CoCap is operated by Kapil Bansal (sole proprietor, GSTIN 23GALPB3479M1ZB), 140, Nihalpur Mundi, Indore, Madhya Pradesh 453331, India — the data fiduciary responsible for your personal data under India's Digital Personal Data Protection Act, 2023.

For any question, request or complaint about your data, write to our grievance contact at hello@cocap.in. We respond within 30 days.

Account: your phone number and/or email address (whichever you sign in with), and what you choose to add — your name, photo, city, a line about you, your learning goal, and any level or learning preferences you choose to add later. Signup does not require your name, goal or learning-level answers.

Practice: your answers in Sentences and Words, the words you save, your level-check answers, the evidence behind your English level, your conversations with Kyra, and your CapCoins and XP.

Your speech, in three different ways:

• When your device can transcribe by itself — mostly on a computer — your browser turns your speech into text on your device. We receive the text, not the audio.
• When it cannot — which is most phones — a short audio clip is sent to CoCap and passed to our speech-to-text processor (Groq, United States), which returns the words. CoCap does not add that transient clip to your saved recordings. Groq says ordinary inference inputs are not retained by default, although limited temporary logging for reliability or abuse monitoring may occur under its service terms unless zero-data-retention controls apply.
• Recordings you save in Speak — we keep the audio so you can hear your progress. They are stored privately in India, reachable only through a short-lived link signed for you, never shared or sold, and you can delete any of them at any time.

Sessions: your bookings, times and topics, any note you add for the other member, feedback and problem reports you send, people you block, your age confirmation (Sessions are 18+) and, if you apply to host, your application. If a verified host connects Zoom, we also keep the Zoom user/account identifiers, granted scopes and encrypted OAuth authorization needed to create and run that host's Sessions while the connection remains active. See Sessions below.

Feedback and support messages: what you write, an optional screenshot, and — stated on the form — the app version, the screen you came from and your device type. If you are not signed in and leave an email for a reply, that email. Authorized support staff may keep private account notes to investigate and resolve a support issue; those notes are not shown to other learners or sent to AI providers.

App and device: counts of which screens and actions are used, and the technical detail of an error when one happens. We do not request your contacts or precise device location. In Android Words and Sentences, Google AdMob may process IP-derived approximate location, ad/app interactions, diagnostics, and device or app identifiers for ad delivery, measurement and fraud prevention.

Ads in Android Words and Sentences: the Android app may show a clearly marked Google AdMob native ad between groups of vocabulary cards and above sentence practice. This release requests non-personalized ads and removes Android's AD_ID manifest permission. Those controls reduce advertising data use but do not make the ad SDK anonymous. CoCap does not send your practice answers, Kyra conversations, recordings, phone number or email to AdMob for ad targeting.

A notification token, in the Android app. If you allow notifications, Android gives the app an anonymous device token through Google's Firebase Cloud Messaging, and we store it so we can send you a reminder. It carries no name, number or address, it is reset if you reinstall CoCap, and refusing the permission stops it being created. It is deleted with your account.

WhatsApp, when you choose it. If you turn on WhatsApp updates or message Kyra there, Kapso and WhatsApp (Meta) route your WhatsApp number and the message needed for that conversation. When you message CoCap on WhatsApp, CoCap keeps the canonical WhatsApp delivery address observed on that signed inbound message so later updates go back to the same account instead of guessing a country code from a local-format profile phone. CoCap also keeps your WhatsApp consent and reminder preferences, plus delivery metadata such as sent, delivered, read or failed. For a scheduled template, CoCap may temporarily keep the template parameters needed to send it (for example your first name or Session time); those parameters are erased as soon as the job is sent, skipped, failed or expires. Terminal workflow metadata is retained for up to 30 days for operational debugging. The delivery log does not store a second copy of the message body or your phone number.

How you found us. When you first arrive we note the website that sent you, any campaign tag in the link, and which CoCap page you landed on — once, with your account. It is not shared and is deleted with your account.

Payments. CoCap is free in this release and takes no new payments. The Android app has no in-app purchases or subscriptions. Until July 2026 the website briefly sold plans through Razorpay; we keep the order records of those payments for as long as the law requires.

When you ask Kyra something, she is given: your first name; a short summary of your English level, goal and the mistakes you repeat; bounded recent practice evidence; how much of your own language to use; up to 5 relevant notes; and a bounded excerpt of the current screen when you ask for help with it. That is sent to our AI provider (OpenAI, United States) to write her answer.

