Privacy policy

What Cobalt Capture collects when you use it, what we do with it, and what we don't do.

What we collect

• Your email address, for sign-in.
• An email address you give us at the end of a capture so we can send you the link to your review. We store it on that review, use it to send you that one email, and use it later only to warn you before the review locks. It is not a mailing list and we do not sell or share it.
• Your name and profile picture from your sign-in provider, shown to you inside the product.
• The reviews you save: titles, captured screenshots, comments you write or dictate, and product URLs you paste in.
• Reviews created without an account, including ones an AI assistant creates through our connector. We keep these anonymously and delete them automatically after 30 days unless you save them to an account. An email address attached to one of these is deleted with it.
• Standard server logs from our hosting providers: IP address, browser user-agent, and request timestamps.

We do not run third-party analytics that profile you across the web. We do not run advertising trackers.

Signing in with Google

If you sign in with Google, Google sends us a small set of information about your account:

• Email address. We use this to identify your account and to send you transactional messages.
• Name. Shown to you inside the product so you know which account you're signed in to.
• Google account ID. A stable identifier we store so we recognize your account when you come back.
• Profile picture URL. Displayed in the product UI; not republished or sold.

That's it. We do not request access to Gmail, Drive, Calendar, Contacts, Sheets, Docs, or any other Google service. Cobalt Capture's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell this data. We do not share it with third parties for their own advertising. We do not use it to train machine learning or AI models.

You can revoke our access at any time from your Google Account permissions page, or by deleting your Cobalt Capture account.

Using Cobalt through Claude or another AI assistant

Cobalt Capture offers a connector (an MCP server) that lets an AI assistant such as Claude read and create reviews for you. When you use it:

• We receive only what the connector's tools are explicitly given: the screenshots, notes, titles, and review links passed to them. We do not receive your wider conversation with the assistant, your files, or anything you didn't hand to a Cobalt tool.
• Reviews an assistant creates are anonymous by default and behave like any other anonymous review: reachable by their public URL, and automatically deleted after 30 days unless you save them to an account.
• Reading a review through the connector returns the same public content anyone with the link can see. The connector never exposes another person's private account data.
• Screenshots sent through the connector are stored in our object storage and served from the review's public URL, exactly as with reviews created on the website.

Disposable test inboxes

If you (or an assistant acting for you) use our optional disposable-inbox tools to sign up for a product you're testing, we create a temporary email address and store the messages sent to it, so a verification code or confirmation link can be read back. These inboxes and their messages are deleted automatically within about 24 hours. The address is disposable and its contents are readable by whoever holds its access token, so don't route anything sensitive or personal through it.

What we share

• Public reviews. When you finish a review, Cobalt Capture gives it a public URL. Anyone with that URL can read the review, including the title, screenshots, and your comments. That's the whole point of the product. Don't capture anything you wouldn't want a recipient to see.
• Sub-processors. We use a small set of vendors to operate the service. They process data on our behalf under their own terms.
  • Neon: managed PostgreSQL hosting for review data.
  • Railway: runs the web application.
  • Cloudflare: DNS, CDN, and R2 object storage for screenshots.
  • Supabase: handles authentication when you sign in.

We do not sell your data. We do not run ad trackers.

Cookies and local storage

We use first-party browser storage to keep you signed in and to remember your in-progress work. We do not use third-party advertising cookies or cross-site tracking.

Your choices

• You can delete any review from your reviews list. Deleting removes it from our database and removes its screenshots from object storage.
• You can sign out at any time from the product.
• You can revoke Google's connection from your Google Account permissions page.
• To delete your account and all associated data, contact us.

Email communications

When you create an account, you'll receive transactional emails (sign-in, account information, material service changes) and occasional product updates about Cobalt Capture. You can opt out of product updates at any time using the unsubscribe link in any email or from your account settings. Transactional emails are required to use the service and cannot be opted out of while your account is active. We do not share your email address with third parties for their own marketing, and we do not use your email to market other products in the Middlefield General Services portfolio without your separate explicit consent.

Data retention

Reviews you save remain available until you delete them. If you close your account, we remove your reviews and the associated screenshots from object storage. Anonymous reviews (including ones created through the connector) are deleted automatically 30 days after they're published unless you save them to an account. Disposable test inboxes and their messages are deleted within about 24 hours. Standard server logs are retained for a short window by our hosting providers under their own policies.

Children's data

The service is not intended for anyone under 13 (or 16 in the EU). We do not knowingly collect data from children.

Where we operate

We operate from the United States. By using the service you acknowledge your data is processed in the US.