Legal
Privacy policy
Effective: 12 October 2026 Controller: Coy Koi Limited (company number 17424259), 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, [email protected]
This is what CoyKoi collects, why, where it goes, and how to get it deleted. It is written to match what the software actually does; if something here stops being true, the policy changes, not the software quietly.
The short version
- We keep what an account needs to work: your email, a handle, a password hash, and the files you choose to store in the cloud.
- We do not sell data, run ads, or use tracking pixels. There are no third-party analytics scripts on the app or the account site.
- Payment details never reach us. Paddle handles them.
- We never train AI on your work. Features that learn from your own project (a rig’s model, a character’s lighting depth) run on your computer, for that project, and nothing is uploaded for them.
- Face tracking runs on your iPhone. The camera picture never leaves the phone, and nothing is recorded or uploaded unless you choose to.
- The desktop and mobile apps work offline. Before you sign in, the desktop app only asks us for notices (sending its product and version) and fetches what you ask it to, such as an update or the High light quality.
What we collect
Account
| Data | Why |
|---|---|
| Email address | Sign-in, verification, password reset, receipts. Never shown to other users, never searchable. |
| Password (as an argon2 hash, never the password) | Sign-in |
| Handle, display name, optional bio, role (rigger / streamer / other) | Your public identity to other CoyKoi users |
| Connect code | A private code you can hand to someone so they can add you without knowing your handle. You can regenerate it at any time. |
| Directory listing (opt-in, off by default) | Only if you turn it on can other users find you by fuzzy search. Otherwise you are reachable only by exact handle or connect code. |
If you sign in with Google, Discord or Twitch, we receive your email address and the provider’s identifier for you, and nothing else — no contacts, no channel data, no posting rights.
Devices and use
| Data | Why | Kept |
|---|---|---|
| Each signed-in device: a name you gave it, platform, app version | So you can see and revoke what has access | Until you remove the device |
| Country of each sign-in and of the app’s periodic “I’m running” heartbeats, from a two-letter country code Cloudflare attaches to the request | Sizing servers and languages; spotting a sign-in from somewhere you have never been | Per-sighting records for 90 days, then only daily counts per country |
| Security log: sign-ins, device approvals, downloads, revocations, with the IP address and browser/app identifier of the request | So you (or we, if you ask) can answer “was that me?” | 12 months |
We never record your precise location, and the apps do not know or send where they are — the country comes from the network request, not from the device.
Error reports and feedback
| Data | Why | Kept |
|---|---|---|
| An error report, only when you choose to send one: the error and where in the code it happened, the app’s version, product and operating system, the app’s last log lines, the language the app is in, anything you write about what you were doing, and after a crash the crash dump | Finding and fixing the error | 180 days; after that only a count of how often that error happened, with no link to you |
| Feedback you send: your message, its kind (bug, idea, question), the app’s version, product and operating system, and a screenshot of the app’s window if you leave it attached | Reading it, answering it, improving the app | 180 days |
| Your answers to our polls, with the app’s product, version and language when you answered. Only we see answers and results; they are counted, never shown to other people | Deciding what to build and learning who uses the app | Until 180 days after the poll closes; after that only the totals, with no link to you |
| Your support conversation: your feedback and messages, our replies, and when you read them. A reply is also emailed to you when none of your apps has been running for the last 20 minutes | Answering you | 180 days per message |
If the app crashes, it writes a crash dump on your computer: a snapshot of where each part of the program was, with a little of the memory around it, which can include pieces of what was open at the time. On the next start it asks whether to send it with the report, like any other error.
When an error happens, the app keeps it on your computer and asks before sending anything. Nothing is sent if you say no. Your projects are never part of a report. Sending needs a signed-in account, so reports and feedback are kept with that account and deleted with it.
Your files
Cloud saves, motion-capture libraries and delivered runtimes are stored in Cloudflare R2, addressed by the hash of their content. What that means for you:
- We do not open them. The server checks a file’s first bytes to confirm the type and never reads further. Nobody at CoyKoi looks inside your projects.
- Identical parts are stored once, even across users. This is how saves stay fast and storage stays cheap. It does not let anyone learn whether you hold a particular file: the server only confirms a part exists if you already own it or have been sent it.
- Deleting is real, with a short delay. When you delete something and no one else has a reference to it, it is removed from storage after a 7-day grace period. Old versions of projects are thinned automatically (everything for 30 days, daily for 90, weekly for a year).
Face tracking and motion capture
Face tracking runs on your iPhone, using Apple’s ARKit and the front camera. From each camera frame the phone works out the numbers that move your character: how strongly each of 52 expressions shows (a smile, a blink, a raised eyebrow), the position and angle of your head, and a 3D mesh of your face’s shape (about 1,200 points). CoyKoi never records, stores or sends the camera picture itself, and never records sound. The desktop apps do not use a webcam.
We use this data only to animate characters. We do not use it to identify you, we do not analyse it or train models on it, and we do not share it with anyone you have not chosen.
| Where | What | When |
|---|---|---|
| Your phone | Recordings you make, in the app’s own storage | Until you delete them. Nothing is uploaded unless you choose to |
| Your computer | Live tracking, sent from the phone straight to the desktop app over your local network, and recordings saved in your projects | Never through our servers. To be found, the phone announces itself on your local network by its device name |
| Our cloud | A motion-capture set you upload, and recordings inside a project you save to the cloud. Both include the face mesh | Only when you upload or save to the cloud; kept until you delete them (see Your files) |
| People you collaborate with | The expression and head values that move your character, live, while a session runs. Not the face mesh | Directly between your devices where possible, otherwise through Cloudflare’s relay, which passes it on without storing it. It never reaches our servers |
Sharing a motion-capture set. A set you upload is visible only to you until you share it. You can share it with specific people, by handle or connect code, or with anyone who has its link. Either way they must be signed in to open it, every download is counted, and the count is visible to everyone who can open the set. A link shows the set’s name and your handle. You can remove a person, replace the link or stop sharing at any time, and delete the set as described under Your files.