Chat history and uploads. Kyra in the header uses a browser-tab conversation with refresh recovery. Previously saved account chats and uploads remain available under Me → Kyra → Chat history, where you can open, rename, pin, archive or delete them; archive does not delete a chat. Opening a saved chat keeps the current thread as an in-tab recovery copy. New header replies are not automatically saved to the account archive. Image and TXT upload input is currently unavailable in the header. Existing uploaded images were resized and re-encoded without location metadata; image content and bounded uploaded text used for a question were sent to OpenAI. Staff operational views show type, size, counts and timing, not chat text, titles, images or file names. Deleting a saved chat removes its uploads and does not erase Kyra’s memory notes. Account deletion removes saved chats and uploads after the published grace period. Download my data includes chat content and upload metadata with explicit export limits.

Her notes. Kyra keeps a few short notes between conversations — an exam date, a job you are preparing for, how you like to be corrected — each with the reason it is kept and whether you told her or she worked it out. She refuses to keep phone numbers, emails, codes or ID numbers. An explicit new primary goal replaces the earlier goal note. Expired and superseded notes are excluded from her context. Forgetting permanently removes the note; an opaque source receipt can remain to prevent a retried event from recreating it. Receipts contain no note text and are removed with your account.

Reliability. We keep response validation results, timing, token counts and context-size counts. Our daily maintenance job clears health records older than 30 days. This health record contains no prompts, replies, transcripts or memory text. Recent practice evidence may help Kyra choose relevant support; recognition or a correct retry does not establish fluent speech or pronunciation.

Correction retries and Session reflection, when enabled. Validated feedback you requested in Speak can nominate a practice opportunity for a recognised construction. This uses structured feedback, without sending old recordings again. After a completed Session and saved feedback, you can optionally report how communicating felt and remove that reflection. Kyra may offer lighter support for up to seven days after you report difficulty. This is your self-report, not an objective measure of ability, pronunciation or transfer. The reflection is included in your account export and removed with your account. Authorised staff can inspect the selected option without call content.

Voice questions, when enabled. Kyra only opens the microphone when you choose Use microphone. You can cancel recording; stopping sends the short clip through CoCap to Groq for transcription. CoCap does not save this audio as a recording. The transcript appears in the editable question field and is sent to the text AI provider only when you choose Send. Closing Kyra stops microphone capture.

Suggestions. Contextual starters use the word, structure, feedback or booking currently shown. Opening Kyra does not itself request a generated answer. Next-action suggestions can be dismissed; cooldown and dismissal counts are kept in this browser tab, separately for each signed-in learner. Analytics records action and voice event counts without transcripts or question text.

Your control. Me → Kyra’s memory shows every note and everything she reads from your progress. You can correct, pin, add or forget a note, forget all of them, or clear what she worked out about you. Forgetting is permanent: the note is deleted, not hidden.

Memory and progress are different. Deleting a Kyra note stops that note being used in later conversations, but it does not erase the practice evidence behind My English, such as completed exercises or level evidence. Those records are part of your learning progress and can be removed through the relevant in-app controls or by deleting your account.

Optional Kyra practice: when enabled, a canvas attempt records the exercise, how much help you requested and its verified outcome in your existing practice history. Open-ended typed replies are sent to OpenAI for evaluation; typed replies are not saved. Full-answer help earns no independent skill credit. Spaced-review callbacks describe recorded attempts, not inferred mastery.

Communication planning and short experiences: when enabled, Kyra derives a recalculable focus from existing learning evidence, your communication goal and booked Session topic. This is not a personality profile. Fictional practice situations and hints are cached for up to one day and removed by daily maintenance; minimal outcome, assistance and context provenance remain in your practice history. Your short English reply is sent to OpenAI for evaluation and a counterpart turn, then discarded. A protected, account-specific fingerprint can remain to detect repeated answers; it contains no reply text and is excluded from staff views. Plans expire after fifteen minutes and old projections are removed by daily maintenance after seven days. Dismissal preferences reduce repeated roleplay suggestions. You can finish any time, export your own projections and outcomes, and delete them with your account. Attendance alone never establishes speaking ability or transfer.

