What we hold about your family, and what happens to it.

Last written 2026-09-22 · approved by the owner 2026-09-22. Same text as inside the app.

Coparent holds a small amount of information about your family and uses it for one purpose: working out which Singapore government schemes apply to you, and when.

This page describes what is actually collected and what actually happens to it. Where something is not settled, it says so rather than covering it with general language.

What we collect

Your email address, to sign you in and to send you deadline reminders. Your name or the name you would like to be called, if you give one.

For each child: a given name, a date of birth or an estimated delivery date, birth order, and citizenship status.

About your household: marital status and, if you are married, the date; an income band, never an exact figure; whether each parent is employed, self-employed or not working; how many people live with you; and your postcode. We ask for the postcode and never the address — it is enough to work out school distances and what is near you, and a street and unit number would not be.

Five short answers you write yourself, during setup: who can help you, how the two of you divide things, how much time you each have, what a normal week looks like, and what you are most worried about getting wrong.

What you type to the assistant. Your side and its side are both kept, so the conversation makes sense when you come back to it, and so the assistant can learn a small number of durable facts about your family from it. You can read every fact it has learned, edit any of them, delete any of them, and clear the conversation, from the account screen.

If you use the journal: the entries you write, and the photographs you attach to them.

If you use receipts: the photographs of receipts you send in, and the merchant, amount, date and category read off them. You get a private email address for this, which you can change at any time.

The income question is optional. So is every one of the five setup questions, the journal, and receipts. Skipping any of them never blocks anything — a means-tested item is marked "verify" rather than guessed, and a question we have not asked is treated as unanswered rather than filled in with the most likely answer.

We still do not collect NRIC numbers, passport numbers, street addresses, phone numbers, bank or card details, or health records. If we ever need to, this page changes first.

Why we collect it

Every field is used to derive your timeline. A date of birth sets when each window opens and closes; birth order and citizenship decide which schemes apply and at what amount; marital status gates several of them.

We say why we need a date of birth on the screen where we ask for it, before the field appears — not only here.

We do not sell anything, we do not share your data with advertisers, and we do not build a profile of you for any purpose other than your own timeline.

How long we keep it

Your household is deleted on 31 December of the year your youngest child turns twelve, plus twelve months.

The twelve years is when the product stops being useful — Secondary 1 posting, the last thing on your child's timeline, completes in the year they turn twelve, and after that the timeline is empty. The extra twelve months exists because a parent who signs up at birth and returns eleven years later, when their child reaches that point, is the intended use of this product, not an edge case, and deleting on the day the last item expires would remove their data at exactly the moment they came back.

The deletion is automatic and runs whether or not you ask for it.

Your journal is the exception, and it is deliberate. Journal entries and the photographs attached to them are never deleted by that automatic sweep. A record of your child's first years is not the kind of thing that should disappear because a timer expired, and nothing about a benefits deadline justifies destroying it. Everything else about your household is still removed on schedule; what remains is the journal itself and an identifier with nothing attached to it, so the journal has something to belong to.

You can still delete your journal yourself, at any time, and doing so removes it completely. The exception is only to the automatic sweep, never to your own request.

If you stop using Coparent entirely, we delete your household after twelve months without a sign-in. We email you a month before that happens, to the address you signed in with, so that coming back is always an option you are offered rather than one you have to remember. Signing in resets the clock. Your journal is not deleted by this, for the same reason it is not deleted by the sweep above.

Deleting it yourself

You can delete everything from the account screen at any time. It is a hard delete: the rows are removed, not flagged. There is no "deleted" column in our database to be tempted by.

What survives is a single audit record that a household was deleted and when. It holds a random identifier that points at nothing once the rows are gone, and no child's name, date or identifier.

How it is protected

Dates of birth and estimated delivery dates are encrypted before they are stored, using AES-256-GCM with a key the database never sees. This is not required by the PDPA, but the PDPC has stated an expectation of a higher standard for children's data, and pre-implemented measures that make harm unlikely change what has to happen after a breach.

