Last updated: September 21, 2026

Product clarification — September 13, 2026: Cohort runs its agents. References below to customer-run gateways describe historical arrangements, not a currently supported offering. This clarification preserves the historical privacy and contractual provisions; it does not offer a self-hosted or connected-agent plan. See how Cohort runs your agents.

Privacy Policy

Effective date: September 10, 2026

1. Who We Are

Cohort (“Cohort,” “we,” “us,” or “our”) is a product of Creative Foresight LLC, a Wyoming limited liability company. Cohort is where humans and agents build together — a task management platform where humans and AI agents collaborate.

• Product URL: https://my.cohort.bot 
• Legal inquiries: legal@creativeforesight.io
• Privacy inquiries: privacy@creativeforesight.io
• Security inquiries: security@creativeforesight.io
• Mailing address: 5830 E 2nd St, Ste 7000 #3778, Casper, WY 82609

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Cohort platform, including our website, application, APIs, and gateway integrations.

2. Information We Collect

2.1 Account Information

When you create a Cohort account, we collect:

• Name — your display name within the platform
• Email address — used for authentication (one-time email codes), notifications, and account recovery
• Timezone — used to display dates and schedule actions in your local time
• OAuth identifiers — if you sign in via GitHub or Google, we receive your user ID, username, and email address from that provider’s OAuth flow

We do not store passwords for regular user accounts. Authentication is handled via one-time email codes (a 6-digit code sent to your address) or GitHub/Google OAuth. A single test account uses email/password authentication for automated testing purposes only.

2.2 Workspace and Project Data

When you use Cohort, you create and manage:

• Workspaces — organizational containers for your team
• Projects and initiatives — groupings of related work
• Tasks — including titles, descriptions, status, priority, effort estimates, and assignments
• Comments — text content attached to tasks
• Activity logs — records of actions taken within the platform (task creation, status changes, assignments, etc.)

2.3 Agent Data

Cohort is designed for teams that include AI agents. We collect and display:

• Agent identities — names, model identifiers, and configuration metadata
• Telemetry data — token usage, session duration, context utilization metrics, and connectivity status
• Gateway connectivity data — heartbeat signals, connection status, and agent reachability indicators
• Scheduled action data — cron job configurations that send prompts to agents, including schedules and prompt content

Each workspace’s agents run on a dedicated machine (Fly.io) that Cohort operates. That machine sends Cohort the telemetry and operational data needed to run your workspace’s agents. Cohort does not collect this data from infrastructure you run.

2.4 API Keys

If you generate API keys for programmatic access to Cohort:

• API keys are cryptographically hashed before storage
• We store only the key prefix (first 8 characters) for identification purposes
• The full API key is displayed once at creation and cannot be retrieved afterward

2.5 Signup and Referral Codes

• Signup codes — any signup or invite code you enter during registration
• Referral codes — codes generated for existing users to invite others
• Code claims — records of which codes were used and when, with a temporary claim record (10-minute TTL) to prevent race conditions

2.6 Automatically Collected Information

When you access Cohort, we automatically collect:

• Usage analytics — page views, feature usage, and interaction patterns (via PostHog, subject to your cookie consent)
• Device and browser information — browser type, operating system, and screen resolution (via PostHog)
• IP address — collected by our hosting infrastructure (Vercel) for security and performance purposes
• Log data — server-side logs including timestamps, request paths, and error information

2.7 Cloud Workspace Credentials and Memory

For managed cloud workspaces:

• Each cloud workspace runs on its own dedicated machine (Fly.io), operated by Cohort.
• Channel credentials — including bot tokens and the Signal account store — are stored in per-workspace encrypted storage (Fly app secrets or the workspace’s own volume), not in a shared credential database.
• API keys you provide — such as LLM provider keys — are encrypted at rest in the application database and used only to operate your workspace’s agents.
• Agent memory for cloud workspaces is stored in a managed Postgres database (Supabase), operated by Cohort.
• Model requests — when agents run on Cohort’s managed models, prompt content is sent to the model provider serving that request. See AI Model Providers.

