Coszu
Privacy Policy
How Coszu handles account, local browser, AI, gallery, support, payment and optional advertising data.
Effective / updated: October 13, 2026
1. Scope and responsible operator
This policy describes personal-data processing associated with Coszu at https://coszu.com, including cosplayers’s names, likenesses and public cosplay metadata where present. Coszu is the service name; the repository does not establish a separately verified controller legal name, postal address, DPO or representative. Those required identity and contact disclosures must be confirmed by the operator before a regulated launch. Feedback is the current electronic contact route, including a public notice form without sign-in.
This policy distinguishes browser-local features from requests actually sent to servers. A local selection or draft is not automatically a cloud upload. The policy does not certify universal GDPR compliance or that every item in a public gallery has been independently verified. Other websites reached through links have their own privacy practices.
2. Accounts, authentication and security data
Account operation involves information you provide when registering or signing in, account identifiers, authentication records, session state and security-related requests. The browser uses HttpOnly session cookies and CSRF protections for authenticated actions. The server receives technical request data needed to route and secure these actions. Never send passwords through a support message.
Purposes include providing the requested account service, controlling access, preventing abuse and addressing security incidents. Depending on the activity and applicable law, processing may be necessary for a contract, a legal obligation or proportionate legitimate security interests. Those bases do not turn optional advertising into essential account processing.
3. Local preferences, favorites and histories
Language choices, favorites, viewed items, local conversation history, personas and other supported preferences may be stored in product-namespaced localStorage or browser databases. Create reference images and drafts are held locally in the current implementation. Browser profiles, shared devices and browser extensions can affect confidentiality. Clearing a site’s data may remove these items without deleting a server account.
Local data is used to provide the feature you request, such as remembering a selection or resuming a draft. Optional advertising choices are separate from these controls. Persistent browser caches, IndexedDB and PWA storage may retain application resources for repeat or offline use; see Cookies for storage details and clearing instructions.
4. AI requests and conversations
When you request an AI reply, the necessary prompt, conversation context and persona information are sent to Coszu’s service and its AI processing infrastructure. The current server integration uses DeepSeek through Runware. Local history storage does not mean no request leaves the device, and it does not establish a persistent raw-chat database. Do not include private third-party information, medical records or identity documents in prompts.
AI processing serves the conversation you request and supports service security. Generated text is simulated and does not speak for the cosplayer. Coszu does not deliberately send private chat contents, private Upload submissions or browser-local Create reference images to advertising partners as part of the advertising integration. This does not prevent a linked external service from processing information you independently provide there.
5. Public galleries, names and likenesses
Public gallery pages may expose images, videos, names, credits, tags, character or source-work associations and other descriptions. Search engines, visitors and third-party archives may retain public information. A correction or removal from Coszu cannot guarantee deletion of every independent copy. Do not assume metadata identifies a verified model or that a public credit establishes consent.
Publication and handling of disputes can involve copyright, publicity, privacy and data-protection rights simultaneously. A lawful basis for processing an image does not automatically establish the separate right to distribute a photograph or intimate content. Use gallery Report or Feedback to identify disputed material and the rights involved; see DMCA for copyright-specific information.
6. Private media submissions
Upload transmits selected media, original filenames, gallery title, performer/creator and character names, source, description, adult-content flag and consent declarations. Private server files and a metadata manifest record your authenticated account association, UTC receipt time and pending-review ID. Access is restricted to authorized manual reviewers; submissions have no public URL and do not enter the public catalog automatically.
Submissions are retained while needed for manual review, handling rights or removal requests and applicable legal duties, then should be removed when no longer needed. There is no automatic deletion schedule. Use Feedback with your submission ID to request removal or ask about stored data. Restricted filesystem permissions protect private storage; this is separate from Create reference images that remain in your browser.
7. Reports, contact and attachments
Feedback and gallery reports send the information you deliberately enter, relevant account/request context and any supported contact attachment you choose to send. Contact attachments are a distinct intentional transmission, unlike local Create references. Include enough information to identify the issue and requested action, while avoiding passwords, private keys, unnecessary ID scans or illegal imagery.
Data may be used to investigate a concern, communicate about an account or payment, address rights claims and comply with lawful requests. Feedback offers a public notice form without sign-in using the existing optional-authentication message endpoint. Signed-in support may also send attachments. Coszu does not promise a response SLA or completed appeals system; delivery configuration and legally sufficient notice handling require operational verification.
8. Payments and transaction records
The configured checkout integration uses NOWPayments for cryptocurrency payment instructions and status. Coszu’s server handles order references, account association, selected plan, network, currency and amount, provider payment identifiers and status, and premium entitlement. Payment providers receive information needed to process the transaction and apply their own policies. Blockchain transactions may be publicly observable and are not erased by deleting a browser profile.
