Privacy Policy
Version 1.3. Effective October 7, 2026. Version 1.2, effective August 25, 2026, applies until then. The change adds the Butter Health list.
Cozy Butter is operated by Cozy Butter LLC, an independent company co-founded by Kim Carlos of The Plus SideZ Podcast and Amanda Bonello of the GLP-1 Studio. Cozy Butter LLC is the business responsible for the information described here.
The short version. We collect what we need to run a community. We do not sell your personal information and we do not sell your health data. We do not put advertising or social media trackers on our site or in the community. We may publish and license insights built from aggregated, de-identified information, and you can switch that off for your account at any time. You can ask us to delete everything, and we will.
This policy covers cozybutter.com, the community at community.cozybutter.com, our free tools at cozybutter-tools.pages.dev, and our email to you. Where consumer health data is concerned, our Consumer Health Data Privacy Policy controls.
1. What we collect, where it comes from, and why
| Category | Examples | Source | Why we have it |
|---|---|---|---|
| Identifiers and account details | Email address, member name, profile photo, password (stored hashed by Circle), account ID | You | To create and secure your account, and to contact you about the Service |
| Content you share | Posts, comments, direct messages, reactions, event RSVPs, questions to a coach, chat during a live session | You | To host and display it in the community and, for posts in open spaces, to the public, as you asked us to |
| Sensitive information, including health information | Anything you choose to say about your weight, medication, side effects, diagnoses, or mental health | You | To host and display it. See the Consumer Health Data Privacy Policy |
| Participation records | Which sessions you registered for or attended, and recordings of sessions you appear in | You, and our event platform | To run programs, send reminders you asked for, and provide replays |
| Payment information | Billing name, last four digits, expiry, country, transaction history | Stripe. We do not receive your full card number | To take payment, prevent fraud, and keep tax records |
| Technical and usage data | IP address, approximate region derived from it, device and browser type, pages viewed, dates and times, error logs | Automatically, through the platforms below | Security, fraud and abuse prevention, and keeping the Service working |
| Communications with us | Emails, support requests, reports about another member | You | To answer you and to enforce our rules |
| Cookie and consent choices | Your analytics, marketing, and do-not-sell settings, and when you made them | You | To honor your choices and to show we honored them |
What we do not collect. We do not collect precise geolocation, biometric or genetic data, government identification numbers, immigration status, union membership, or the contents of your communications outside the Service. We do not buy personal information about you from data brokers, and we do not build advertising profiles.
Our tools. The protein, hydration, medication, and side effect tools run entirely in your browser. What you type into them is not sent to us and is not stored on a server.
2. How we use your information
- To operate the community, run programs and live sessions, and provide replays.
- To process purchases and keep the records the tax and accounting rules require.
- To send service messages, and to send newsletters or program announcements you have asked for. You can unsubscribe from marketing email at any time using the link in it, and you will still receive service messages about your account.
- To answer your questions and provide support.
- To keep the Service safe, including preventing spam, fraud, harassment, and unauthorized access, and to enforce our Terms of Service and Community Guidelines.
- To understand which pages and resources are useful, using aggregate counts rather than profiles of individuals.
- To produce aggregated, de-identified insights, as described in Section 6.
- To comply with the law and to establish or defend legal claims.
We do not use your information for purposes unrelated to Cozy Butter, and we will ask for your consent before using it for a materially different purpose than the one it was collected for.
No automated decisions. We do not use automated processing or profiling to make decisions that produce legal or similarly significant effects about you, and we do not use AI to decide anything about your membership. See our AI Policy.
