Privacy Policy

Last updated: 2026-10-02  |  Effective date: 2026-10-02

1. Who We Are and How to Contact Us

Cobalt ("Cobalt", "we", "us", "our") is a hosted visual moodboard service operated at app.cobalt.photos (marketing site cobalt.photos). The data controller responsible for your personal data is:

Jakub Ludwig, IČO 88711111
U Obory 1004, 675 71 Náměšť nad Oslavou, Czech Republic
Sole trader (OSVČ / podnikající fyzická osoba).
Contact for privacy matters: [email protected]

For any privacy enquiry, data-subject request, or complaint, write to the address above. We will respond within one month of receiving your request (extendable by up to two further months for complex or numerous requests, with notice to you), as required by GDPR Art. 12(3).

2. Scope

This policy applies to personal data we process when you access or use Cobalt — when you sign in, create and store content, use public share links, view or contribute to a shared board, contact us for support, or subscribe to a paid plan. It does not cover third-party sites linked from boards, or the practices of an AI provider you choose to connect (see Section 5).

3. Personal Data We Collect

3.1 Account Data

You can create an account with "Sign in with Google" (Google OAuth) or with your email address and a password. When you sign in with Google, Google provides us the data you authorise: your email address, display name, profile picture URL, and Google account identifier (Google id). We do not receive or store your Google password. When you sign up with email, we store your email address, the name you enter, and a one-way hash of your password (never the password itself), and we send you an email to confirm the address. In both cases we assign you an internal user ID and store your account creation date, plan/subscription tier, and storage usage.

3.2 User Content

You may upload images (which can include photographs of people) and create notes, hyperlinks, board layouts, and column structures. We store this content in Google Cloud object storage (see Section 7). You are the primary party responsible for ensuring uploaded content complies with applicable law, including obligations arising from images of identifiable individuals (see Section 12).

3.3 Share-Link and Visitor Data

When you create a public share link we record its creation time and the permissions you set (view-only or contributor). When someone accesses a share link, our servers and our CDN (Cloudflare) process the visitor's IP address, request metadata (browser type, referrer), and a view-count increment. We do not build persistent profiles of anonymous visitors. Anonymous visitors are data subjects of Cobalt in their own right (not only of the board owner); we process their connection data on the basis of our legitimate interest in delivering and securing the Service (see Section 4).

3.4 Contributor Content

If you enable "contributor" access on a share link, anyone with the link can add images, notes, or comments without an account. We store the submitted content and a timestamp. Where contributed content contains personal data, both Cobalt and the board owner have roles: Cobalt is the controller for hosting and securing the platform, while the board owner determines what is collected on their board and is responsible for that content under our Terms. We provide a route for affected individuals to exercise their rights (see Section 12.1).

3.5 Support Communications

If you email us, we retain your email address, the content of your message, and follow-up correspondence for as long as reasonably necessary to handle your query and a limited period thereafter.

3.6 Payment and Billing Data

Paid subscriptions are sold through our Merchant of Record, Polar, which acts as the seller of record and collects and processes your billing details, payment method, and tax data directly. We do not receive or store your full card number or bank details. From Polar we receive a customer/transaction reference and your subscription status, plan, and billing-period dates.

3.7 Authentication Tokens, Cookies, and Similar Technologies

To keep you signed in and to secure sign-in, we use a small number of strictly necessary technologies (an authentication token stored in your browser's local storage, a short-lived sign-in security cookie, and a cookie that remembers your cookie-banner choice). For analytics we use Umami, a privacy-friendly, cookieless analytics tool that we host ourselves (no third-party analytics processor). It sets no cookies, collects no personal data, and performs no cross-site tracking (aggregate, anonymous usage counts only), so it requires no consent. Advertising cookies are set only if you accept them in our cookie banner (Section 3.8). All of these are described in full in our separate Cookie / GDPR Consent Notice.

3.8 Advertising and Marketing Cookies (Only With Your Consent)

To measure our advertising, we may use advertising pixels from Meta (Facebook and Instagram), Google (Google Ads and Google Analytics 4), TikTok and Reddit on cobalt.photos and app.cobalt.photos. They are off by default. They load, and set or read cookies, only after you accept them in our cookie banner. If you reject them or don't make a choice, they don't load.

If you accept, these pixels are used to:

• measure conversions from our ad campaigns, such as sign-ups and plan purchases, and tell which ad or campaign led to them; and
• build advertising audiences, for example to show Cobalt ads to people who visited our sites, to stop showing them to people who already signed up, or to reach people similar to our visitors.