Processing supports order fulfillment, reconciliation, fraud prevention and applicable accounting or legal duties. A browser redirect does not verify payment. Do not send full payment credentials or wallet secrets to Coszu; support normally needs the order reference and a description of the problem.
9. Server logs and service infrastructure
Requests can reveal IP address, browser/request headers, time, route, error state and operational metadata to hosting, delivery and security infrastructure. These data support delivery, incident response, abuse prevention and reliability. Logs and diagnostic records are different from a claim that all raw conversations or selected files are stored.
Access should be limited to authorized operational needs. Specific hosting locations, processor contracts and fixed log-retention periods are not verified by this policy. Avoid placing sensitive personal information in URLs or public metadata. Contact messages are delivered through the configured Telegram support integration. Required deployment disclosures must be based on actual hosting and provider arrangements.
10. Optional advertising partners
When a dedicated Coszu spot is configured, and only after advertising consent and adult acknowledgement, TrafficStars Ltd may receive IP addresses, device/browser information, cookies or identifiers and ad-interaction information for ad delivery, personalization, frequency control and measurement. Advertisers and their service providers may also use tracking technologies. The same optional advertising permission applies to configured partners; non-essential cookies and identifiers may be used as described in their policies. No active Google Analytics measurement ID is configured for Coszu by default.
Reject non-essential prevents the Coszu ad SDK from loading. Age confirmation, navigation, inactivity and accepting Terms do not grant advertising permission. Read the TrafficStars and Kadam privacy policies linked on Cookies; their published website policies do not establish every downstream advertiser’s processing or retention. Vendor and deployment-specific disclosures require operator review.
11. Recipients and disclosures
Data recipients can include hosting and content-delivery providers, authentication and operational infrastructure, AI processing services for requested conversations, payment services for orders, and authorized people handling support and legal issues. Configured advertising partners and downstream advertising services receive relevant data only when enabled with permission. Public gallery information is available to visitors and search engines by its nature.
Disclosure may also be required by a valid legal process, a child-safety obligation or the establishment or defense of legal claims. Information should be limited to the legitimate purpose and recipient. This policy does not promise no advertising sharing when ads are active or assert provider contracts that have not been verified.
12. International processing and safeguards
Internet hosting, AI, payment and advertising services may process information in countries other than yours. Applicable rules may require an adequacy decision, contractual safeguards or another lawful transfer mechanism. The operator must verify actual recipients, destinations and safeguards and provide any required information; this page does not claim completed transfer assessments or blanket protection in every territory.
Ask through Feedback for information relevant to your request. Where applicable, you may request details of safeguards or complain to a competent supervisory authority. Do not treat the mere presence of a provider privacy link as proof that Coszu has completed its own contractual obligations.
13. Retention, deletion and security
Local data generally persists until you remove it, clear browser storage or the browser evicts it. Server-held account, payment, support and security data have different purposes and may be retained as needed for service operation, applicable law, dispute resolution or legitimate security needs. No unverified fixed retention period is promised. Legal preservation may limit immediate deletion of particular records.
Use available local controls for local history and drafts; request server-side access, correction or deletion separately. Removing an account does not necessarily remove a public gallery, a blockchain record, an independent archive or a backup immediately. No security measure guarantees complete protection; protect your device, session and credentials and report suspected exposure.
14. Your rights and privacy preferences
Depending on your location and the legal basis, you may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent, and a right to complain to a regulator. Send the relevant page, account or order reference and the right you wish to exercise through Feedback. Appropriate identity checks may be needed to avoid disclosure to the wrong person; no unverified deadline or automated deletion process is promised here.
Advertising permission can be changed directly through Privacy choices or Manage privacy choices on Cookies. Withdrawal stops new SDK loads and clears active provider execution by reloading when necessary; it does not retroactively invalidate lawful prior processing or delete third-party cookies outside Coszu’s control. Browser/provider controls and direct provider requests may also be needed.
15. Minors, sensitive matters and updates
Coszu is intended for adults and prohibits content depicting minors. If you believe a child’s information or abusive imagery is present, identify the exact URL and safety concern through reporting; do not redistribute the imagery. Where a person is in immediate danger, contact appropriate emergency or child-protection authorities rather than relying on a support form as an emergency service.
This policy is dated above and should be updated when actual processing changes. Operator identity, reliable public-notice delivery and handling, provider arrangements, performer rights and jurisdiction-specific duties remain matters for operational and legal confirmation. Related Terms, Acceptable Use, Cookies, DMCA and performer-safety information are linked here.