Archived first-meeting tools: account entry no longer asks onboarding questions or records an introduction. In staff previews of the earlier first-meeting flow, you can speak for up to 20 or 60 seconds, type, or choose quick answers. A stopped recording is sent to our transcription processor and is not saved in your recordings. Review the transcript before asking Kyra to understand it. The introduction is unscored and is not kept as a full memory. You review the extracted choices before saving. Your confirmed goal and optional short context become editable memories; your help language, self-reported starting comfort and first focus are saved in your profile. You can leave out the optional context. A first meaningful communication marker records the time and source of a qualifying learning result or completed Session; signing up or viewing a screen does not qualify.

Optional Session help: enable it separately in each call, then request a phrase. Kyra does not hear or transcribe the call for this help. Turning the option off removes the help. Dismissal and usage events contain bounded interaction metadata, not call content.

Your account phone number and email are excluded from Kyra’s progress context and durable memory notes. What you choose to submit in a question is sent to the AI provider. Raw saved recordings are not turned into Kyra memory notes. When you explicitly request speaking feedback, the transcript and validated feedback may contribute a structured learning signal such as a recurring grammar or phrasing mistake; Kyra may later receive that short learning summary as part of your progress context, not the recording itself or the full transcript. Nothing she is given is used for advertising or to train AI models.

To run CoCap: coach you, work out and show your English level, run Sessions, keep your CapCoins and XP, send the reminders you asked for, answer your messages, keep CoCap safe and working, and — in Android Words and Sentences — fund the free experience with clearly labelled advertising.

We do not sell your personal data. Ever.

We do not use your conversations or recordings to train AI models. Groq's current business-service terms prohibit using customer inputs or outputs for model training unless the customer explicitly authorises it; CoCap does not give that authorisation.

These providers process data for us, each bound by contract and given only what its job needs:

• Vercel — Runs the CoCap website and the app’s servers.Receives: Every request your app makes, on its way to our database.
• OpenAI — Kyra and selected text-based AI features (United States).Receives: The text and selected image content needed for the feature, plus limited learning context such as your first name, level and goals. CoCap does not send audio to OpenAI for transcription.
• Supabase — Database and file storage (India (Mumbai)).Receives: Your account, your practice history, your saved recordings and your uploads.
• Kapso + WhatsApp (Meta) — Routes WhatsApp sign-in codes, opted-in reminders and Kyra replies.Receives: Your WhatsApp phone number and the message content needed to deliver or receive that WhatsApp message.
• An Indian SMS gateway — Delivers sign-in codes when WhatsApp cannot (India).Receives: Your phone number and the code.
• Resend — Sends email (United States).Receives: Your email address and the email itself.
• Zoho ZeptoMail — Sends email.Receives: Your email address and the email itself.
• Groq — Speech-to-text and speaking feedback (United States).Receives: Short audio clips that need transcription and the resulting transcript when speaking feedback is requested.
• Google AdMob — Shows labelled Android Words native ads and compact banners in compatible Android Sentences builds.Receives: IP address, ad/app interactions, diagnostics and device/app identifiers for ad delivery, measurement and fraud prevention. Requests are non-personalized and CoCap does not send practice, recordings or Kyra conversations for ad targeting.
• Zoom — Runs the video call for a Sessions booking (United States).Receives: The call itself and the name you join with; for hosts who connect Zoom, the authorization and basic Zoom account details needed to create and manage Sessions. CoCap does not record Sessions.
• Google Firebase Cloud Messaging — Delivers notifications to the Android app.Receives: An anonymous device token and the text of the notification.
• Sentry — Tells us when something crashes (United States).Receives: The technical detail of an error — the screen, the device type, the code that failed.
• Website measurement tools (such as Google Analytics) — Counts visits to the website — only if you agree to it.Receives: Visited public pages or a redacted app path, a broad discovery-source category, and allow-listed action counts after consent. Never practice answers, recordings, conversations, private URLs or query text.
• Razorpay — Handled payments when CoCap sold plans on its website (until July 2026) (India).Receives: Order records for those past payments. CoCap takes no payments today.

Website measurement loads only if you agree to it. It can count page visits, signup completion, selected completed practice attempts and public exercise interactions. We send event names and broad page categories, not your practice answers, recordings, conversations, account identifiers or private URL details. AdMob is separate from that website-measurement consent: its own Google consent flow is requested before an ad request where required.

Your account, your practice history and your saved recordings are stored in India (Mumbai).

