Privacy Policy
Effective January 1, 2025 | Last updated September 9, 2026
COOSOU collects only the information needed for posting, displaying information, contacting others and account services. We aim to minimize unnecessary collection and protect the privacy of users and businesses.
Important: do not publish identity documents, bank card details, verification codes, full home addresses or someone else’s private information.
Data we collect
- To provide accounts, posting, reporting and contact features, we may process email addresses, display names, profile photos, cities, posts, image URLs, contact details, private messages and images, notification preferences, report descriptions and basic access logs.
- Historical business information continues to be retained where required for compliance, review and data retention.
How we use information
- This information supports sign-in verification, displaying user posts, handling reports, improving search and sorting, investigating errors, preventing spam and maintaining platform safety.
- Historical business information is not automatically deleted when its public onboarding interface closes.
Google sign-in
- When you choose “Sign in with Google”, Google and our authentication service may provide COOSOU with the basic identity information needed for sign-in, such as your Google account identifier, verified email address, name or display name and profile photo.
- COOSOU uses this information only to create or identify your account, authenticate you and provide basic profile features.
- Basic Google sign-in does not give COOSOU your Google password, and we do not use it to read Gmail messages, Google Contacts, Google Drive files or Google Calendar content.
- Google sign-in currently requests only the basic openid, email and profile permissions required for authentication.
- If future features need other Google data, we will explain them separately and obtain the relevant authorization before requesting additional permissions.
Contact details
- Phone numbers, WeChat details and contact email addresses supplied by users or businesses are provided through contact features that require sign-in, permission checks and rate limits, rather than directly on public cards.
- Contact details you put in a title, body or public image may still be seen by any visitor.
- Do not include identity documents, bank card details, verification codes, detailed home addresses or someone else’s private information in public descriptions.
Images
- Post and business images appear in public detail pages, feeds and search results.
- Private chat images are held in separate private storage and can be read only after conversation participant permission checks; they are not displayed as public images.
- Ensure that images contain no unauthorized portraits, identity documents, private information, misleading screenshots or infringing materials.
Cookies and sessions
- COOSOU uses necessary account session cookies to keep you signed in and may use hosting, logging and security cookies to support access, troubleshooting and risk controls.
- We do not use local storage to fabricate a signed-in state.
What is public
- Titles, descriptions, images, prices and areas that users choose to post may be shown to visitors.
- Structured contact details are available through controlled contact features.
- Account email addresses, internal notes, report descriptions and non-public information are not published as ordinary page content.
Third-party services
- COOSOU uses Supabase for authentication, databases and file storage, and may offer Google sign-in through Google OAuth.
- Website hosting and enabled Cloudflare network services process technical data needed for access and security.
- When notification email is enabled, Resend processes recipients’ addresses and notification content; account verification emails are sent through the authentication service’s email configuration.
- Third parties should receive only data needed for the relevant feature, subject to their own privacy and security terms.
Private chat, notifications and reports
- Private messages and chat images are used for communication between conversation participants and are not public to other ordinary users.
- Notification preferences determine the supported on-site and email channels.
- Operations activity summaries do not display private message bodies.
- Report descriptions and necessary review evidence are used for safety investigations.
- Deleting a reported item does not automatically delete its case or audit records; staff must access them according to their permissions.
Data security
- We protect data through account sessions, server-side permission checks, access controls and minimal use of privileged credentials.
- Privileged credentials are restricted to necessary server-side operations and must not appear in client code.
Data retention
- Account information, posts, saved items, reports and review records are retained for as long as needed to provide services, handle disputes, meet legal obligations and maintain safety.
- A listing expiring or being taken down changes its visibility; it does not delete the account or all related data.
- Long-term demonstration templates do not undergo real-post automatic expiry and are excluded from real-content metrics.
- Account deletion requires identity verification and cleanup.
- Failed media cleanup may delay completion and require a retry or manual action; backups, logs and necessary audit evidence may take longer to remove.
- This policy does not promise one automatic deletion period for all data and backups.
- Contact the privacy channel for the scope and progress of a request.
Deletion, correction and revoking Google access
- To correct business information, delete posts, resolve account issues or raise privacy questions, submit a deletion request from your account page or contact the privacy channel.
- If you cannot sign in, provide information needed to verify account ownership, without sending passwords or verification codes.
- You can also revoke COOSOU’s Google authorization in your Google Account security settings.
- Revocation stops that sign-in authorization but does not automatically delete an existing COOSOU account or platform data.
- Submit a separate request through COOSOU’s deletion process to delete the account and data.
Contact
- You can submit privacy, data deletion, correction and copyright concerns through the administrator mailbox without signing in.
- Keep your receipt code to check progress and replies.
- We may need further identity verification before handling requests involving account ownership.
- Do not provide passwords or verification codes.
We will reflect Privacy Policy updates on this page. Continuing to use the service means you understand these data processing practices.
For privacy and data processing requests, use the administrator mailbox. Open administrator mailbox