Every table enforces row-level security at the database, not in application code. A test signs in as one household and attempts to read another's records by direct identifier; both the read and the write are refused by the database itself.

Journal entries, the five setup answers, what the assistant has learned about your family, and the names of files you upload are encrypted the same way. Receipt amounts and dates are not, so that a total can be added up without decrypting every row one at a time; the merchant name is encrypted, because a clinic or a school can identify more than a number does.

Photographs are held in private storage that nothing can read without being signed in as your household — enforced by the storage service itself, not only by our code. We strip the hidden location data that phones attach to photographs before storing them, so a picture taken at home does not carry your home's coordinates.

Your private receipts address is a password in the shape of an email address: anyone who learns it could send into your account. We only accept mail from addresses on your own account, and you can change the address at any time from the account screen.

We do not put names, dates of birth or identifiers into logs, error reports or analytics.

Emails, and how to stop them

Deadline reminders tell you when something in your timeline is closing. They are the reason the product exists, and they are on by default. Every one carries an unsubscribe link that works without signing in, and you can also turn them off from the account screen.

Occasional emails about Coparent itself are a separate, optional choice, off unless you tick it. It is never a condition of using the product — making excessive consent a condition of service is a breach of the PDPA's Purpose Limitation Obligation, and we would rather not.

Where your data is held

Our database and our application both run in Singapore regions (ap-southeast-1 and sin1). Singapore has no data-localisation requirement, so this is a choice rather than an obligation — it simply removes a question that would otherwise need answering.

Our hosting providers are Vercel and Supabase, and their standard data processing agreements apply.

Coparent has an assistant you can ask questions. Your question is answered by an AI model hosted outside Singapore — the provider offers United States and European regions only, with no Asian region available. That is a cross-border transfer under the PDPA's Transfer Limitation Obligation, and this page says so before you type rather than after.

Your benefit timeline crosses in a stripped-down form: no date of birth, no identity number, no account id, and no row from our database. Your profile itself stays in Singapore and is never sent.

A child's given name does cross, so that you can ask about them by name instead of by birth order. It is the given name only — we hold no surname for a child, and there is no field for one — and it travels without the date of birth, which is encrypted here and never sent. A first name on its own is still information about your child, which is why it is written down on this page rather than left for you to discover.

Your calendar is different, in a way worth knowing before you point the assistant at it. If you ask the assistant about your calendar, those events cross the border with your question — the titles and any notes you have written on them. We do not strip that text, because it is the answer to your question rather than a detail attached to it. It is also the one part of Coparent you write freely, so it is the one part where what leaves the country is up to you: whatever you would not want processed overseas, do not put in an event you then ask about.

The same is true of anything else you point the assistant at. The five setup answers and the facts it has learned about your family are sent with your question, because they are what make the answer about you rather than about a stranger. Your journal and your receipts are NOT sent — they are not part of what the assistant reads, and if that ever changes, this page changes first.

The model provider is Anthropic, in the United States. Anthropic is a named subprocessor of our hosting provider, Vercel, listed for generative AI services, and the transfer is covered by Vercel's data processing addendum, which binds the chain to protections comparable to the PDPA. If you would rather nothing of yours left Singapore, do not use the assistant — every other part of Coparent runs here, and nothing else you do in it crosses a border.

If something goes wrong

We have a written breach procedure with a named decision-maker, and the reporting form bookmarked before we need it. The PDPA gives three calendar days to notify the Personal Data Protection Commission once a breach is judged notifiable, which is not enough time to work out who decides.

If a breach affects you and is likely to cause significant harm, we will tell you what was taken, when, what we have done, and what you should do — in the first sentence, not the fourth.

Who to contact

Our Data Protection Officer is Brian Chang, at brian.chang@coparent.sg. Write there about anything on this page — what we hold about you, a correction, a deletion, or a complaint. Under the PDPA we must respond, and we would rather hear it from you than from the Commission.

See also: Terms · Disclaimer. Questions: hello@coparent.sg.