Privacy Policy

This version applies from the day you sign up if you join after it is published, and from 16 October 2026 if you joined before. Until then the previous version applies. You do not have to accept this policy; it explains how we use your data.

1. About this policy

We do not advertise to you, and we do not sell your personal data. There are no adverts in Cohorta, we do not sell advertising space, and we have never sold, rented or traded members' personal data to anyone. Cohorta is paid for by your subscription. This policy explains who sees your data, and why.

It explains what personal data we collect when you use Cohorta, how and why we use it, who we share it with, how long we keep it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). Cohorta is for adults aged 18 and over only.

2. Who we are (controller)

The data controller is Cohorta Ltd, 128 City Road, London, EC1V 2NX, United Kingdom (company number 17376110). Cohorta Ltd is, and always has been, the company that holds your data and that you contract with. Our data protection lead is Steve Paddock.

Cohorta Ltd is registered with the Information Commissioner's Office (ICO), registration number ZC247656. For any privacy question or to exercise your rights, contact privacy@cohorta.me.

3. The data we collect

• Account and identity: name, email address, date of birth.
• Profile: your profile photo, bio ("At a Glance"), gender, who you want to connect with (dating, friendship or both), interests, happy places, prompts, and other details you choose to add, including any link to a profile of yours elsewhere that you type in yourself.
• Connection activity: discovery filters, likes, matches.
• Location: your home location, and a current location if you choose to set one, to show you members and events near you. Both appear on your profile as you set them; Cohorta never moves your location by itself.
• Messages and content: your one-to-one messages, your messages in group chats and on event boards, and other content you post. All conversations on Cohorta are text only: there are no photos or files in any message. The only images on the platform are profile photos.
• Age information: your date-of-birth declaration at sign-up and the result of your age check with our age-assurance provider (see section 11).
• Payment data: subscription and billing information, processed by Stripe; we do not store full card numbers.
• Group and community data: the group you belong to, the invite code you used, when you joined or left, and the events you said you would attend.
• Usage, analytics and device data: how you use the app and the website, device identifiers, IP address, log data, and cookies (see our Cookie Policy). We use this to understand which parts of Cohorta work well and to fix what does not. It is never used to advertise to you and is never sold.
• Support and safety data: reports you make or that are made about you, and support correspondence.

What we do not collect: nothing is imported into Cohorta from any other service. You build your Cohorta profile yourself, and nothing you do on Cohorta is sent back to any other service.

What you have to give us. Your name, email address and date of birth, and a payment method, are needed to have an account; without them we cannot provide the Service. Almost everything else on your profile is yours to choose, and leaving it out only means we can show you less.

4. Special category data

Because Cohorta is a connection and dating service, some information you provide (for example the genders you wish to connect with, or details in your profile or messages) may reveal or imply special category data such as your sexual orientation. Where we process such data we rely on your explicit consent (UK GDPR Article 9(2)(a)), given when you choose to provide that information. You can withdraw it at any time by removing the information or deleting your account.

Special category information is never shown to your group's owner (section 6) and is excluded from our analytics.

5. How we use your data and our lawful bases

6. Who sees your data

• Other members of your group. Your profile and the content you choose to share are shown to other members through Discover, matching, your group's chat and event boards. Your profile is not public and does not appear on the open internet or in search engines.

• Your group's owner. The person who owns your community group is given your display name, your profile photo and your full email address — and nothing else — for the members of their own group only.

  We send this list to them by email, outside the app, to their own mailbox, and we will tell you before your details are sent for the first time.

  People who have left the group are not in the list. They use it to confirm that people belong to their group, and to tell us whether someone asking to join should be let in.

  Their agreement with us allows them to use your email address for that purpose only: not for marketing, not to contact you about anything else, not to show or forward the list to anyone, not to add you to any list — and they must delete the list once they have finished the check.

  A group owner is never shown your date of birth, your dating preference or orientation, your messages, your activity, your billing, who has reported anyone, the contents of any report, or anything about members of other groups.

  If we ask an owner about a concern over someone's behaviour, we give them the member's name and the general concern only.

  You can object to your details being sent to your group's owner — see section 9.

• Service providers (processors), under data processing agreements:

  • Stripe (payments; see section 7 for transfers);
  • Google Cloud Platform (hosting) and Firebase (app infrastructure);
  • Yoti (age assurance);
  • Google Analytics 4 (analytics, only with your consent; see the Cookie Policy);
  • Brevo (email delivery);
  • FreeScout (support desk);
  • our automated content-checking provider, which scans open group chats and event board messages against our Community Standards (see 'What we scan, and what we do not' below).

