Privacy policy
Edition of 17 October 2026
Cognitive OS is a personal memory you trust with your thoughts. Here, plainly and in order: what we keep, why, who else sees it, and how to delete it all.
1. What we keep
Your account: your email address and your password — as a strong hash; we never know or keep the password itself.
What you write and upload: messages in the chat and in threads, voice messages and their transcripts, the photos and documents you attach and the text read from them, notes with their versions and table settings, imported notes (Apple Notes, Obsidian), ideas and requests, your ratings.
What the AI derives from it: facts, atoms and topics of your memory, tags, links between notes, and vector representations of text for search by meaning. All of it is derived data: it always points back to your own text and can be rebuilt from it.
Service records: sign-in sessions, a log of AI requests (time, model, size — to watch quality and cost) and technical details of errors.
2. Why
Only to make the service work for you: answering in the chat with what you told it in mind, sorting thoughts into notes and topics, finding things, transcribing your voice, reading your photos and documents, sending the emails that confirm your address and reset your password, finding and fixing errors.
We do not sell your data, show ads, or use your content to train models of our own.
3. Who else processes it
OpenAI — AI requests: chat answers, memory extraction, vector representations, voice transcription and reading the photos and documents you attach. Only what a request needs is sent. Under OpenAI's API terms the data is not used to train their models.
Mailtrap — email delivery: address confirmation and password resets. Your address and the email's text are sent.
Sentry — error reports. Before a report leaves, query strings, secret headers and everything that identifies you except an internal id are removed.
Hosting: the server and the database run at the cloud provider Timeweb Cloud, in a data centre in Almaty (Kazakhstan). No one else receives your data, unless the law directly requires it.
4. Where and how it is stored
The primary store is a PostgreSQL database on our server; photos and documents are kept on the same server's disk, open to no one but you — a file opens only from your own sign-in. Outside AI services are replaceable processors, and the source of truth stays with us. Connections are encrypted (HTTPS), and access to the server and the database is restricted.
5. How long
Your data is kept while your account exists. A deleted note stays in Deleted for 30 days — you can bring it back — and is then erased for good. A sign-in session lasts up to 30 days. Resetting your account in Settings erases all your content and derived data at once. A deleted account is closed: it cannot be signed in to, its email is free for a new sign-up, and what it holds is kept out of reach until you ask us to erase it completely.
6. Cookies and browser storage
We use only necessary cookies: cos_session — to keep you signed in; cos_locale — your language; cos_theme — your theme; cos_log_side and cos_log_folded — where and how the memory panel shows. Browser storage keeps interface preferences and drafts. There are no advertising or analytics trackers.
7. Your rights
At any time you can see and correct your data in the app, delete single notes, facts and messages, reset or delete your account in Settings → Profile, and ask us to export your data or erase it completely — write to us through Suggest an idea in the app.
8. Children
The service is not meant for children under 16.
9. Changes
If this policy changes, the new edition appears on this page with a new date, and we tell you about significant changes in the app.