups: a full database backup is created daily and stored in private storage to support service restoration after a failure. A backup is a copy of the entire database, including phone numbers and ballots, and is never published. The 14 most recent daily backups and the 8 most recent weekly backups are retained, and every backup, without exception, is deleted no later than 90 days after it was created. Information deleted from the live service can persist in an existing backup file until that file is deleted under this schedule.
Organization records: an organization's history is retained with the organization, including through a leadership transfer, until a leader deletes the specific record or the owner deletes the organization.
Roster-only members: where a leader added a roster entry for a person who never created an account, that record is retained until a leader of that organization removes it. Contact support@coetio.com for assistance.
Volunteer applications: an application, with the name, contact details and answers on it, is kept until a coordinator of that program deletes it, or the applicant deletes a Coetio account held at the same email address. Declining does not remove it, and nothing here expires on a schedule. Deleting is permanent, and takes the coordinator’s notes and any onboarding steps with it. Applying does not create an account, so removal is requested by emailing support@coetio.com with the program and the address the application was sent from.
Guest check-ins: retained with the associated event and removed when a leader deletes that event and its 30-day trash period elapses, or when the organization is deleted. No account is associated with a guest check-in; contact support@coetio.com with the event and approximate time to request earlier removal.

Security

Connections are encrypted using HTTPS. Passwords are stored only in hashed form by Coetio's authentication provider. Database records are reachable only through the application's own authorization checks: the database provider's automatically generated public API is revoked for every table, including tables added later. File uploads are validated for type and size. Sign-in and other sensitive actions are rate-limited to slow automated attacks.

No online service can guarantee absolute security. If a security incident is identified that affects personal information, affected accounts will be notified without undue delay, with an explanation of what occurred.

Rights and choices

Access and correction: account information can be reviewed and edited at any time from the Profile page.
Data export: the Profile page provides a file containing account information and its associated records, including memberships, attendance, excused absences, RSVPs, votes, service hours, assigned tasks, and authored notes. Some records are not yet included in that export: reminders received, steps completed, tasks created, event declines, and volunteer applications. Contact support@coetio.com to request those records, or any other record expected and not found in the export.
Account deletion: available at any time from the Profile page. See Account deletion for scope.
Leaving an organization removes the associated membership at any time.
Notification controls: push notifications can be enabled or disabled per device, an organization can be muted, and a notification category can be disabled from the Notifications page.
Email controls: a single Profile page setting governs organization email, and disabling it stops announcement email, dues reminders, and the weekly summary. Every such message also carries a one-click unsubscribe mechanism. Muting an organization silences its announcement email and its dues reminders as well as its push notifications, unless a leader has marked a specific post as important. Account email, such as sign-in links and password resets, cannot be disabled while an account exists, because it is required to access the account.
Correcting roster information held by a leader: contact a leader of the relevant organization, or support@coetio.com if that does not resolve the issue.
Requests: submit a question or request to support@coetio.com. A response is provided within 30 days. Additional rights apply in some jurisdictions; contact support@coetio.com to invoke a right applicable to the account holder's jurisdiction of residence.

Account deletion

Account deletion is initiated from Delete account on the Profile page. An account that owns an organization must first transfer or delete that organization in Settings, so an organization is never left without an owner. Deletion asks the account holder to type their own email address before it proceeds.

Account deletion performs all of the following at once:

the account profile is deleted, including name, email address, phone number, date of birth, graduation year, grade, pronouns, and profile picture, and the sign-in account is removed;
roster records are anonymized rather than deleted, so an organization retains its history while the row is renamed “Former member” and no longer identifies the individual. Phone number, custom roster fields, kiosk PIN, join answer, title, any leader note about the member, and, at a volunteer program, the guardian's name and phone number and the coordinator's consent note are cleared. The dates recording that the age attestation and the paper consent form existed are kept, because they carry no name;
personal rows are deleted, including RSVPs, votes, reactions, replies, read receipts, sign-up claims, event acknowledgements and any associated guardian name, event declines and the reason given, event ratings, contribution notes, budget requests, event photos uploaded by the account, feedback submissions, reports, invites, volunteer applications and their onboarding steps, and push subscriptions;
the account's email address is removed from accountability records retained for other purposes, such as activity logs, approval stamps, and crash reports.