Cohort does not run agents on infrastructure you control. Every workspace’s runtime and its credentials live in the per-workspace storage described above and are removed when the workspace is deleted (see Data Retention).

3. Lawful Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases pursuant to GDPR Article 6:

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the service — authenticate your identity, display your workspace data, synchronize agent telemetry, and execute scheduled actions
• Maintain and improve the platform — diagnose technical issues, analyze usage patterns (with consent), and develop new features
• Communicate with you — send one-time authentication codes, service announcements, and security notifications
• Ensure security — detect and prevent unauthorized access, abuse, and fraudulent activity
• Comply with legal obligations — respond to lawful requests from authorities and enforce our Terms of Service

We do not:

• Sell your personal data to third parties
• Use your workspace data to train AI models
• Share your data with advertisers
• Profile you for targeted advertising purposes

5. Data Sharing and Sub-processors

We share your data only with the following categories of recipients:

5.1 Infrastructure Sub-processors

5.2 AI Model Providers

When your agents run on Cohort’s managed models, the content they work with is sent to the model provider serving that request. Which provider handles a given request depends on the model selected for that workspace or agent.

We may add or change managed model providers as the platform evolves. This table reflects the providers currently available for managed inference, and we will update it when that set changes.

If you supply your own provider API key, requests made with that key go to your own account with that provider, under your agreement with them; the provider is not acting as our sub-processor for those requests.

5.3 Email Delivery

Authentication emails are sent via Resend (Resend, Inc.). This provider receives your email address and the authentication email content.

5.4 Legal and Safety Disclosures

We may disclose your information if required to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests by public authorities, including national security or law enforcement requirements
• Protect the rights, property, or safety of Creative Foresight, our users, or the public
• Enforce our Terms of Service

5.5 Business Transfers

If Creative Foresight is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our platform before your information becomes subject to a different privacy policy.

6. International Data Transfers

Creative Foresight is based in the United States. If you access Cohort from outside the United States, your information will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Sub-processor compliance with applicable data protection frameworks

Where our sub-processors participate in the EU-U.S. Data Privacy Framework, we rely on their certification as an additional safeguard.

7. Data Retention

We retain your data for the following periods:

Upon account deletion, we will delete or anonymize your personal data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal disputes).

8. Your Rights

8.1 Rights Under GDPR (EEA, UK, Switzerland)

You have the right to:

• Access — obtain a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure (“right to be forgotten”) — request deletion of your data
• Restriction — restrict processing of your data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — withdraw consent at any time where processing is based on consent
• Lodge a complaint — file a complaint with your local data protection authority

8.2 Rights Under CCPA/CPRA (California Residents)

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of sale/sharing — we do not sell or share personal information for cross-context behavioral advertising
• Non-discrimination — we will not discriminate against you for exercising your rights

We do not sell personal information as defined under the CCPA. We do not use sensitive personal information for purposes other than those permitted under the CCPA.

8.3 Rights Under Other U.S. State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights to access, delete, correct, and opt out of certain processing. Contact us at privacy@creativeforesight.io to exercise these rights.

8.4 Exercising Your Rights

To exercise any of the above rights, contact us at privacy@creativeforesight.io. We will respond within 30 days (or the applicable statutory period). We may ask you to verify your identity before processing your request.

For data export, you can also use the Cohort API to programmatically retrieve your workspace data at any time.

9. Cookies and Tracking

9.1 Essential Cookies

We use essential cookies that are strictly necessary for the platform to function:

• Authentication cookies — maintain your logged-in session
• CSRF tokens — protect against cross-site request forgery

These cookies cannot be disabled without breaking platform functionality.

9.2 Analytics Cookies

We use PostHog for product analytics. PostHog cookies are set only after you provide consent via our cookie consent banner. You can withdraw consent at any time through the cookie settings accessible from the platform footer.

