Cookie & GDPR Consent Notice

Last updated: 2026-10-02 | Effective date: 2026-10-02

This notice explains the small set of cookies and similar browser-storage technologies Cobalt (app.cobalt.photos, marketing site cobalt.photos) uses, and our approach to consent. It supplements our Privacy Policy. Cobalt is operated by Jakub Ludwig, IČO 88711111, Czech Republic.

1. Our Approach

We keep browser storage to the minimum needed to run the Service securely. The items in Section 2 are strictly necessary for sign-in, security and remembering your cookie choice, so under the ePrivacy rules (Directive 2002/58/EC, as transposed in the Czech Republic by § 89 of Act No. 127/2005 Coll. on electronic communications) they are exempt from the consent requirement.

Advertising cookies are different: they are optional and off by default. We set them only after you accept them in our cookie banner (Section 3), and you can change your mind at any time through "Cookie settings" (Section 4).

Analytics. For analytics we use Umami, a privacy-friendly, cookieless analytics tool that we host ourselves (no third-party analytics processor). It sets no cookies, stores no information on your device, collects no personal data, and performs no cross-site tracking or profiling — only aggregate, anonymous usage counts (such as page views and referrer totals). Because it is cookieless and does not store or read information on your device, it does not require consent under the ePrivacy rules, and it keeps working the same way whatever you choose in the cookie banner.

2. Storage That Needs No Consent

Name / item	Type & where stored	Purpose	Duration	Category
`drift_token`	Authentication token in the browser's localStorage (not a cookie; same-origin only)	Keeps you signed in to the app after you sign in (with Google or with email and password), so each request can be authorised. It is not sent to third parties.	Persists until you sign out or clear it; the underlying token expires after the configured token lifetime (currently 7 days).	Strictly necessary
`drift_workspace`	Preference value in localStorage	Remembers which workspace you are currently acting in (e.g. a shared workspace you switched into).	Until changed or cleared.	Strictly necessary / preference
`drift_oauth_state`	Short-lived cookie; `httpOnly`, `SameSite=Lax`	Carries an anti-forgery (CSRF) nonce during the "Sign in with Google" redirect to protect the login flow.	Up to about 10 minutes; cleared as soon as sign-in completes.	Strictly necessary (security)
`cobalt_consent`	First-party cookie set by our cookie banner	Remembers whether you accepted or rejected advertising cookies, so we respect your choice and don't ask on every page.	6 months; then the banner asks again.	Strictly necessary
Cloudflare security tokens	Cookies/challenge tokens set by our CDN (Cloudflare) at the network edge	DDoS/bot protection and reliable content delivery.	As set by Cloudflare (typically short-lived).	Strictly necessary (security)
Umami analytics (self-hosted)	No cookie and no browser storage — Umami is cookieless and stores nothing on your device	Aggregate, anonymous usage analytics (e.g. page-view counts) to help us improve the Service. No personal data, no cross-site tracking.	Not stored on your device.	Analytics (cookieless — no consent required)

3. Advertising and Marketing Cookies (Only With Your Consent)

To measure our advertising, we may use advertising pixels from Meta (Facebook and Instagram), Google (Google Ads and Google Analytics 4), TikTok and Reddit on cobalt.photos and app.cobalt.photos. They load, and set or read the cookies below, only after you accept them in our cookie banner. If you reject them or don't make a choice, they don't load.

If you accept, they're used to:

measure conversions from our ad campaigns, such as sign-ups and plan purchases, and tell which ad or campaign led to them; and
build advertising audiences, for example to show Cobalt ads to people who visited our sites, to stop showing them to people who already signed up, or to reach people similar to our visitors.

Provider	Cookies (typical)	Purpose	Typical lifetime	Privacy policy
Meta Pixel (Facebook, Instagram) Meta Platforms Ireland Ltd.	`_fbp`; `_fbc` (only after you click a Meta ad)	Recognises your browser for ad conversion measurement and audiences; `_fbc` stores the Meta ad click id.	About 90 days, renewed when you return (approximate)	Meta Privacy Policy
Google Ads and Google Analytics 4 Google Ireland Ltd.	`_gcl_au`; `_gcl_aw` (after a Google ad click); `_ga`; `_ga_<ID>`	`_gcl_*`: ad click and conversion measurement. `_ga`, `_ga_<ID>`: tell visits apart to measure campaigns and conversions.	`_gcl_au`, `_gcl_aw`: 90 days; `_ga`, `_ga_<ID>`: 2 years	Google Privacy Policy; how Google uses data from partner sites
TikTok Pixel TikTok Technology Limited	`_ttp`; `ttclid` (after a TikTok ad click); `ttcsid`, `ttcsid_<ID>`	Recognises your browser and the TikTok ad click for conversion measurement and audiences.	13 months from last use	TikTok Privacy Policy (EEA)
Reddit Pixel Reddit, Inc.	`_rdt_uuid`	Recognises your browser for ad conversion measurement and audiences.	About 90 days (approximate)	Reddit Privacy Policy

Cookie names and lifetimes are set by each provider and can change. The Google and TikTok lifetimes are those published in the providers' own documentation (checked October 2026); those marked "approximate" are typical values, not a figure the provider guarantees. Some browsers (for example Safari) shorten them. Which of these providers is active at a given time depends on where we advertise.

Each provider processes this data under its own privacy policy, linked above, and may process it outside the EEA, notably in the United States. Depending on the provider and the purpose, a provider is a joint controller with us, an independent controller, or our processor; our Privacy Policy, Section 3.8, explains this and the legal basis (your consent).

You can change your mind at any time: click Cookie settings in the footer of any page to reopen the banner, then accept or reject advertising cookies. Rejecting later stops the pixels from loading from then on; it doesn't affect anything before. To remove advertising cookies that were already set, clear the cookies for cobalt.photos in your browser.

We remember your choice in the cobalt_consent cookie for 6 months. After that, or if you clear your cookies, the banner asks again.

Campaign parameters at sign-up (no cookie). If you reach our sign-up page from a link that carries campaign parameters (utm_*) or an ad click id (such as gclid, fbclid, ttclid or rdt_cid), the sign-up page saves the first set of these values with your new account, so we can see which campaigns bring sign-ups. No cookie is used for this: our marketing pages simply pass the values along in their links to the app. See our Privacy Policy, Section 3.9.

5. Managing Cookies and Browser Storage

You can clear cookies and local storage at any time through your browser settings, and you can sign out of Cobalt to clear the authentication token. Note that blocking strictly necessary items will prevent sign-in and stop the app from working.

6. Third-Party Sign-In

Signing in uses "Sign in with Google" (Google OAuth). Google may set its own cookies on Google's own domains during authentication; those are governed by Google's privacy and cookie policies, not this notice.

7. Changes and Contact

We will update this notice if our use of cookies or browser storage changes, and update the "Last updated" date above. Questions: [email protected].

Home · Privacy · Terms · DPA · Refunds · Cookie settings