Privacy policy

Effective November 10, 2026

Cosign is an app for asking friends for songs and putting each other on to music. It is run by Cosign LLC ("Cosign", "we"). Cosign is published on the App Store by its founder, Cole Justin Withers, for Cosign LLC. This policy says what we collect, why, who can see it, and how to delete it.

What we collect

• Your phone number. It's how you sign in. We verify it with a text message through Firebase Authentication (Google). We also keep a scrambled copy of it (a SHA-256 hash) so people who have your number in their contacts can find you on Cosign. They see your first name, username and photo, never your number.
• Your profile. Your first name and username, your open call and shelf if you add them, a profile photo if you add one, and your time zone, so Sunday notifications arrive at the right time where you live.
• Your birthday. Only to check that you're at least 13, and at least 16 to see Trending on Explore, post asks there, answer them or cosign answers there, answer Everyone asks from people who aren't your friends, or make share links. It's kept where only you and Cosign's servers can read it, and it's never shown to anyone.
• What you do in Cosign. Asks, answers, songs you put people on to, cosigns and passes, reactions, messages in threads and groups, your shelf, your friends, links you share, and anyone you block or report.
• Your contacts, only if you allow it. Your phone turns each number into a one-way code (a SHA-256 hash) and sends only those codes, so we can tell you which contacts are on Cosign. We don't store your contacts or the codes.
• Your device. A notification token so we can send the notifications you've turned on, and crash reports (device model, iOS version, app version and your account ID, never your name, number or email) through Firebase Crashlytics.
• People without the app. Someone who answers an ask from a Cosign link gives the first name they type, the song they pick and any note, and everyone the ask reaches can see them. Someone who opens a put-on link can mark it heard and cosign or pass, and the person who sent it sees that. The page keeps a random code in their browser so each browser answers or decides once, and we store only a scrambled version of it. Anyone who can see a web answer in the app can report it, the person who asked can remove it from their ask, and anyone can email us to have one removed.

What we don't do

We don't sell your data, show ads, or track you across other apps and websites.

Who sees what

• Anyone on Cosign can see your profile: your first name, username, photo, open call, shelf and record. Only your friends see your picks.
• Your time zone is saved with your profile. The app doesn't show it, but other people on Cosign could read it.
• Your invite link shows your username to anyone who opens it, no sign-in needed. It doesn't show your name or photo.
• An ask is seen by the people it goes to: the friends you asked, a group, or, if you're 16 or older and choose Everyone, everyone on Cosign. An Everyone ask stays visible to everyone on Cosign even if it comes off Explore. Cosign's own Sunday prompt goes to everyone, and its daily ask to everyone 16 and older, and anyone on Cosign can see the answers to both. Everyone an ask reaches can see every answer to it, yours included.
• When you cosign an answer on Explore or on Today's ask, anyone on Cosign can see that you cosigned it.
• When you cosign an answer to your own ask, everyone the ask reaches can see which answers you cosigned.
• Share links are for people 16 and older. If you share an ask's link, anyone with the link can see the ask and your first name, and answer it without the app. If you send a put-on as a link, anyone with the link can see your first name, what you sent and your note.
• When a friend cosigns something you put them on to, it shows on Home for your friends and theirs, with your pick and your note. You can take it off Home from the put-on.
• When you put someone on to a song, or cosign one, you join that song's path. A path shows who started the song, who it was sent to, and who passed it to whom, and anyone on Cosign can see it. So can your Called early receipts, which include the first names of the people you put on.
• Group messages stay in the group. Songs you send in a group, and your answers to group asks, show in your picks with the group's name, so your friends can see them even if they aren't in the group.
• A pass stays between you and the person who sent the song: whoever put you on to it, or whoever answered your ask. Nobody else sees it.
• Your phone number and birthday are never shown to anyone.

Companies that help run Cosign

• Google Firebase stores our data, runs sign-in, notifications, photos and crash reports, and checks that requests come from the real Cosign app (App Check, using Apple's DeviceCheck). Our servers keep short-term logs, including IP addresses, for up to 30 days to keep Cosign running and secure.
• Apple (the Apple Music API and iTunes Search API) and Deezer supply song details, cover art and 30-second previews. What you type in search goes to them, and covers and previews load from their servers.
• Musixmatch supplies lyrics. When lyrics are on screen, the app lets Musixmatch know they were shown, as their license requires.
• Spotify, Apple Music and YouTube. When you paste a Spotify, Apple Music or YouTube link, Cosign looks the song up with that service. Apple Music, Spotify and YouTube open when you choose to play a song there, and their own privacy policies apply.

Keeping and deleting your data

We keep your data while you have an account. You can delete your account any time in Settings, under Delete account. That removes:

• your profile, photo, username and sign-in, and the scrambled copy of your phone number
• your friendships, and the people you blocked
• your asks and every answer to them, your answers to other people's asks, including where they show on Explore, and your cosigns on other people's answers
• the songs you sent and received, and the put-on links you sent, with what visitors did on them
• your threads, your messages in groups, your group memberships and your record in each group
• feed posts you're in, and your comments and reactions
• the notifications about you in other people's Activity
• the paths of songs you started, your place on everyone else's paths, your Called early receipts, and your first name on other people's

Reports you filed, and reports about you, are kept so we can review them and keep Cosign safe. Other people keep their own picks, so a song someone sent you, or an answer someone gave to your ask, can still show your first name in their picks. Crash reports expire on their own after 90 days, and server logs within 30 days.

Children

Cosign is for people 13 and older. If someone gives the app a birthday under 13, the app deletes their sign-in, or their account, right away. If we learn in any other way that someone under 13 has an account, we delete it. You need to be 16 or older to see Trending on Explore, post asks there, answer them or cosign answers there, answer Everyone asks from people who aren't your friends, or make share links.

Your choices and rights

You can change your name, username and photo in Settings, turn each kind of notification on or off, and delete your account. Depending on where you live, you may also have the right to ask for a copy of your data or to have it corrected or deleted. Email us and we'll help.

Security

Data travels encrypted, and our database rules limit each person to what they're allowed to see.

Changes

If we change this policy in a way that matters, we'll post the new version here and update the date at the top before it takes effect, and we may also let you know in the app.

Contact

Questions or requests: thecosignapp@gmail.com.