Some processing happens outside India, under contractual safeguards and limited to what the task needs: what Kyra is given (OpenAI, United States); short audio clips for transcription and speaking feedback (Groq, United States); Sessions video calls (Zoom); crash diagnostics; some email delivery; and the servers that run the app, which sit on a global network. Android ad delivery also involves Google AdMob and may be processed outside India. CoCap does not send your learning content, Kyra conversations or recordings to AdMob for ad targeting, and does not authorize AI providers to train on that learning content.

Sessions are 20-minute English conversations with another member, on Zoom. They are for people aged 18 and over; you confirm your age the first time you book or apply to host.

During the booking-only launch, members can book available Sessions on CoCap's owner Zoom account. Member hosting opens after Zoom approval; connecting Zoom is not required to book.

What the other member sees: your first name, the topic you picked and any note you add for them. A host also sees the times you have booked with them. Your phone number and email are never shown.

The call itself runs on Zoom, on the host's own Zoom account, and Zoom's privacy policy applies to it. CoCap does not record Sessions, and members must not record them either.

If you connect Zoom as a host: you authorize CoCap on Zoom's own consent screen. We store the minimum Zoom connection data needed to create and manage your Sessions — your Zoom user/account identifiers, the scopes you granted, and OAuth access/refresh tokens encrypted at rest. CoCap never sees your Zoom password.

When you disconnect or remove CoCap from Zoom: we revoke access when possible, erase the stored Zoom authorization and Zoom profile identifiers from the connection, and cancel future Sessions that depended on that connection so another member is not left waiting. You can reconnect later through Zoom's authorization screen.

Reports and blocks are seen only by the CoCap team, who use them to keep Sessions safe. If you apply to host, CoCap reviews your application by hand.

Much of it you can do yourself, inside the app:

• See and change your profile in My profile, and what Kyra knows in Kyra’s memory.
• Delete parts of it — any saved recording (Speak → Your recordings), any saved word, any or all of Kyra's notes, or a saved Kyra chat and its uploads. Deleting a recording also removes its cached transcript and feedback.
• Control WhatsApp from Settings → WhatsApp · Kyra by CoCap. You can also send STOP in WhatsApp to stop proactive updates and START to restore them.
• Export what we store about you, from Settings → Download my data.
• Delete your account from Settings, with a 30-day grace period — see how deletion works.

You may also ask us to correct your data, tell you what we hold, remove something the app has no button for, or act for someone you nominate. Write to hello@cocap.in — we act within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Data is stored with row-level security and reached only through our servers, over encrypted connections. Saved recordings and feedback screenshots sit in private storage, reachable only through short-lived signed links. Login codes expire in 5 minutes and are stored hashed.

We keep your practice history while your account is active, because your level and progress are built from it. A note you tell Kyra to forget is deleted straight away. Zoom connection credentials and identifiers are removed when a host disconnects Zoom or removes CoCap from their Zoom account.

When you delete your account it is deactivated at once and permanently erased after 30 days — including your recordings, your Kyra notes, private account support notes and your uploads. Private account support notes become inaccessible when the account is deactivated. Administrative audit evidence retains only the note identifier, size and fingerprint, not note text. Messages you sent us and reports you made in Sessions are kept, detached from your account, so we can act on them; ask and we will delete those too. Beyond that we keep only what the law requires, such as the records of earlier payments.

CoCap is for people 13 and older; Sessions are for 18 and older.

Under India's DPDP Act anyone under 18 is a child. If you are under 18, please use CoCap with a parent or guardian's knowledge and consent. Android Words and Sentences can show non-personalized AdMob ads; CoCap does not use a learner's practice, conversations or recordings to target those ads, and this release does not request Android's AD_ID permission. We do not use anyone's conversations for AI training.

If you believe a child under 13 is using CoCap, or you are a parent who wants an account removed, contact us and we will delete it.

The CoCap plugin provides public word content, authored sentence lessons and situation-practice guides without connecting your CoCap account. It receives the word, lesson or guide query, selected level and optional support language needed for the tool call. CoCap does not save these requests as learner practice history, award coins, read private Kyra memory or accept recordings through this plugin.

OpenAI handles your ChatGPT conversation under its own terms and privacy controls. CoCap receives only the tool arguments, not your entire chat. Our hosting infrastructure handles ordinary request metadata; the endpoint uses a temporary per-instance IP limiter. Do not put personal information in word, lesson or guide searches. You can remove or disable the plugin in ChatGPT at any time.

When how we handle data changes, we update this page and its date. For a change that materially affects you, we tell you in the app or by email before it takes effect.