• Safety, legal and regulators: we may share data with law enforcement, the National Crime Agency, Ofcom, the ICO or others where the law requires it, or where it is needed to protect someone's safety.

• Business transfers: in connection with a merger, acquisition or sale of assets, subject to the same protections.

We do not sell your personal data, and we do not share it with advertisers.

7. International transfers

Where a provider processes data outside the UK (for example Stripe and Google process some data in the United States), we rely on appropriate safeguards: UK adequacy regulations, or the UK International Data Transfer Agreement / Addendum with Standard Contractual Clauses.

8. How long we keep your data

• Account and profile data: when you delete your account, your profile immediately stops being visible to other members. We then keep your account data for a safety retention window of three months (up to two years where the account was banned), so we can investigate unlawful or harmful behaviour, protect other members, and meet our legal safety duties. When the window ends, your data is deleted or anonymised.
• Messages: deleted with your account at the end of the safety retention window.
• Billing records: six years from the end of the tax year they relate to (an HMRC requirement). This is a legal minimum and cannot be shortened, even if you ask us to erase your data.
• Support correspondence: up to two years, or longer where connected to a live complaint or dispute.
• Safety and moderation records (reports, decisions, enforcement): kept for as long as needed for member safety and to meet our Online Safety Act record-keeping duties, and longer where a hold applies.
• Security logs: up to 12 months.

We keep data beyond these periods only where we must: an open report or investigation, a legal or regulatory hold, an outstanding or potential claim or dispute, or a legal obligation (for example child-safety reporting duties). We do not keep everything just in case.

9. Your rights

You have the right to: access your data; correct inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent at any time (where we rely on consent).

You can object to your details being sent to your group's owner. We send that list because we have a legitimate interest in keeping groups to the people entitled to be in them (section 5), and you have the right to object to it at any time for reasons that apply to your own situation. Email privacy@cohorta.me and we will stop unless we can show compelling grounds to carry on. Objecting does not affect your membership of your group or your use of Cohorta. Your group's owner is told only that the list is incomplete, never that you objected.

To delete your account, open Profile → Account in the app and choose delete.

For every other right, such as a copy of your data, a correction, erasure (including deleting your account if you cannot use the app), an objection, or a question about how we use your data, email privacy@cohorta.me.

A person handles your request and we will respond within one month. If your request is complicated, or you have made several, we may need up to two months more; we will tell you within the first month if that happens, and why. There is no self-service download of your data. Ask us and we will put it together for you.

You can also complain to the ICO: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; ico.org.uk; 0303 123 1113, though we would ask you to contact us first.

10. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and logging. No service is completely secure; if a breach affects your rights we will notify you and the ICO as required.

11. Age requirement (18+) and age assurance

Cohorta is strictly for adults aged 18 and over. You confirm your date of birth when you sign up and you complete an age check with our age-assurance provider, Yoti, to meet our duties under the Online Safety Act 2023. Access is also invite-only: you need a group code from your community. Age information is used only to confirm your age and to meet our legal duties. If we find a member is under 18 we delete their account immediately, and keep only a minimal safeguarding record where we are required to.

12. Marketing and communications

We send service-related messages where needed to provide the Service, including a reminder 3 days before your first payment and reminders before your subscription renews, by email, and in the app and by push where you have them turned on.

We send marketing about Cohorta's own service only where you have consented or the "soft opt-in" applies. You are given the chance to say no when we first take your email address, and you can unsubscribe at any time via the link in each message. We never send you other companies' promotions.

13. What we scan, and what we do not

• One-to-one messages between matched members are private. We do not read them and we do not scan them. We look at a one-to-one message only when someone in that conversation reports it to us.
• Group chats and event board chats are open and moderated. They are visible to Cohorta and are checked automatically against our Community Standards. Where the check flags something, a person decides what happens. No account is ever banned, and no content removed, on the automated check alone.

14. Automated processing and profiling

We use your preferences and activity to suggest other members and events (matching and discovery). This does not produce legal or similarly significant effects on you, and you can adjust your preferences at any time. We do not make solely automated decisions with legal or similarly significant effect; a decision such as banning an account is always made by a person, and you can appeal to a person.

15. Cookies

We use cookies and similar technologies (including identifiers used by the phone apps) as described in our Cookie Policy. Nothing non-essential is used without your consent.

16. Changes to this policy

We may update this policy. If changes are material we will notify you and, where required, ask you to review the updated version. The current version and effective date are shown at the top.

17. Contact

Cohorta Ltd, 128 City Road, London, EC1V 2NX, United Kingdom (company number 17376110). Privacy contact: privacy@cohorta.me. ICO: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; ico.org.uk.