Privacy Policy

1. Information We Collect

To facilitate our peer-to-peer marketplace, we collect the following types of information:

• Account Information: Username, email address, and phone number. Every account is also assigned an internal system ID used to associate your activity within our database — this is not visible to other users.
• Transaction & Order Data: Order and trip details, including origin and destination information you provide when creating an order or trip (e.g. city or address text), delivery dates, order/trip status, and cancellation details.
• Communications: Messages exchanged between users through in-app chat, and notifications sent to you regarding your orders and trips. Message content may include personal information you choose to share with another user.
• Photos: Product photos, and delivery/receiving confirmation photos you or your counterpart upload to verify a completed handoff.
• Identity Verification: To ensure the safety and trust of our community, we require identity verification for certain account types. This is performed through our identity verification partner, Stripe Identity — government-issued ID documents (e.g. CNIC, Emirates ID, or Passport) and any biometric selfie capture are collected and processed directly by Stripe within their own hosted verification flow. Cokatoo does not receive or store the ID images themselves; we retain only a verification session reference and a pass/fail status.
• Financial & Payout Data: Payment details (card and transaction information) are processed by our payment partner, Stripe. We do not store full credit card numbers on our servers. For travelers receiving payouts, we collect and store bank account details (bank name, account holder name, IBAN, SWIFT/BIC code) necessary to process payments to you. Your IBAN is encrypted at rest and is not included in standard account queries.
• Device & Notification Data: A device push-notification token, used solely to deliver order, trip, and message notifications to your device. This token is cleared immediately if you delete your account.
• Location: We do not access your device's precise GPS location. The only location-related information we collect is the origin and destination text you provide when creating an order or trip.

What we do not collect

We do not collect your date of birth, precise device location, your device's contacts list, or biometric data — and government ID data involved in identity verification is collected and held by our verification partner, Stripe Identity, not by Cokatoo.

2. How We Use Your Information

• Account Information (username, email, phone, internal system ID): Used to create and secure your account, to log you in, and to send you one-time verification codes by email. Your username and profile are shown to other users you transact with; your email and phone number are not shared publicly.
• Transaction & Order Data: Used to connect Shoppers and Travelers for a given order or trip, to track order/trip status, and to resolve cancellations or disputes between the parties involved.
• Communications: Used to deliver in-app messages between matched users and to send you notifications about the status of your orders and trips.
• Photos: Used to confirm that an item was correctly handed off and received, and to display product listings within the app.
• Identity Verification: Used to confirm you are who you say you are before allowing certain account activity (e.g. acting as a Traveler), in order to protect the safety of our community. Cokatoo only receives a verification result (pass/fail) from Stripe Identity — the underlying documents are used solely by Stripe to perform the check.
• Financial & Payout Data: Used to process payments for completed orders and to pay out Travelers for completed trips. Bank and payout details are used exclusively for this purpose and are never used for marketing or shared with any party other than our payment processor.
• Device & Notification Data: Used solely to deliver push notifications to your device (e.g. new messages, order updates). This token is not used for advertising or cross-app tracking.
• Location (origin/destination text): Used to help match Shoppers and Travelers whose routes overlap, and to display order/trip details. We do not use this information to track your device's real-time location.

3. Information Sharing

We do not use any of the information above for third-party advertising, and we do not sell your personal information to data brokers.

4. Data Sharing and Disclosure

We do not use any of the information above for third-party advertising, and we do not sell your personal information to data brokers.

Between Users

To complete a delivery, we share necessary contact details (such as your username) and order/trip information between the matched Shopper and Traveler. Your email address and phone number are not shared with other users.

Service Providers

We share data with the following third-party service providers, solely to the extent necessary for them to perform services on our behalf:

• Stripe: payment processing, payouts, and identity verification (Stripe Identity). Stripe receives your payment details, payout bank information, and, for identity checks, your government ID and selfie image directly.
• Firebase Cloud Messaging (Google): delivery of push notifications to your device, using your device's notification token.
• Mailgun: delivery of transactional emails, including one-time verification codes, using your email address.
• Microsoft Azure: secure cloud hosting for our backend infrastructure and for storing photos (product images, delivery/receiving confirmation photos, and chat images).

We do not use any analytics or advertising SDKs that collect or share your usage data with third parties.

Legal Requirements

We may disclose your information if required to do so by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect the safety of our users, investigate fraud, or respond to a valid request from a public authority.

Business Transfers

If Cokatoo is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you if this happens and if your information becomes subject to a different privacy policy.

5. Account Deletion

You can request to delete your account at any time from the app's Settings menu.

What happens when you delete your account:

• Your personal identifiers — email address, phone number, and username — are immediately replaced with anonymized values, so your account can no longer be linked to you by name, email, or phone.
• Your login credentials and active sessions are revoked, and your device is immediately unsubscribed from push notifications.
• If you signed up using a third-party account, that connection is removed and can no longer be used to log in.
• Your identity verification status is cleared.

What is retained, and why:

Records tied to orders, trips, payments, and messages you were part of are not deleted — they are retained in de-identified form (associated with an anonymized account, not your name or contact details). We retain these for the following reasons:

• The other party's record. If you completed or were mid-way through a delivery with another user, deleting the underlying order or trip would remove their own record of that transaction.
• Financial and tax record-keeping. Payment and payout records may be retained as required for accounting, tax, and dispute-resolution obligations.
• Fraud prevention. Retaining de-identified transaction history helps us detect abuse patterns across the platform.

Your payment processor account with Stripe is unlinked from your Cokatoo profile but is not automatically deleted at the same time, since Stripe may independently retain records for chargeback and regulatory purposes. You may separately request deletion of your Stripe-held data by contacting us.

When deletion may be delayed:

If you have an order or trip that is currently in progress or in dispute, you will need to wait until it is completed, cancelled, or resolved before your account can be deleted, so that the transaction can be properly closed out for all parties involved.

If you have questions about what happens to your specific data after deletion, contact us at info@cokatoo.net.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access & Correction: You can view and update your profile information (username, email, phone number) directly within the app's Settings menu at any time.
• Data Portability: You may request a copy of your personal data by contacting us at info@cokatoo.net. We will provide your account, order, and trip information in a structured, commonly-used format within a reasonable timeframe.
• Account Deletion: You can request account deletion from the app's Settings menu. See the "Account Deletion" section above for exactly what is removed, what is retained, and why.
• Withdrawal of Consent: Where we request a device permission (such as camera or photo library access), you may revoke it at any time through your device's system settings. Revoking a permission may limit your ability to use certain features (for example, uploading a delivery confirmation photo).
• Marketing Communications: If we ever send you marketing communications, you may opt out at any time via the unsubscribe link in the message or through your notification settings in the app. This does not affect transactional notifications related to your active orders or trips, which are necessary for the Service to function.

Regional rights: Depending on where you live, you may have additional rights under local law (for example, Canada's PIPEDA). If you believe your rights under applicable law have not been respected, you may contact us at info@cokatoo.net, or lodge a complaint with your local data protection authority.

Age restriction: Cokatoo is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us so we can remove it.

7. Data Security

We implement technical and organizational measures designed to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS) between the app and our servers.
• Encryption at rest for sensitive fields, such as your payout bank account details (IBAN).
• Access controls limiting which systems and personnel can access personal data.
• Delegation of the most sensitive data — full payment card details and government ID documents — to specialized, PCI-compliant third parties (Stripe and Stripe Identity) rather than storing them ourselves.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you in accordance with applicable law.

8. Contact Us

If you have questions about this policy or your data, please contact us at:

Email: info@cokatoo.net