Last updated: October 24, 2026
ContentOS helps you plan, write, and publish content in your own voice. To do that, we collect the information described below, use it to run and improve the Service, and share it only with the vendors that help us operate. We do not sell your personal data. We use your content to train and improve ContentOS’s own models - that is how voice learning works - but never to train general-purpose AI models for unrelated products, and our AI providers do not train on your data.
Drafting, voice matching, and related features send relevant content and instructions to third-party AI model providers, which process that data only to return results to you. These providers act as our processors: under their agreements with us they are not permitted to use your content for their own purposes, and they do not train their models on it.
We do use your content - your posts, drafts, edits and swipes, and content from accounts you connect - to train and improve ContentOS’s own models, including the voice model that writes in your style. That training is how the product learns you. It stays within ContentOS, and we never use your content to train general-purpose AI or machine learning models for unrelated products.
If you opt into our managed content pilot, our Glove operators may connect a third-party assistant, such as Grok Bot, to read the posts, calendar, voice brief and stored performance data in the client workspace you authorize. Access can be read-only or include delegated posting actions. With posting access, the person controlling the assistant can create, edit, schedule, cancel and publish content within the assigned permissions without a separate approval for each post. The assistant cannot access other workspaces, social credentials, account connection or outreach through this interface.
Separately authorized asset generation sends draft text and visual directions to configured generation providers, such as OpenAI, and uses Clayzo software to render graphics in our hosted environment. Generation counts toward the client's plan limits. Operators can prepare generated stills as public post media or download generated video files. Revoking assistant access does not recall public media URLs or costs already incurred by work in flight.
Before enrollment, we identify the assistant provider and explain the data it will receive and the privacy settings that apply to that pilot. This is separate from connecting an assistant yourself. We require your opt-in before providing managed assistant access; payment or an existing Glove assignment does not enroll you. Any later audience feature that shares additional engagement or relationship information requires a separate notice and authorization before it is enabled.
We record authorization and key-use metadata for security, including the operator, client workspace, key identifier, requested tool, time and outcome. Access logs exclude key secrets, tool arguments and returned content. You can withdraw from the pilot through support, and we will revoke its access. Revocation stops future access; it does not erase material already received by an assistant provider. Already committed schedules remain in Content OS; cancel those posts or pause the operator assignment to stop publication. A provider request already in flight cannot be recalled. The enrollment notice explains the applicable retention and deletion process before you consent.
We keep your information while your account is active and as needed to provide the Service. When you request deletion through Settings, we delete or de-identify personal data associated with your account within 45 days (or sooner where required), unless applicable law permits an extension, in which case we will tell you before that first deadline passes and finish within the extended period. This is subject to records we must retain for legal compliance, fraud prevention, dispute resolution, or legitimate business records the law allows us to keep. Deletion removes your content and account data from our systems; it does not undo training that has already happened - signals and improvements learned from your content before deletion may remain in the models that power the Service, and we do not retrain or rebuild models to remove them. Disconnecting a social account stops new data collection from that account immediately.
We use administrative, technical, and physical safeguards appropriate to the data we handle, including encryption in transit and encryption at rest for OAuth tokens where configured, and access controls limited to personnel who need it to operate the Service. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security - but if a breach affects your data, we will notify you as the law requires.
If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect, use, and disclose; to request access, correction, or deletion; and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CPRA; our analytics vendors act only as our service providers. To exercise any of these rights, submit a request through account Settings or email founder@trycos.ai from the address on your account.
If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. Our legal bases for processing are performing our contract with you, our legitimate interests in operating and improving the Service, your consent where requested, and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.
We are based in the United States and process data there. If you use the Service from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we rely on standard contractual clauses or equivalent approved safeguards for these transfers.
The Service is not directed to anyone under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.
We may update this policy as features evolve. We will post the updated policy on this page and revise the “Last updated” date. For material changes, we will provide prominent notice (and, where the law requires, obtain consent or offer an opt-out) before the changes apply. If you do not agree with an update, stop using the Service and delete your account.
Questions or requests about this policy: submit a support request through account Settings, or email founder@trycos.ai. You can also write to Chrysa, Inc., doing business as ContentOS, 24 Henry Pl, Millbrae, CA 94030.