Privacy Policy

Last updated: April 2026

This Privacy Policy explains how Cogsynth ("we", "us", or "our") collects, uses, and protects your personal information when you use cogsynth.io. We are committed to protecting your privacy and handling your data responsibly.

1. Information We Collect

Category	Examples	Purpose
Account data	Email, display name, password hash	Authentication, account management
Usage data	Pages visited, features used, prompts sent (anonymized)	Product improvement, analytics
Payment data	Billing email, subscription status (via Stripe — we never store card numbers)	Subscription management
Technical data	IP address, browser/OS, session tokens	Security, rate limiting, fraud prevention
Project data	Code files you create and store on the platform	Delivering the service

2. How We Use Your Data

To provide, operate, and improve the Cogsynth platform
To authenticate you and manage your account and subscription
To send transactional emails (welcome, password reset, billing receipts)
To monitor for abuse, fraud, and security incidents
To aggregate anonymized analytics for product decisions
To comply with legal obligations

We do not sell your personal data. We do not use your prompts or generated code to train AI models without your explicit consent.

3. Data Sharing

We share data only with trusted third-party service providers that help us operate the platform:

Stripe — payment processing
Railway / Vercel / Netlify — hosting infrastructure
Groq / Cerebras / OpenRouter — AI inference (your prompts are sent to these providers per your model selection; they have their own privacy policies)
PostHog / Mixpanel (optional) — anonymized product analytics

All providers are bound by data processing agreements and may not use your data for their own purposes.

4. BYOK (Bring Your Own Key)

If you provide your own API keys, they are stored server-side in encrypted form and used only to proxy your requests to the respective AI provider. We never log the key values themselves.

5. Data Retention

We retain your account data for as long as your account is active. Project files are stored until you delete them or close your account. After account closure, we delete your data within 90 days. Anonymized telemetry may be retained indefinitely.

6. Your Rights (GDPR / CCPA)

Depending on your location, you may have the following rights:

Access — request a copy of your personal data
Correction — request correction of inaccurate data
Deletion — request deletion of your data ("right to be forgotten")
Portability — request your data in a machine-readable format
Opt-out — opt out of non-essential analytics communications

To exercise any of these rights, email privacy@cogsynth.io. We will respond within 30 days.

7. Cookies

We use essential session cookies (cs_token) for authentication. We may use analytics cookies (PostHog/Mixpanel) with your consent. You can disable non-essential cookies in your browser settings. A cookie consent banner will be shown on your first visit.

8. Security

We use industry-standard security practices including HTTPS/TLS, hashed passwords (bcrypt), encrypted API key storage, rate limiting, and session expiry. However, no system is 100% secure. Report security vulnerabilities to security@cogsynth.io.

9. Children's Privacy

Cogsynth is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us and we will delete it promptly.

10. International Transfers

Your data may be processed in the United States and other countries. By using Cogsynth, you consent to this transfer. We ensure appropriate safeguards are in place for international transfers of EU/UK personal data.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notice. Continued use after changes constitutes acceptance.

12. Contact Us

Questions about this Privacy Policy? Email privacy@cogsynth.io.