Privacy & Your Data
Plainly: what is kept, where, and what leaves the device
The short version
Everything a staff member types about a resident stays in the browser on the computer where it was typed. Cognicopia has no server, no account and no cloud copy of it. No resident data leaves the device.
This page says what is kept, how it is protected, what does travel over the internet and why, and what the software does not do. It describes how the software works as of October 13, 2026. It is not legal advice, and a facility's own policies and counsel decide how any software fits its program.
What is kept on your computer
The tools keep what you give them so your work is there the next time you open the page. All of it stays in this browser, on this computer.
| Kept | What it holds |
|---|---|
| Resident profiles | Names the resident goes by, interests, work and hometown, and the support level chosen. Encrypted. |
| Drafts and the packet queue | The profile form and the packet form in progress, the Packet Builder's queue, planner and journal forms, and settings. Encrypted. |
| Session notes and memories | Session notes, Memory Digest entries and reminiscence responses. Photos of finished pages are kept in a separate encrypted photo store. Encrypted. |
| The Facility Portal | Wings, groups, the team, an audit trail and each wing's calendar. Packets and files from the portal carry group names only. Encrypted. |
| The Shift board | Handoff notes and staff tasks. Residents appear by alias or room only, and the board checks for names. Notes older than the chosen number of days are removed. Encrypted. |
| The Academy | Learners (staff names and roles), lesson progress, quiz scores and certificate numbers. Encrypted. |
| Settings that hold nothing about a resident | The free-packet count (one whole number, kept in three places in your browser so that clearing one does not return the free packets; it is not an identifier and is never sent anywhere), layout choices, a license key (a business name, the plan and two dates), and reading preferences. These are kept as ordinary browser storage on purpose, because they name no resident. |
How it is protected
- Encryption. Records are sealed with AES-256-GCM using the browser's own cryptography. Every save uses a fresh random value, and a record that is changed or moved will not open.
- The key. By default the key is one the browser keeps and page scripts cannot read. That protects against copying the storage files without the browser profile. Anyone who can open this browser on this computer can still open the records.
- An optional passphrase. Set one in the Packet Builder's Settings and the key is kept only wrapped by a key made from the passphrase (PBKDF2 with SHA-256, 600,000 rounds). Lock now forgets the key on this computer and reloads open pages. A forgotten passphrase cannot be recovered by anyone, including us.
- Aliases. With aliases on, residents appear as "Resident 302-B" in lists and pickers, and file names and print titles can use the alias too.
- Files you make. A
.cognicopiabackup or handoff file is locked with a passphrase you choose for that file. PDFs are saved wherever you choose. Cognicopia keeps no copy of either.
What travels over the internet
The packet tools make no network request of their own. Our build fails if one does. Three things still involve the network, and none of them carries resident information:
| What | What happens |
|---|---|
| Loading the pages | The pages and fonts are files served by GitHub Pages. As the host, GitHub receives the ordinary information any web server receives when a page is requested, such as an IP address and browser type, under GitHub's own policies. We do not receive it. The pages load no outside scripts, fonts, trackers or analytics. |
| Buying | A card payment, when you choose it, is handled by Stripe, and we never see the card number. The one page that may contact a service is activate.html. It sends only the Stripe checkout reference, and only after a card purchase, to a small license service, to exchange it for a license key. That service also emails the key to the address given at checkout; to do that it reads the buyer's email address and business name from the payment record, never anything about a resident. Keys can also be issued by email, for an invoice. |
| Writing to us | The contact links open your own email program with a message filled in. Nothing is sent until you send it. |
After the first load, the tools make and print packets on the computer, so a network that blocks other sites does not stop printing.
What we do not do
- We do not collect resident information, and we cannot see what is kept on your computers.
- We do not run analytics, advertising or tracking, and the tools set no cookies.
- We do not sell or share information about anyone.
- We do not make a facility compliant with anything. HIPAA, state rules and CMS requirements are met by a facility's own program. Because the software keeps resident details on the device, it supports a facility's privacy practices. Whether a particular use needs a business associate agreement is a question for the facility's counsel; we do not receive protected health information, so we do not ask facilities to send us any.
Your part, and the limits
- Back up. There is no second copy to restore from. Make a locked backup from the Resident Profiles page and keep it where your facility keeps its records.
- Shared computers. Use a separate browser profile per person where you can, set a passphrase, and choose Lock now at the end of a shift.
- Removing data. Clearing this site's data in the browser removes everything the tools stored on that computer. The Academy also has its own button to remove its records.
- Questions. If you find something here that does not match what you see, tell us at cognicopia@outlook.com. For how the encryption was checked and what else a facility's security team may ask, see Security and vendor questions.