The data involved is a pseudonymous cookie identifier, the ad click id from the link you followed (if any), the pages you view on our sites, the conversion events above (for a purchase, the plan and its price), your IP address, and browser and device information. We do not send your boards, images or other content to these providers.

Cookie names and lifetimes are set by each provider and can change. The Google and TikTok lifetimes are those published in the providers' own documentation; those marked "approximate" are typical values, not a figure the provider guarantees. Some browsers (for example Safari) shorten them. Our Cookie Notice keeps the current list.

Who is responsible. Each provider processes this data under its own privacy policy, linked above. For collecting the data on our pages and sending it to the provider, the provider and Cobalt can be joint controllers (Meta, for example, provides a controller addendum for this). For their own purposes, such as delivering and measuring ads and improving their services, the providers act as independent controllers. Where a provider only processes data on our behalf (for example Google Analytics), it acts as our processor. These providers may process the data outside the EEA, notably in the United States (see Section 8).

Legal basis and withdrawal. The legal basis is your consent (GDPR Art. 6(1)(a) and, for storing or reading information on your device, § 89(3) of Act No. 127/2005 Coll.). You can withdraw it at any time, as easily as you gave it, through "Cookie settings" in the footer of every page on cobalt.photos. Withdrawal does not affect processing that happened before it.

Your choice itself is stored in a cookie named cobalt_consent for 6 months. It is strictly necessary: it only records whether you accepted or rejected advertising cookies, so we can respect that choice without asking on every page.

3.9 Campaign Parameters Saved at Sign-up

If you arrive at our sign-up page through a link that carries campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), an ad click id (gclid, gbraid, wbraid, fbclid, ttclid, rdt_cid, msclkid, li_fat_id or twclid) or a referral code (ref), we save the first set of these values with your new account. We use them only to measure which campaigns and sources bring sign-ups. No cookie is used for this: our marketing pages pass the values along in the links to the app, and they are saved once, when you create your account.

The legal basis is our legitimate interest in knowing which of our marketing works (Art. 6(1)(f)); the values describe how you found us, not what you do in Cobalt. You may object under Art. 21. They are kept with your account and deleted with it (Section 9).

4. Purposes and Legal Bases (GDPR Art. 6)

5. AI Integration (MCP / Access Token)

Cobalt offers an optional integration that lets you connect an external AI assistant (for example, Claude by Anthropic) to your account using an access token you generate in the Service. When enabled, the assistant can read and write boards on your behalf, strictly according to your instructions.

We do not send your data to AI providers on our own initiative. When your connected assistant requests board data, our servers transmit that data to the assistant only in response to your token-authorised request. In that flow the AI provider receives the personal data contained in the boards you expose to it; you decide the scope of access, and you should review the AI provider's own privacy policy, which may involve a transfer to a provider outside the EEA. We don't choose or instruct the AI provider: you do, under your own agreement with it. The legal basis for this feature is Art. 6(1)(b) (the integration you chose to activate).

6. Sharing and Disclosure

We do not sell personal data. We disclose personal data only:

• to sub-processors we use to operate the Service (Section 7);
• to advertising providers (Meta, Google, TikTok, Reddit), only if you accept advertising cookies, as described in Section 3.8;
• to comply with the law, a court order, or a lawful request from a competent Czech or EU authority, to the extent required, notifying you where legally permitted;
• to protect rights, prevent fraud, enforce our Terms, or protect the safety of users or third parties; and
• on a business transfer (merger, acquisition, or sale of substantially all assets), in which case we will notify you and the recipient will be bound by an equivalent policy.

7. Sub-processors

We rely on the following service providers. Those acting as our processors are bound by a data-processing agreement (DPA), and where data leaves the EEA we rely on the transfer mechanism shown for each provider:

Web fonts. Pages on our marketing site (cobalt.photos) load their fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com, operated by Google). When such a page loads, your browser sends Google your IP address, its user agent and the address of the page requesting the font. Google states that the Google Fonts API does not set cookies. Google may process this data outside the EEA; transfers to Google LLC are covered by its certification under the EU-U.S. Data Privacy Framework.

Bot protection at sign-up. The e-mail sign-up form uses Cloudflare Turnstile (Cloudflare, Inc.) to tell humans from bots, which processes your IP address and browser signals for that purpose only, based on our legitimate interest in preventing abuse (GDPR Art. 6(1)(f)).

We may change sub-processors; how we notify you is described in our separate Data Processing Addendum (DPA).