3. Who we share it with
We share personal information only with the categories of recipients below, and only for the reasons given. We do not share it with advertisers, ad networks, data brokers, or social media platforms.
| Recipient | Role | What they receive |
|---|---|---|
| Circle Media, Inc. | Hosts the community | Account details, content, messages, participation records, technical data |
| Cloudflare, Inc. | Hosts and protects cozybutter.com and our tools | Technical data, including IP address |
| Stripe, Inc. | Processes payments | Billing and transaction data. Stripe acts as an independent controller for fraud prevention |
| Google LLC (Google Workspace) | Our email accounts and internal files, on a workspace administered by GLP-1 Studio LLC | Email you send us and our replies. That workspace is covered by a business associate agreement between Google and GLP-1 Studio LLC, and Workspace content is not used to train Google's general AI models |
| GLP-1 Studio LLC | Administers our email accounts, file storage, and business phone number | Administrative access to email you send us and to files we keep. Limited by written agreement to running these systems for Cozy Butter |
| Resend, Inc. | Delivers automated email | Your email address and the message content |
| Google Fonts | Serves the typefaces on our pages | Your IP address, when your browser requests a font |
| Anthropic PBC and OpenAI, L.L.C. | AI assistance for drafting our own content and artwork | Only what our team types or pastes, under settings that exclude the content from model training. Member posts and member personal information are not sent to these tools. See our AI Policy |
| Professional advisers | Accountants, insurers, and lawyers | Only what a specific matter requires, under a duty of confidentiality |
These companies act as our service providers or processors. They are contractually limited to using the information to provide their service to us, and they may not use it for their own purposes or sell it.
Other members, and the public. The community is public. Anything you post in an open space is visible to anyone on the internet without an account, including your member name and anything you say about your health, and search engines may index it. Spaces marked members-only, including our resource library, are visible to signed-in members, and direct messages are visible to the people in them. Our rules forbid members from republishing what other members share and we enforce that, but people who read the open spaces without joining are not bound by our member rules, and we cannot guarantee every reader's behavior. Please treat anything you post in an open space as public, and share only what you are comfortable sharing.
Legal disclosures. We may disclose information if we are required to by law, a subpoena, or a court order, or where we believe in good faith that disclosure is necessary to protect someone from serious harm, to investigate fraud, or to establish or defend a legal claim. Where the law allows it, we will tell you first so you have a chance to object, and we will narrow what we hand over.
Business transfers. If Cozy Butter LLC is involved in a merger, an acquisition, a financing, a reorganization, or a sale of all or part of its business or assets, personal information may be transferred as part of that transaction, including during due diligence under a confidentiality agreement. Any successor will be bound to honor this policy for information collected before the transfer, or will give you notice and a choice before applying a materially different policy. We will post a notice here and inside the community if such a transfer happens.
Shared administration. Cozy Butter LLC is a small company and does not run all of its own back-office systems. Some of them are provided by companies our co-founders own. Today that is GLP-1 Studio LLC, owned by co-founder Amanda Bonello, which provides and administers our email accounts, our internal file storage, and our business phone number. Plus SideZ Media LLC, owned by co-founder Kim Carlos, does not currently run any system that holds your information. If either company begins providing a system that does, we will update the list above and tell you.
Administrators at a company providing that support can technically reach what is stored in the systems they run, including email you send us. Under a written agreement they may use that access only to keep those systems running for Cozy Butter. They may not use your information for their own products, marketing, or mailing lists, they may not disclose it onward, and we do not sell it to them.
Other affiliated companies. If we ever want to share your personal information with an affiliated company for any purpose beyond the administration described above, we will update this policy and tell you before we do.
4. Where your information is stored, and international transfers
Our providers store data primarily in the United States, and some of them, including Cloudflare, operate globally and may process technical data at a location near you. If you use the Service from outside the United States, your information will be transferred to and stored in the United States, which may have different privacy protections than your country. The Service is directed to residents of the United States.
5. Security
We use administrative, technical, and physical safeguards appropriate to the size of our operation and the sensitivity of the information. These include encryption in transit for every page and every request, encryption at rest by our providers, multi-factor authentication on administrative accounts, access limited to the small number of people who need it, and providers chosen for their published security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If something goes wrong. If we learn of a breach affecting your personal information or your health information, we will notify you and the appropriate authorities as the law requires, including under state breach notification laws and the Federal Trade Commission's Health Breach Notification Rule where it applies. We will tell you what happened, what information was involved, and what you can do.