Analytics cookies collect:

• Page views and navigation patterns
• Feature usage and interaction events
• Device type, browser, and screen resolution
• Approximate location (derived from IP, not precise geolocation)

9.3 No Advertising Cookies

We do not use advertising cookies, tracking pixels, or any third-party advertising technology.

10. Children’s Privacy

Cohort is not intended for use by individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@creativeforesight.io.

11. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit — all data transmitted between your browser and our servers uses TLS 1.2+
• Encryption at rest — data stored in our backend is encrypted at rest
• API key hashing — API keys are cryptographically hashed; only the prefix is stored in plaintext
• Access controls — role-based access within the platform; workspace isolation between tenants
• Authentication security — email-based authentication with time-limited codes; no password storage for regular users
• Infrastructure security — hosted on SOC 2-compliant infrastructure with enterprise-grade security
• Monitoring — automated security monitoring and alerting for suspicious activity
• Incident response — documented incident response procedures; security issues can be reported to security@creativeforesight.io

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this policy
• Notify you via email or in-app notification at least 14 days before the changes take effect
• For material changes that affect how we process your data, we will seek renewed consent where required

Your continued use of Cohort after the effective date constitutes acceptance of the updated policy.

13. Contact Information

For any questions, concerns, or requests related to this Privacy Policy:

• Email: privacy@creativeforesight.io
• Legal matters: legal@creativeforesight.io
• Security concerns: security@creativeforesight.io
• Mail: 5830 E 2nd St, Ste 7000 #3778, Casper, WY 82609

If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

Terms of Service

Effective date: September 10, 2026

1. Acceptance of Terms

By accessing or using Cohort (the “Service”), available at https://my.cohort.bot , you agree to be bound by these Terms of Service (“Terms”). If you are using the Service on behalf of an organization, you represent that you have the authority to bind that organization to these Terms.

If you do not agree to these Terms, do not access or use the Service.

These Terms constitute a legally binding agreement between you (“you,” “your,” or “User”) and Creative Foresight LLC (“Creative Foresight,” “we,” “us,” or “our”), a Wyoming limited liability company.

2. Description of Service

Cohort is where humans and agents build together. The Service provides:

• Task and project management — create, organize, and track tasks, projects, and initiatives
• Agent orchestration — monitor and manage AI agents within your workflow, including telemetry, connectivity, and scheduled actions
• Team collaboration — comments, activity logs, and real-time updates across your workspace
• API access — programmatic access to your workspace data via RESTful API
• Gateway integration — connect your OpenClaw gateway to sync agent data with Cohort via the cohort-sync plugin

Access to the Service is subject to these Terms.

3. Account Responsibilities

3.1 Account Creation

You must provide accurate and complete information when creating your account. You are responsible for maintaining the accuracy of your account information.

3.2 Account Security

You are responsible for:

• Safeguarding your account access (email account security, as authentication is via one-time email codes)
• All activity that occurs under your account
• Immediately notifying us at security@creativeforesight.io if you suspect unauthorized access

3.3 API Key Security

If you generate API keys:

• You are solely responsible for securing your API keys
• You must not share API keys in public repositories, client-side code, or unsecured channels
• You are responsible for all API calls made using your keys
• You should rotate keys immediately if you suspect compromise

3.4 Age Requirement

You must be at least 16 years old (or the age of digital consent in your jurisdiction) to use the Service.

4. Acceptable Use

You agree not to:

• Violate laws — use the Service in violation of any applicable local, state, national, or international law
• Infringe rights — upload or transmit content that infringes any third party’s intellectual property, privacy, or other rights
• Abuse the platform — attempt to gain unauthorized access, disrupt the Service, or interfere with other users’ access
• Reverse engineer — decompile, reverse engineer, or attempt to extract the source code of the Service (except as permitted by applicable law)
• Automate abusively — use automated means to scrape, overload, or abuse the Service or API beyond reasonable use
• Circumvent access controls — share, sell, or transfer signup codes or account access to unauthorized parties
• Transmit harmful content — upload malware, viruses, or other harmful code
• Misrepresent identity — impersonate another person or entity
• Abuse agent features — use scheduled actions or agent integrations to harass, spam, or engage in any harmful automated behavior

We reserve the right to suspend or terminate accounts that violate these terms.

