COCOCE

Privacy & Authentication

Your Data, Your Control.

Transparency about what we store, how we secure it, and what you should know before signing in. Your privacy is a priority — here's exactly how we handle your information.

Last updated: Latest Applies to: cococe.rw and all subdomains

1. What we store (minimal by design)

We believe in collecting only what is absolutely necessary to provide you with a secure and functional experience. Here is exactly what we store when you create an account:

  • Email address — used as your unique identifier and for critical security alerts.
  • Password hash — we never store your plain password. Only a salted, slow hash (Argon2id).
  • Account metadata — creation date, last sign-in, and basic device/browser info to detect anomalies.
  • Display name (optional) — if you choose to provide it.

We never ask for your full address, phone number, or payment details unless you explicitly enable paid features. Your data stays minimal — and that's intentional.

2. How we keep it secure

Your credentials are encrypted and stored more securely. We employ industry-leading practices to ensure that even in the unlikely event of a breach, your data remains inaccessible.

“Even our team cannot access your data.”
  • Passwords are hashed with Argon2id + unique salt.
  • All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
  • Zero‑knowledge architecture for authentication secrets.

3. Cookies & authentication

We use a minimal set of cookies — strictly necessary for keeping you signed in and protecting against cross‑site request forgery. We never use third‑party tracking cookies for authentication.

What cookies do we use?

Session cookie (httpOnly, secure) CSRF protection token Preferences (e.g. dark mode)

What authentication means for you: Authentication verifies that you are who you claim to be. When you log in, COCOCE creates a temporary session — a short‑lived key that tells our servers it’s really you. That session expires after a set time of inactivity or when you sign out.

4. Important session & security cautions

⚠️ Please read carefully
  • Session lifetime: For your safety, sessions automatically expire after 30 minutes of inactivity. Always sign out manually when you’re done, especially on shared devices.
  • Password sharing / protection: Never share your password — not with friends, not with support (we will never ask for it). Use a unique passphrase and a password manager.
  • Browser data hijacks: Malicious extensions, cached credentials, or session tokens stored in your browser can be stolen if your device is compromised. Attackers may use your browser’s stored caches to enter or steal information.
  • Public networks & shared machines: Avoid signing in from public computers, libraries, or uncontrolled Wi‑Fi. If you must, use a trusted VPN and always sign out and clear browser data afterwards.
Even if our system monitors your account security, login details and attacks may use your browser's stored caches to enter or steal information. We urge you to always sign out after using your account and avoid accessing or signing in from public uncontrollable machines or public networks.
Always sign out Use private/incognito if needed Keep browser updated

5. Browser cache & device safety

Browser cache can betray you: Even with our strict encryption, if you save passwords in your browser or leave a session open, someone with access to your device could impersonate you. Always lock your device and use a screen lock.

We recommend using a password manager, enabling two-factor authentication where available, and regularly clearing your browser's cache and saved passwords on shared devices. Your security is a shared responsibility — we do our part, and we ask you to do yours.

6. Contact

Questions about privacy or authentication may be sent to:

This document is provided for informational purposes and does not constitute legal advice. COCOCE recommends that users seek independent legal advice where appropriate. If anything here conflicts with mandatory law, the law prevails.