6. Selling, sharing, and aggregated insights
We do not sell your personal information, and we do not sell or share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We do not sell consumer health data, and we would not do so without first obtaining a separate written authorization from you that meets the requirements of applicable law, which you could revoke at any time.
Aggregated and de-identified insights. Part of how we intend to support this work is by publishing and licensing insights about what people on GLP-1 medications experience, built from information that has been aggregated and de-identified. An example would be the share of members who report a particular side effect in their first month, expressed as a percentage across hundreds of people. We hold ourselves to the following, and these are commitments, not aspirations:
- We remove direct and indirect identifiers before analysis, applying the eighteen-identifier standard used for de-identification under the HIPAA Safe Harbor method as our floor, whether or not HIPAA applies to us.
- We suppress small cells. No figure is published or licensed if it is derived from fewer than eleven people, because small groups can be re-identified.
- We do not include verbatim member posts, quotations, photographs, member names, or free-text answers in any licensed or published dataset.
- We publicly commit to maintaining and using this data only in de-identified form. We do not attempt to re-identify it, and we do not combine it with other datasets in a way that could re-identify anyone.
- We contractually require every recipient to do the same, to refrain from re-identification and onward sale, and to accept our audit rights.
- We do not license data to advertisers or data brokers, and we do not license information that could identify a member to anyone.
Your switch. If you turn on Do not sell or share my personal information in your privacy choices, we will exclude data derived from your account from these insights entirely, even in de-identified form. We also honor the Global Privacy Control signal from your browser automatically, and treat it as turning that switch on. If you join the Butter Health list, the answers you give through it are covered by the agreement you accept when you join, which is your separate choice to take part in insights. Your switch still applies to everything else, and you can leave the list at any time by emailing [email protected].
7. Cookies and similar technologies
We use cookies and similar technologies in four categories:
- Essential. Required for signing in, security, load balancing, and remembering your privacy choices. These are always on, because the Service does not work without them. Circle's sign-in cookie and Cloudflare's security cookie are in this category.
- Analytics. Help us count how often a page or resource is used. Off unless you turn them on. The one exception is Cloudflare Web Analytics on cozybutter.com, the community, and our tools, which sets no cookies and identifies no one, so it runs without a choice from you. See Amendments.
- Marketing. Used only for clearly disclosed sponsored content. Off unless you turn them on. None are running today.
- Set by the Circle platform. The community runs on Circle, and Circle sets its own first-party cookies there, including a product analytics cookie that Circle uses to run and measure its platform. These are set by Circle rather than by us and are not controlled by our banner. Circle describes them in its own privacy policy. If you would rather not have them, you can block or clear cookies for community.cozybutter.com in your browser, with the trade-off that signing in will not persist.
We do not use advertising pixels, social media pixels, session replay, or cross-site tracking anywhere on the Service, and we do not put any tracking technology on pages that show video.
A banner asks for your choices on your first visit. Rejecting optional cookies is as easy as accepting them, and nothing non-essential loads until you say yes. You can change your mind at any time through the Your privacy choices link in the footer, and the same choices apply on cozybutter.com, on our tools, and on the community.
8. How long we keep things
| What | How long |
|---|---|
| Account details and profile | While your account is open, then deleted within 30 days of your request or of account closure |
| Posts, comments, and messages | While your account is open, or until you delete them. Removed from view immediately on deletion, though content that was public may persist in search engine caches for a time |
| Backups containing deleted content | Overwritten on our providers' cycles, no longer than 90 days |
| Session recordings | Kept inside the community while the program runs, and reviewed at least once a year for removal |
| Payment and tax records | Seven years, because tax law requires it. This is a legal obligation and survives a deletion request |
| Security and access logs | Up to 12 months |
| Privacy requests and consent records | At least 24 months, because privacy law requires us to keep proof that we honored your choices |
9. Your rights and choices
Whatever state you live in, we extend the following to everyone who uses Cozy Butter, and we do not discriminate against you for using them.
