Privacy information
A minimal-data V1 by design
This page explains the information the current service must process to resolve media links and protect the public endpoint.
What the service processes
A submitted source URL and the selected format options are processed to provide the requested resolution. Cobalt receives the approved source URL, and the source platform necessarily receives requests related to the media.
Security and abuse prevention
Cloudflare Turnstile processes technical signals needed for its challenge. The service temporarily derives a pseudonymous HMAC identifier from the observable client address for rate limiting; the raw address is not stored in the limiter.
What is not kept
The V1 has no account, personal download history, user library or permanent media storage. Resolution responses are not cached, and operational logs exclude full source URLs, Turnstile tokens, IP addresses and media tunnel URLs.
Operational records
Minimized resolution logs contain only safe operational fields. Aggregate Prometheus metrics use fixed enums and are retained for no more than 30 days or 8 GB. A separate tunnel log excludes IP addresses, URLs, query strings, tunnel identifiers, referrers and user agents; it rotates daily with seven archives. Private daily aggregate reports are removed after 30 days by default. Download button telemetry contains only platform, delivery, media type and an allowlisted format, and is not a personal download history.
This V1 information describes the current product behavior and is not a substitute for final legal review before launch.