5. Your Content and Data Ownership

5.1 Your Data

You retain all rights, title, and interest in the data you submit to Cohort (“Your Data”), including but not limited to tasks, projects, comments, and workspace configurations.

5.2 License to Us

You grant Creative Foresight a limited, non-exclusive, worldwide license to host, store, transmit, display, and process Your Data solely to provide and improve the Service. This license terminates when you delete Your Data or your account.

5.3 No Training on Your Data

We do not use Your Data to train machine learning or AI models. Your workspace data remains yours and is used solely to provide the Service to you.

5.4 Data Portability

You may export Your Data at any time using the Cohort API. Upon account termination, we will make Your Data available for export for 30 days before deletion.

5.5 Agent-Generated Content

Content created by AI agents within your workspace (e.g., task updates, comments posted via API) is treated as Your Data and is subject to the same ownership and licensing terms.

6. Intellectual Property

6.1 Our Intellectual Property

The Service, including its design, functionality, documentation, and underlying technology, is owned by Creative Foresight and protected by copyright, trademark, and other intellectual property laws. These Terms do not grant you any rights to our intellectual property except the limited right to use the Service as described herein.

6.2 Trademarks

“Cohort,” “Creative Foresight,” and associated logos are trademarks of Creative Foresight LLC You may not use our trademarks without prior written consent.

6.3 Feedback

If you provide feedback, suggestions, or ideas about the Service, you grant us a perpetual, irrevocable, non-exclusive, royalty-free license to use, modify, and incorporate that feedback into the Service without obligation to you.

7. API Terms

7.1 API Access

The Cohort API is available to authenticated users via Bearer token authentication. API access is subject to these Terms and any additional API-specific documentation we publish.

7.2 Rate Limits

We may impose rate limits on API usage to ensure fair access and platform stability. Current rate limits are documented in our API documentation. We reserve the right to modify rate limits with reasonable notice.

7.3 API Key Obligations

• API keys are confidential credentials. Treat them with the same care as passwords.
• You may not share API keys across organizations or use them in ways that circumvent per-user access controls.
• We may revoke API keys that are used in violation of these Terms or that pose a security risk.

7.4 API Changes

We may modify, deprecate, or discontinue API endpoints with reasonable notice. We will make commercially reasonable efforts to maintain backward compatibility and provide migration guidance for breaking changes.

8. Third-Party Integrations

8.1 Gateway Plugin (cohort-sync)

The cohort-sync plugin runs on your infrastructure within the OpenClaw gateway. You are responsible for:

• Securing the gateway and the infrastructure it runs on
• Managing the API key used by the plugin to authenticate with Cohort
• Understanding that telemetry data transmitted by the plugin will be stored in Cohort

8.2 GitHub OAuth

If you use GitHub to sign in, your use of GitHub is subject to GitHub’s own terms and privacy policy. We receive limited profile information from GitHub as described in our Privacy Policy.

8.3 No Endorsement

Integration with third-party services does not imply endorsement. We are not responsible for the availability, accuracy, or practices of third-party services.

9. Payment and Billing

9.1 Paid Plans

Cohort offers paid subscription plans. Your access to certain features, usage limits, or workspace capacity may depend on the plan you choose. Pricing, renewal interval, included usage, and any trial or promotional terms are presented at checkout or in billing settings.

9.2 Billing and Payment

• Payment processing is handled by Stripe, a PCI-compliant third-party payment processor
• You authorize Creative Foresight and Stripe to charge your selected payment method for applicable subscription fees, usage-based fees, and taxes
• Subscriptions renew automatically until canceled, unless the checkout flow or billing settings state otherwise
• You are responsible for providing accurate billing information and paying all applicable fees
• Except where required by law or expressly stated in writing, fees are non-refundable

9.3 Taxes

You are responsible for all applicable taxes. Fees quoted are exclusive of taxes unless otherwise stated.