- Know and access. Ask what we have collected about you, where it came from, why we have it, who we shared it with, and get a copy in a portable format.
- Correct. Fix information that is wrong.
- Delete. Have your account and personal information deleted, including from archived and backup systems. Some records, such as tax records, must be kept, and we will tell you which.
- Opt out of sale, sharing, targeted advertising, and profiling. Use the privacy choices link, or send a Global Privacy Control signal.
- Limit the use of sensitive information. Tell us to use your health information only for providing the Service.
- Withdraw consent at any time, including consent to our collection and sharing of your health information.
- Appeal. If we decline a request, reply with the word "appeal" and we will review it and answer in writing within 45 days. If your appeal is denied, you may complain to your state attorney general.
How to make a request. Email [email protected] from the address on your account, or write to Cozy Butter LLC, 3800 Business Highway 151, #113, Marion, IA 52302. We verify a request by confirming you control the account email, and we may ask one additional question if the request is unusually sensitive. We answer within 45 days, extendable once by another 45 days where the request is complex, in which case we will tell you why. An authorized agent may make a request for you with your written permission, and we may ask you to confirm it directly.
California residents. Sections 1, 3, 6, and 8 give you the notice at collection, the categories of personal information and sensitive personal information collected and disclosed, the purposes, the sources, and the retention periods that the California Consumer Privacy Act requires. We disclosed the categories in Section 1 to the recipients in Section 3 for business purposes in the preceding twelve months. We sold and shared nothing. We collect and use sensitive personal information only to provide the Service, which means the right to limit its use does not require any further action from us, and you can still exercise it.
Washington and Nevada residents. Your rights over consumer health data, including the right to a list of every third party we have shared it with and an email address for each, are in the Consumer Health Data Privacy Policy.
Everyone else. If your state gives you a right we have not listed, tell us and we will honor it.
10. Email, text messages, and notifications
Service email, such as a password reset or a change to these policies, is part of having an account and cannot be turned off while the account is open. Marketing and program email carries an unsubscribe link and our postal address, and unsubscribing takes effect within ten business days. We do not send text messages today. If we ever do, it will be to a number you gave us for that purpose, with clear terms, and you will be able to stop them by replying STOP.
11. Children
Cozy Butter is for adults. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has an account, email [email protected] and we will close it and delete the information.
12. HIPAA, and what this policy is not
Cozy Butter LLC is not a HIPAA covered entity and is not acting as a business associate of one. Information you post in the community is not protected health information under HIPAA, and it is not protected by the doctor-patient privilege. Our providers hold agreements appropriate to the information they handle for us. The Google Workspace that holds our email is administered by GLP-1 Studio LLC under a business associate agreement with Google, so the records kept there are handled to a healthcare standard. Having that agreement does not make Cozy Butter a healthcare provider, and it does not make your posts protected health information.
13. Other sites
We link to research, prescribing information, and news from other organizations. Those sites have their own policies, and we are not responsible for them.
14. Changes to this policy
We may update this policy. Material changes will be posted here with a new version number and date, and we will give notice inside the community or by email at least 14 days before they take effect. We will not apply a materially different practice to information we already hold without asking you first.
Amendments
Changes made after a version takes effect are listed here, newest first.