On your computer
Some features learn from your work. They all run on your computer, use only the project you are working on, and upload nothing:
- A rig’s model (Rig, Model, Training) learns how your character moves from the poses and motion-capture pairs in that project. The result is saved in the project and used only by it.
- Distill finds the recurring expressions in a motion-capture clip you have open.
- Lighting precompute works out the depth of your artwork with an AI depth model (Depth Anything; see Help, Licences in the app) so stage lights can shade it. Your artwork is not uploaded.
None of this trains anything for us or for anyone else. The High light quality model is not included with the app: when you choose to download it, your computer fetches it from downloads.coykoi.studio, served by Cloudflare, like any download. Nothing about you or your work is sent with that request.
Live collaboration
When you collaborate with another CoyKoi user, our server helps the two apps find each other. While the session is open it holds each side’s network address (IP address and port) and a short-lived credential for the relay; it clears them when the session ends or the invite is declined. The server also keeps a record of each session: who took part, when it started and ended, the country each side connected from, and whether the connection was direct or relayed. That record lets us show your sessions and size the relay, and it is kept while your account exists. Your name is shown to the person you are in a session with.
Deliveries
When a rigger sends you a runtime, or you send one, both sides’ handles and account identifiers — and, for email deliveries, the recipient’s email — are embedded in the delivered file as an attribution watermark, and recorded with the delivery. This is how a leaked file can be traced to the account it was issued to. Both parties to a delivery can see who the other is; that is the point of it.
Business accounts
If you set up a business account, we keep the business’s name, country, billing email, tier and the number of people it says it has: to show the business’s page, to apply the right prices, to send its price-change notices, and (the country) to understand where our users are. Invoice details such as the business’s legal name, address and VAT number go to Paddle at checkout, not to us; Paddle issues the invoices.
If you join one, the business’s owner and admins can see your public profile (handle and display name), your role, whether you hold one of its seats and since when, and how many machines you have activated with that seat. Other members see your profile and role. Nobody in the business sees your email address, your own files or what you do in CoyKoi. Adding, removing and re-seating people is recorded in the security log with who did it.
Payments
Handled entirely by Paddle, who is the seller of record. We receive: that a purchase or subscription happened, which plan, the amount, and Paddle’s identifiers for the customer and transaction. We never see card numbers or bank details. Paddle’s own privacy policy governs what they hold.
Where it goes
We use these service providers to run CoyKoi. They process data only on our instructions, under data processing agreements:
| Provider | What | Where |
|---|---|---|
| Fly.io | Runs the server and database | United States (Los Angeles) |
| Cloudflare | File storage (R2), the website and web app, the network in front of them, and the relay for live collaboration when a direct connection is not possible | Global network; storage region set at creation |
| Resend | Sends account email (verification, password reset) | United States |
| Sentry | Error reports when the server fails, without request bodies, cookies or email addresses | United States |
Where these providers handle data outside the UK, the transfer is protected by the UK–US data bridge or by contract clauses approved by the UK Information Commissioner.
Paddle is our reseller and merchant of record. It handles payments, invoices and sales tax as an independent controller, under its own privacy policy.
Google, Discord and Twitch receive data only if you choose to sign in with them, and handle it under their own privacy policies.
We do not share data with anyone else, and we do not sell it. We will hand over data if a court in a jurisdiction that applies to us orders it, and we will tell you unless the order forbids it.
Cookies
The account site sets two cookies: a session cookie so you stay signed in,
and a CSRF token so a form can only be submitted from our own pages. Both are
scoped to coykoi.studio and its subdomains. The desktop and mobile apps do
not use cookies; they hold a device token you can revoke from your account.
There are no advertising or analytics cookies anywhere.
How long we keep things
| Retention | |
|---|---|
| Account data | While the account exists. A free account nobody has used for 24 months is deleted, after emails 90, 60 and 30 days before |
| Files, including motion capture you upload | Until you delete them (plus 7 days), subject to version thinning above |
| Recordings on your phone | Only on your phone, until you delete them |
| Collaboration network addresses | Until the session ends or the invite is declined |
| Collaboration session records | While your account exists |
| Per-sighting activity | 90 days |
| Security log | 12 months |
| Error reports, feedback and support messages | 180 days |
| Payment records | As long as tax law requires (typically 7 years), held by Paddle |
| Backups of the database | Rolling, up to 30 days |
Deleting your account
Use Delete account in the app’s Account view (it asks you to type your handle), or email [email protected] from the account’s address. On deletion: the account is closed immediately, your files are released (and removed under the rule above unless another user holds a delivery of them), and the personal data is removed. What remains is what must: payment records held by Paddle, and delivery attribution on files already sent to other people — a runtime you delivered stays traceable to the account that sent it, because the recipient is entitled to that. You leave any business account you are in, and its seat goes back to the business. If you own a business account, transfer ownership to an admin or close the business first.
Your rights
Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or hand it to you in a portable form, and you can object to how we use it. Email [email protected]; we answer within 30 days. If you are in the EU/EEA or UK you also have the right to complain to your data protection authority. We do not make automated decisions about you.
Children
CoyKoi is not directed at children under 13 (or the higher age your country sets for consent), and we do not knowingly hold their data. If you believe a child has an account, tell us and we will remove it.
Changes
If this policy changes materially, we email account holders before the change takes effect. The current version is always at https://coykoi.studio/privacy-policy.