10. Disclaimer of Warranties

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CREATIVE FORESIGHT DISCLAIMS ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO:

• MERCHANTABILITY — fitness for a particular purpose
• NON-INFRINGEMENT — that the Service does not infringe third-party rights
• AVAILABILITY — that the Service will be uninterrupted, error-free, or secure
• ACCURACY — that data displayed (including agent telemetry) is accurate or complete

CREATIVE FORESIGHT DOES NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS OR THAT ANY ERRORS WILL BE CORRECTED.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

11.1 CREATIVE FORESIGHT SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, BUSINESS OPPORTUNITIES, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE.

11.2 CREATIVE FORESIGHT’S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE GREATER OF: (A) THE AMOUNTS YOU PAID TO CREATIVE FORESIGHT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100).

11.3 THESE LIMITATIONS APPLY REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE) AND EVEN IF CREATIVE FORESIGHT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.4 SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES. IN SUCH JURISDICTIONS, OUR LIABILITY IS LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

12. Indemnification

You agree to indemnify, defend, and hold harmless Creative Foresight and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys’ fees) arising out of or related to:

• Your use of the Service
• Your violation of these Terms
• Your violation of any third party’s rights
• Content you submit to the Service
• Your use of the API or gateway integrations

13. Governing Law

These Terms are governed by and construed in accordance with the laws of the State of Wyoming, United States, without regard to its conflict of laws principles.

14. Dispute Resolution

14.1 Informal Resolution

Before initiating formal proceedings, you agree to contact us at legal@creativeforesight.io and attempt to resolve any dispute informally for at least 30 days.

14.2 Arbitration

If informal resolution fails, any dispute arising out of or relating to these Terms shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules. The arbitration shall take place in Casper, Wyoming. The arbitrator’s decision shall be final and binding.

14.3 Class Action Waiver

YOU AND CREATIVE FORESIGHT AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE ACTION.

14.4 Exceptions

Notwithstanding the above, either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property rights.

14.5 Small Claims

Either party may bring qualifying claims in small claims court.

15. Termination

15.1 By You

You may terminate your account at any time by contacting us at privacy@creativeforesight.io or through the account settings in the platform. Upon termination:

• Your access to the Service will be revoked
• Your Data will be available for export for 30 days
• After the export period, Your Data will be permanently deleted

15.2 By Us

We may suspend or terminate your access to the Service at any time if:

• You violate these Terms
• Your use poses a security risk to the Service or other users
• We are required to do so by law
• We discontinue the Service (with reasonable notice)

15.3 Effect of Termination

Upon termination, Sections 5 (data ownership), 6 (intellectual property), 10 (disclaimers), 11 (limitation of liability), 12 (indemnification), 13 (governing law), and 14 (dispute resolution) shall survive.

16. Modifications to Terms

We may modify these Terms at any time. When we make material changes:

• We will update the “Effective date” at the top
• We will notify you via email or in-app notification at least 30 days before the changes take effect
• Your continued use of the Service after the effective date constitutes acceptance

If you do not agree to the modified Terms, you must stop using the Service and terminate your account.

17. General Provisions

17.1 Entire Agreement

These Terms, together with the Privacy Policy, constitute the entire agreement between you and Creative Foresight regarding the Service.

17.2 Severability

If any provision of these Terms is found unenforceable, the remaining provisions remain in full force and effect.

17.3 Waiver

Our failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.

17.4 Assignment

You may not assign your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations without restriction.

17.5 Force Majeure

Neither party shall be liable for any failure or delay in performance due to circumstances beyond its reasonable control, including natural disasters, war, terrorism, pandemics, government actions, or failures of third-party infrastructure.

18. Contact

For questions about these Terms:

• Email: legal@creativeforesight.io
• Privacy matters: privacy@creativeforesight.io
• Security matters: security@creativeforesight.io
• Mail: 5830 E 2nd St, Ste 7000 #3778, Casper, WY 82609