October 13, 2026 (announced September 29, 2026). Polls, surveys and insights. From October 13, results from polls and surveys in the community may be used in reports and insights that we publish, share or sell. Reports and insights contain only totals and percentages. They do not include your name, email address, username, photo, the words you wrote, or anything else that identifies you, and no figure comes from fewer than eleven people. You are counted, not named. If you do not want your answer used, do not answer that poll. We use only polls posted on or after October 13 this way. Polls or surveys that ask about your health are covered by a separate consent at the time you answer. We may license reports and insights to any company, including brands that advertise with us. We do not sell, license or share information that identifies a member with anyone. When we license a dataset, rather than a finished report, we contractually require the recipient to refrain from re-identification and onward sale and to accept our audit rights. The Do not sell or share switch and the Global Privacy Control signal continue to apply to optional cookies and to any sale or sharing of personal information. From that date, this replaces the paragraph “Your switch” in Section 6 and the summary sentence that you can switch insights off for your account; the sentence “We do not license data to advertisers or data brokers, and we do not license information that could identify a member to anyone” now reads “We do not license data to data brokers, and we do not sell, license or share information that identifies a member with anyone”; and the requirement placed on “every recipient” applies to datasets we license.
October 13, 2026 (announced September 29, 2026). Service providers. The companies named in the tables in this policy are examples of each category, and we may change providers within a category.
October 13, 2026 (announced September 29, 2026). AI tools and member content. From October 13, we use AI tools to help us run Cozy Butter, with things like organizing messages, posts, comments and emails that members send us, creating content, and more. We use AI providers under business terms. The AI providers named on this page are examples, and we may use others. From that date, this replaces the sentence “Member posts and member personal information are not sent to these tools” and the words “Only what our team types or pastes.” See our AI Policy.
October 13, 2026 (announced September 29, 2026). Circle's own tools. The community runs on Circle, and Circle may load its own analytics, error-reporting and similar tools on community.cozybutter.com to run and measure its platform. These are Circle's tools, not ours. They are governed by Circle's privacy policy and are not controlled by our banner. We do not add advertising pixels, social media pixels, session replay or cross-site tracking to the Service ourselves, and we do not add tracking technology to pages that show video. Your choices in our banner apply to what we add, and Circle's own tools may load on the community whatever you choose there. In our summary, “We do not put advertising or social media trackers on our site or in the community” now reads “We do not add advertising or social media trackers to our site or the community.” From that date, this replaces the sentence “We do not use advertising pixels, social media pixels, session replay, or cross-site tracking anywhere on the Service, and we do not put any tracking technology on pages that show video,” and, for the community, the statements that nothing non-essential loads until you say yes and that the same choices apply on the community.
September 29, 2026. Research studies and opportunities. Taking part in a study, research project, product test or other opportunity is your choice. Before you take part in one, or give any information for it, we explain it and ask you to agree to it separately. We tell you what it asks for, who is running it or, if that company asked to keep its name private, what kind of company it is, what information that company receives, how it will be used, and how to withdraw. If you agree, we share only what that opportunity needs with the company running it. This is an exception to the statements that we share information only with our service providers and that we do not share it with advertisers. A company kept private receives only results that do not identify you, unless you give your information to it directly, for example by filling in its screener. Nothing in this note applies to you unless you agree for that opportunity. You can ask us for a list of the companies that received your information.
September 29, 2026. Wording. We changed the word “never” to “do not” in a few sentences. What we do has not changed.
September 28, 2026. Anonymous quotes. With a member’s permission, we may quote something they wrote, such as a survey answer or a post, on our websites and in insight reports, without their name. We ask each person before we use their words, and we only use a quote if they say yes. We do not attach a name, photo, or any other detail that could identify them, and anyone can ask us to take their quote down at any time. This is an exception to the sentence “We do not include verbatim member posts, quotations, photographs, member names, or free-text answers in any licensed or published dataset.”
September 28, 2026. Visit counts. We now count visits to cozybutter.com, the community, and our tools with Cloudflare Web Analytics. It sets no cookies, does not identify you, and does not follow you to other sites. It tells us how many people viewed a page, not who they were. This replaces the sentence "We currently run no analytics of our own on cozybutter.com."
15. Contact
Privacy questions, requests, and complaints can go to [email protected], or by mail to Cozy Butter LLC, 3800 Business Highway 151, #113, Marion, IA 52302. If you need this policy in another format, ask and we will provide one.