Limits of account deletion. The following categories of record are not removed by account deletion:

Attendance, service-hour, excused-absence, and task rows persist, attached to the anonymized “Former member” row. The organization retains its history, with nothing in it pointing back to the deleted account's name or email address. A note a leader wrote on an excused absence is that leader's text and is not cleared.
Task history rows are not cleared. Reminders received, reminders sent as a leader, steps completed, sub-steps assigned, and tasks created continue to reference the anonymized row, so a leader viewing that task later sees “Former member” where the account's name previously appeared. Name and email address are removed from these rows. To request removal of these rows outright, contact support@coetio.com.
Event checklist entries retain the name at the time of completion. When an item on an event checklist is completed, the product writes the completing account's name into the item as plain text, and account deletion does not clear that text. An event checklist can therefore continue to display a real name after the associated account is deleted. This is a known limitation of the deletion process rather than an intended retention; contact support@coetio.com to have a specific entry cleared.
Photos uploaded by other accounts persist. Account deletion removes the record of photos uploaded by the deleted account, but not a photo uploaded by another account in which the deleted account's member appears. A request to remove such a photo should be directed to a leader of that organization. The stored image file can also persist beyond the record referencing it; contact support@coetio.com with the file link to request permanent removal.
Backups retain the prior copy for up to 90 days. A backup created before account deletion continues to contain the deleted information until that backup file is deleted under the retention schedule in Data retention. A daily backup is deleted once it is no longer one of the 14 most recent, a weekly backup once it is no longer one of the 8 most recent, and any backup once it is 90 days old, whichever comes first.

Children's privacy

Coetio is built for students, and its collection practices reflect that: the minimum information needed to operate an organization is collected, a phone number is optional and visible only to the organization's owner and to accounts with platform administrative access, membership details are kept inside the organization, ballots are not displayed to other members, personal information is not sold, and no advertising is served.

An account may be held only by a person 13 years of age or older. Since August 24, 2026, creating an account directly on Coetio, whether by password or by completing a Google sign-in, requires a real date of birth, checked against this minimum before the account is created. This requirement is not retroactive: an account created before that date was not asked for a date of birth and none is on file for it. It also does not apply to a roster entry a leader creates for a person with no account, or to a guest event check-in, neither of which creates an account. A separate confirmation of age is required at three further points, described in the Terms of Service: an organization's open join form, a roster import performed by a leader, and a volunteer application. Joining through an invite link sent by a leader does not ask for that confirmation, because the account-creation check has already run for anyone who created an account on or after August 24, 2026. Coetio is not directed to children under 13 and does not knowingly collect information from anyone under 13.

Takedown for accounts under 13. If Coetio determines that an account belongs to a person under the age of 13, the account and the personal information associated with it are deleted promptly, using the same process described in Account deletion. To report an account believed to belong to a person under 13, contact support@coetio.com with the account's email address or the relevant organization and name. Coetio investigates and acts on each report received.

A parent or guardian may contact support@coetio.com to request the information held about their student, to request a correction, or to request account deletion. Verification that the requester is the student's parent or guardian may be required before the request is fulfilled. A guardian named on a volunteer program's roster may use the same address to ask what is held about them and to have it removed.

Schools

Coetio is an independent product. It is not affiliated with, endorsed by, or operated by any school unless a school states otherwise. Coetio is not a student-records system, and an organization's records on Coetio are not official school records. Compliance with any school-specific rule governing student data or parental consent is the responsibility of the organization's leaders.

Changes to this policy

The date at the top of this policy is updated whenever it changes. Where a change is material, meaning it meaningfully affects the information collected or the choices available to an account holder, notice is given before the change takes effect, through the product or by email.

Contact

Questions, requests, and corrections concerning this policy: support@coetio.com. Coetio is operated from Coetio, 9 Townsend West, Nashua, NH 03063, United States. This policy is also available in reference to Terms of Service and Community Guidelines.