This page says which data we process, why, where it lives and who touches it on our behalf. It is written to be read, not to cover us.
Last updated: 4 September 2026.
Under Regulation (EU) 2016/679 (GDPR).
The data controller is OverPress Media, Rome, via di Pietralata, VAT IT13366841008. For any request: privacy@cobrain.space.
Your email address and, if you enter it, your name. They are used to sign you in (with a link by email), to recognise you when a colleague shares a branch with you, and to send you service messages. Legal basis: performance of the contract.
The notes, folders, tags, previous versions of every note and the shares you create. They are the service itself. They may contain personal data of third parties that you choose to write there: you are responsible for it, and we ask you to share it only with people entitled to read it. Legal basis: performance of the contract.
When you authorise a program (Claude, ChatGPT, Claude Code or others) to connect to your brain, we record the program’s name, the date of the authorisation and the technical tokens that let it work with your permissions. Every note remembers who changed it, including when it was an AI. You can revoke any authorisation whenever you want. Legal basis: performance of the contract.
Request logs (IP address, date and time, page or tool called, outcome, duration), kept for security and to understand failures. Legal basis: the legitimate interest in running and protecting the service.
We write to you for the sign-in link, to tell you about a share you received, and for service messages (a change to this notice, for instance). No newsletter without consent.
Cobrain sends your notes to no model. It is the programs you connect (Claude, ChatGPT and the rest) that read and write them, with your permissions, when you ask them to in a conversation. What those programs do with what they read depends on their terms and on the settings you have with them: Cobrain does not control them and receives nothing from them beyond the operations they perform in your brain.
We use few suppliers, all with premises or servers in the European Union for the data that concerns us:
None of them uses your data for their own purposes. We do not pass data to anyone else and we do not sell it.
At any time you can ask us to access your data, correct it, delete it, restrict its processing, object, or receive it in a readable format. The full export you do yourself from the dashboard, without asking: they are Markdown files in folders. For everything else write to privacy@cobrain.space: we answer within thirty days. You may also complain to the Italian data protection authority (Garante per la protezione dei dati personali) or to your own supervisory authority.
You sign in with a link by email, or with the code contained in the same email: they work once and they expire. The AIs connect with an OAuth authorisation that expires, renews and can be revoked. Permissions on the notes are applied by the database, on the same rule for the site and for the AIs: an unshared branch cannot be reached by anyone. Connections are encrypted.
The site and the application use technical cookies only: the session cookie, to keep you signed in, the light/dark theme preference and the language preference. No tracking cookies, no advertising.
Cobrain is made for people at work. It is not aimed at children under fourteen and we do not knowingly collect their data.
If this notice changes in a way that affects you, we tell you by email before the change takes effect. The date at the top says when it was last updated.