Privacy Notice
Last updated 3 August 2026
Draft pending legal review. This notice accurately describes what the service does today. It has not yet been reviewed by qualified counsel, and the operating entity and governing jurisdiction are not yet settled.
ComeAndGo creates temporary workspaces that delete themselves. This notice explains exactly what we hold, for how long, and what we cannot recover even if asked.
Who we are
ComeAndGo is operated by [LEGAL ENTITY], registered in [JURISDICTION]. For privacy questions, contact privacy@comeandgo.app.
What we hold, and for how long
| Data | Kept for | How |
|---|---|---|
| Messages and display names | The workspace's lifetime only | Encrypted. See "How deletion works" below. |
| A salted, non-reversible hash of your IP address | Up to 30 days | Used only to rate-limit workspace creation and abuse reports. We do not store raw IP addresses. |
| Workspace metadata — that a workspace existed, when it was created and destroyed, how many people joined, how many messages were sent | Up to 90 days, then aggregated | Counts and timestamps only. It contains no message content, no names, and nothing that identifies a person. |
| Abuse reports and the preserved copy of a reported workspace | 90 days | See "When we preserve content" below. This is the one exception to automatic deletion. |
What we never collect
- No accounts, no email addresses, no phone numbers.
- No cookies and no advertising or third-party analytics trackers.
- No profile of you across workspaces. Two workspaces you use are not linked to each other by us.
How deletion works
Each workspace is encrypted with its own key, which is stored separately from the content and on a system with no restore capability. When the timer ends, that key is destroyed. Everything encrypted with it — including every backup copy anywhere in our infrastructure — becomes permanently unreadable at that moment.
This means we cannot recover a destroyed workspace. Not for you, not for ourselves, and not in response to a legal request. We designed it this way deliberately, and we verified it by testing recovery against our own production systems and confirming it fails.
What we cannot control: screenshots, copies, or notes made by other people in the workspace, and anything they paste elsewhere. Deletion applies to our systems, not to other people's devices or memories.
When we preserve content
If someone files an abuse report about a workspace, we take a copy of that workspace's contents and keep it for up to 90 days so it can be reviewed and, where the law requires, reported to the relevant authorities. That copy is not destroyed when the timer ends. The report form says so before you submit it.
Preserved copies are encrypted with a separate key, access is restricted, and every access is logged. This is the only circumstance in which workspace content outlives its workspace.
A technical caveat we would rather state than hide: our database provider retains point-in-time snapshots for up to 30 days, so a preserved report we delete may persist in those snapshots for up to 30 days after deletion.
The link is the key
A workspace link contains a secret in the part after the #.
Web browsers never transmit that part to any server, so we never receive
it and it does not appear in our logs. The consequence is that
anyone who has the full link can enter the workspace.
Share it only with people you intend to include.
Who processes data on our behalf
The service runs entirely on Cloudflare, which provides our compute, storage, bot protection, and AI. Content used to generate a workspace summary is processed by Cloudflare's AI service and, per Cloudflare's published policy, is not used to train any model. Your content is not sent to any other AI provider.
Your rights
Depending on where you live, you may have rights to access, correct, or erase personal data about you, and to complain to a supervisory authority.
In practice: workspace content is erased automatically, and for the limited data we do retain we hold no identifier that would let us connect it to you. Because we deliberately cannot identify you, we may be unable to act on a request without additional information that links you to specific data. We are not asking you to provide it.
Children
ComeAndGo is not intended for anyone under 16. We do not knowingly process data from children.
Changes
If we change what we retain or for how long, we will update this page and change the date at the top.