Privacy policy

• We collect your email (to sign you in) and the content you create: notes, attachments, study items, and what you send to the AI assistant.
• Your notebook is stored in your browser first and in your account second, in a database where only your account can read your rows.
• AI features send only the content you attach or type to the AI provider that answers, and only when you ask. We do not use your content to train anything.
• We do not sell data, run ads, or use third-party tracking in the app.
• Delete your account and your data is purged within 30 days, backups included.

Account. Your email address, the display name you choose, and the time you sign in. Signing in is by a one-time code emailed to you; we never store a password.

Your notebook. Notes, folders and projects, attachments (PDFs, images, files), study items and your review history, and the settings you set in the app.

AI assistant conversations. What you type to Cairn and the notes you attach to a question. The conversation history itself is kept in your browser, not in your account; the message and attached context are sent to the AI provider when you press send.

Technical records. Our gateway keeps request logs with a hashed form of your identity (not your email) for security and for the daily AI usage limits, and counts of AI requests per account per day. The hosting and sign-in providers below keep their own standard logs (IP address, browser type, timestamps) to run their services.

Invite requests. If you request an invite on cobaltian.co, the form's name, email, school or program, and message are emailed to us. That page uses Cloudflare Turnstile to stop bots.

• Your browser. The working copy of your notebook lives in your browser's local database and works offline. Clearing site data removes it from that device.
• Supabase (United States). Your account, your notebook's synced copy, and your attachments are stored in a Supabase project in a US region. Access is enforced per account at the database level: your account can read and write only its own rows and files.
• Cloudflare. Glyphic is served through Cloudflare, which handles the connection, bot protection, and delivery of the app itself.
• Cobaltian's own systems. Some features (retrieval over your notes, image generation, shared notes) run on equipment Cobaltian operates. Backup copies of the account database and your attachments are also kept on Cobaltian-controlled storage so a hosting-provider failure cannot wipe your notebook.

When you use Cairn or draft study material, the text you send and the notes you attach are sent to a large language model to produce the answer. During the beta the cloud models are provided by Anthropic and OpenAI through their developer APIs, routed through Cobaltian's own gateway so the app never holds a provider key. Some study features run on a model hosted on Cobaltian's own equipment instead, and nothing leaves it.

We send only what is needed for the request: your message, the notes you attached, and a short instruction for the assistant. We do not send your whole notebook, your email, or your account details. We do not use your content to train models, and we rely on the providers' published API data-use commitments for how they handle API traffic; read their pages if that matters to you, and do not put in a question anything you would not want to send to a third party.

You. Other Glyphic users can see only a note you have explicitly shared with them, and only that note. Cobaltian's operator can reach the database and the backups for support, security, and backup work, and does not read notebooks except when you ask for help with yours or when investigating a report of abuse. We do not sell data, we do not show ads, and the app contains no third-party advertising or analytics trackers.

We disclose data to third parties only where the law requires it, for example a valid legal request, or where we are obliged to report illegal content — with one operational exception: if you request an invite, the email address and message you enter are sent to Resend, the provider we use to send the request notification and your acknowledgement email.

We keep your notebook for as long as your account exists. Deleted notes are removed from the account copy on your next sync and from backups as those roll over.

To delete your account, export anything you want to keep, then email inquiries@cobaltian.co from the address on the account. We remove the account, its notebook, and its attachments within 30 days, and backup copies expire within 30 days after that. Invite-request emails are kept in our inbox until they are no longer needed for the beta.

The app keeps your sign-in session in browser storage (you can choose per device whether it survives closing the browser). Cloudflare sets its standard security cookies when it protects the site. There are no advertising cookies. The marketing site (cobaltian.co) uses Cloudflare Web Analytics, which does not use cookies or track you across sites.

Everything travels over HTTPS. Sign-in is by emailed one-time code, so there is no password to leak. Each account's data is isolated at the database level. AI provider keys never reach your browser. We keep backups and test restoring them. No system is perfectly secure; if you believe your account has been accessed without permission, email us and we will help.

Glyphic is for people 13 and older and is not directed at children under 13. If you believe someone under 13 has an account, tell us and we will remove it.

We will update this page as Glyphic changes, and the date at the top moves when we do. For a change in what we collect or who we share it with, we will tell account holders by email before it takes effect.

Cobaltian, Texas, United States. Privacy questions, access or deletion requests, and abuse reports: inquiries@cobaltian.co.