Cobbles

Legal

Privacy Policy

Last updated: 07/07/2026 · Cobbles — formerly River AI. The rename changes nothing about our commitments. The Hebrew statement at app.cobbles.ai is the binding version.

Cobbles ("we") respects your privacy. This document describes what we collect, why, who it's shared with, and your rights.

What we collect

  • Account details — email address, an optional display name, interface preferences.
  • Content you create — boards, tasks, comments, attachments, invitations, reminders.
  • API keys and AI agents — key name, granted scopes, usage timestamps and an action log. Every action an agent performs is recorded and attributed to the key that performed it — visible to every member of the board where it happened.
  • Technical usage data — IP address, browser type, timestamps and security logs, for security and abuse prevention.
  • Push notifications — your browser's push-subscription identifier, if you enable device reminders.
  • Analytics (consent-gated) — usage analytics via PostHog only after you accept the cookie banner; without consent the component never loads.

Cookies and local storage

Browser storage keeps you signed in and stores interface/accessibility preferences — essential, no consent needed. Analytics cookies load only after explicit consent, withdrawable at any time.

How we use it

To provide, secure and improve the service — nothing else. We do not sell personal data and we show no ads. Board access is limited to the members you shared with (and agents connected under your authority).

Sub-processors

Supabase (database, auth, storage) · Vercel (hosting) · Sentry (error monitoring, no board content) · Cloudflare Turnstile (sign-in anti-bot) · Resend (transactional email) · PostHog (analytics, consent-gated). Data is stored on the providers' servers in the EU or US, per provider.

Security

TLS everywhere; row-level database permissions; two-factor authentication (TOTP) supported; API keys shown once and stored as encrypted fingerprints.

Retention and deletion

Data is kept while the account is active. On account deletion, identified data is removed, except records we must keep by law or for security, for a limited period.

Your rights

Request access, correction or deletion any time — support@cobbles.ai. We answer within 30 days.

Changes

Material changes will be announced prominently in the service. Continued use after an update constitutes acceptance.