8. International Data Transfers

Our primary hosting, database, uploaded files and backups are on Google Cloud in the EU, in the europe-central2 region (Warsaw, Poland). Some sub-processors (notably Cloudflare, and Google's identity services, and an AI provider you connect) may process data outside the European Economic Area (EEA), and so may the advertising providers in Section 3.8 if you accept advertising cookies. Where personal data is transferred outside the EEA, we rely on an appropriate safeguard for the specific recipient:

• an adequacy decision of the European Commission, where one applies to the recipient country or framework;
• Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c), incorporated in our agreement with the sub-processor, supported by a transfer impact assessment where needed; and/or
• the recipient's certification under the EU–US Data Privacy Framework (DPF), where applicable and current.

The safeguard we rely on for each provider is shown in the table in Section 7, and for the advertising providers in Section 3.8. You may request a copy of the applicable safeguards by contacting [email protected].

9. Data Retention

10. Security

We apply technical and organisational measures proportionate to the risk, including:

• encryption in transit (TLS 1.2 or higher);
• encryption at rest in Google Cloud object storage;
• access controls limiting production-data access to what is necessary;
• strictly necessary, short-lived sign-in security cookies and bound access tokens;
• regular dependency and vulnerability review; and
• Cloudflare DDoS mitigation and WAF protection at the network perimeter.

No system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the Czech supervisory authority (ÚOOÚ) within 72 hours of becoming aware, and affected individuals without undue delay where required.

11. Children

Cobalt is a paid service intended for adults and is not directed at children. For data-protection consent purposes, the relevant age of digital consent in the Czech Republic is 15 years, as set by § 7 of Act No. 110/2019 Coll. (lowering the GDPR Art. 8 default of 16). We do not knowingly process personal data of children below the applicable age of digital consent in their country. Separately, our Terms of Service set a minimum contractual account age of 16 (with full legal capacity, generally 18, required to purchase a paid plan). If you believe a child has provided us personal data, contact [email protected] and we will delete it promptly.

12. Images Depicting Identifiable People

Photographers using Cobalt may upload images depicting identifiable individuals. Ordinary photographs of people are personal data, but mere storage and display of opaque image files does not, by itself, amount to processing of biometric special-category data under GDPR Art. 9. We do not perform facial recognition or any automated biometric processing of images.

As the uploader, you are responsible for ensuring that:

• you hold the rights to the image and any necessary model release or consent from depicted individuals (a "model release" addresses civil personality-rights law, e.g. § 84–90 of the Czech Civil Code, which is distinct from a GDPR lawful basis); and
• sharing the image (e.g. via a public link) does not breach depicted individuals' privacy or other rights.

12.1 Rights of People Depicted in Content (Non-Users)

13. Your Rights Under GDPR

As a data subject in the EU/EEA you have the right to:

• access (Art. 15) — obtain a copy of your personal data;
• rectification (Art. 16) — correct inaccurate or incomplete data;
• erasure (Art. 17) — request deletion, subject to overriding legal obligations (e.g. accounting records);
• data portability (Art. 20) — receive data you provided in a structured, common, machine-readable format, where processing is by automated means and based on consent or contract;
• restriction (Art. 18) — restrict processing in certain circumstances;
• object (Art. 21) — object to processing based on our legitimate interests (Section 4), including our security logging and visitor-data processing, on grounds relating to your particular situation; we will stop unless we show compelling legitimate grounds; and
• withdraw consent (Art. 7(3)) — where we rely on consent, withdraw it at any time without affecting prior lawful processing. For advertising cookies, use "Cookie settings" in the footer of any page.

You can also do two of these yourself in the app: Settings → Privacy & data → Export my data downloads a JSON file with your account, boards and share links, and Delete account on the same screen permanently deletes your account and its data.

To exercise a right, contact [email protected]. We respond within one month (extendable as noted in Section 1). We may need to verify your identity proportionately before acting (Art. 12(6)).

Right to complain. You may lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
www.uoou.cz

You may also complain to the supervisory authority where you live or work.

14. Changes to This Policy

We may update this policy. For material changes we will notify registered users by email and update the "Last updated" date above. Continued use after the effective date indicates you have read the update. Where a change introduces new processing that requires your consent, we will obtain that consent affirmatively — we do not treat continued use as consent to new processing for which consent is the lawful basis.

15. Contact

Privacy enquiries, subject-access requests, and other data-protection matters:
Jakub Ludwig, IČO 88711111
U Obory 1004, 675 71 Náměšť nad Oslavou, Czech Republic
[email protected]

© 2026 Jakub Ludwig — Cobalt (cobalt.photos). Last updated: 2 October 2026.

Home  ·  Terms  ·  Cookies  ·  DPA  ·  Refunds  ·  Cookie settings