PRIVACY.MD

Privacy Policy

Last Updated June 1, 2026

1. Overview

This Privacy Policy describes how Cognilot ("we", "us", "our") collects, uses, stores, and protects your personal information when you use our platform, browser extension, and developer SDK (collectively, the "Service"). We are committed to transparency and protecting your privacy.

2. Data We Collect

We collect the following categories of information:

Account Information

  • Name and email address (via Google Sign-In or email registration)
  • Authentication tokens (managed by Supabase)
  • Account preferences and settings

Memory Data

  • Personal and professional profile information you choose to store
  • Alias mappings and shortcut configurations
  • Playground configurations and custom skill definitions

API Keys

  • Third-party AI provider API keys you provide (BYOK model)
  • These keys are encrypted at rest and never shared with third parties

Usage Data

  • Pages visited, features used, and interaction patterns
  • Browser type, operating system, and device information
  • IP address and approximate geographic location

3. How We Use Your Data

We use your data exclusively for the following purposes:

  • Service delivery — syncing your Memory data across devices, the browser extension, and connected AI providers
  • Autofill — populating forms using your stored profile data when triggered by you
  • Improvement — analyzing aggregate usage patterns to improve features and reliability
  • Security — detecting and preventing unauthorized access, fraud, and abuse
  • Communication — sending account-related notices, service updates, and (with consent) marketing emails

We do not sell your personal data to third parties. We do not use your Memory data to train AI models.

4. Data Storage & Security

Your data is stored on secure cloud infrastructure provided by Supabase and associated hosting providers. Security measures include:

  • AES-256 encryption for data at rest
  • TLS 1.3 encryption for data in transit
  • Row-level security policies on all database tables
  • JWT-based authentication with short-lived tokens

While we implement industry-standard security practices, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Sharing

Your data may be shared with the following parties, and only as necessary:

  • AI Providers — when you connect a third-party API key, your Memory data is sent to that provider solely to fulfill your request
  • Infrastructure providers — hosting, database, and CDN providers that process data on our behalf under strict data processing agreements
  • Legal requirements — when required by law, subpoena, or court order

6. Cookies & Tracking

Cognilot uses essential cookies required for authentication and session management. We do not use third-party advertising cookies or cross-site tracking.

The browser extension operates entirely on your local device and does not inject tracking scripts into web pages you visit. Form autofill events are processed locally and are not logged or transmitted to our servers.

7. Data Retention

We retain your data for as long as your account is active. Upon account deletion, all personal data, Memory entries, aliases, and API key configurations are permanently deleted within 30 days.

Aggregated and anonymized usage data, which cannot be used to identify you, may be retained indefinitely for analytics purposes.

8. Your Rights

Depending on your jurisdiction, you have the right to:

  • Access — request a copy of all personal data we hold about you
  • Correct — request correction of inaccurate data
  • Delete — request deletion of your personal data
  • Portability — request data in a structured, machine-readable format
  • Object — object to processing of your data for specific purposes
  • Withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at hello@cognilot.com. We will respond within 30 days.

9. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete it promptly.

10. International Data Transfers

Your data may be processed in countries other than your own. We ensure that appropriate safeguards are in place for international transfers, including standard contractual clauses where required by applicable data protection regulations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service at least 30 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at hello@cognilot.com.