Here we explain in plain language how Cobrain handles data. The complete and up-to-date legal notice is published by Iubenda.
Generated and versioned by Iubenda.
This page is a transparent product summary and does not replace the official privacy notice. The complete list of cookies is in the cookie policy.
Last updated: 19 October 2026.
Under Regulation (EU) 2016/679 (GDPR).
The data controller is OverPress Media SRL, Via Latina 57, 00179 Rome (Italy), VAT IT13366841008. For any request: hi@cobrain.space.
Your email address and, if you enter it, your name. They are used to sign you in (with a link by email), to recognise you when a colleague shares a branch with you, and to send you service messages. Legal basis: performance of the contract.
The notes, folders, tags, previous versions of every note and the shares you create. They are the service itself. They may contain personal data of third parties that you choose to write there: you are responsible for it, and we ask you to share it only with people entitled to read it. Legal basis: performance of the contract.
When you authorise a program (Claude, ChatGPT, Claude Code or others) to connect to your brain, we record the program’s name, the date of the authorisation and the technical tokens that let it work with your permissions. Every note remembers who changed it, including when it was an AI. You can revoke any authorisation whenever you want. Legal basis: performance of the contract.
Request logs (IP address, date and time, page or tool called, outcome, duration), kept for security and to understand failures. Legal basis: the legitimate interest in running and protecting the service.
We write to you for the sign-in link, to tell you about a share you received, and for service messages (a change to this notice, for instance). No newsletter without consent.
Cobrain sends your notes to no model. It is the programs you connect (Claude, ChatGPT and the rest) that read and write them, with your permissions, when you ask them to in a conversation. What those programs do with what they read depends on their terms and on the settings you have with them: Cobrain does not control them and receives nothing from them beyond the operations they perform in your brain.
We use technical suppliers as processors. Primary data is in the European Union; CDN, logs, email, payments and support services may be processed in other countries under the safeguards in the relevant data-processing agreements:
We do not sell data. The current roles, purposes and safeguards for each supplier are described in the official notice.
At any time you can ask us to access your data, correct it, delete it, restrict its processing, object, or receive it in a readable format. The full export you do yourself from the dashboard, without asking: they are Markdown files in folders. For everything else write to hi@cobrain.space: we answer within thirty days. You may also complain to the Italian data protection authority (Garante per la protezione dei dati personali) or to your own supervisory authority.
You sign in with personal credentials or with an expiring email link or code. AIs connect through a revocable OAuth authorisation. The database prevents users and AIs from reaching unshared branches. The text of notes, of their versions and of those in the trash is encrypted (AES-256-GCM) with a different key for each brain; those keys are in turn encrypted by a master key kept in AWS KMS, outside the database, that only the application's production functions can use. Whoever obtains the database, one of its backups or the database provider's credentials sees only ciphertext: the database cannot read the notes. To serve them to you and to the AIs you connect, the application decrypts them in memory; every use of the master key goes into a log that not even we can alter or delete. Note and folder names, tags, dates, who made changes, and attachments (stored on Cloudflare R2 with the provider's encryption) stay in plain text. For search the database keeps an index of words turned into codes: it does not reveal the words, but it shows how often the same code recurs within a brain. For Pro and Team brains Cobrain also computes, on its own servers, a fingerprint of the meaning of each note, used to find it when you search with different words: it is encrypted with the brain's key like the text, and the database cannot read it. To compare them the database keeps only a version reduced to codes, also made with the brain's key, which shows which notes in the same brain are alike. The model that computes the fingerprint runs on our side: no text goes to third parties. This is not end-to-end encryption: whoever runs the application could, through a deliberate and logged action, read the notes, and we do so only at your support request, for security, or when the law requires it. The AIs you connect receive notes in plain text to work on them. Connections are encrypted.
In the application, where your notes live, there are technical cookies only: the session cookie, to keep you signed in, the light/dark theme preference, the language preference and the price currency preference. No measurement scripts: what you write, and even the names of your folders, never leave it. Only if you accepted analytics and marketing cookies on the public site are your sign-up and any purchase reported to Google and Meta as conversions, tied to those same identifiers and, for Meta, to your email: never the content of your notes.
The public site — these pages — does count visits, in two ways. One is aggregated and cookie-free, and applies to everyone. The other goes through Google Tag Manager: Google Analytics for statistics, the Meta pixel to measure campaigns and reach site visitors again, and Microsoft Clarity to understand how pages are used (click maps and session recordings). They write cookies and only start if you say yes to the banner; until you do, they stay off. You can change your mind at any time from the button at the bottom left. With the same yes, a cookie of ours (cobrain-src, 30 days) remembers which site or campaign brought you here; if you then sign up, we keep it on your account to know which channels bring us sign-ups. It holds only the name of the referring site, the campaign parameters and the first page you saw, and is shared with no one. If you choose euros or dollars on the English pages, a technical cookie (cobrain-currency, one year) remembers the choice: it measures nothing and is shared with no one. The full list, with durations and purposes, is in the cookie policy.
Cobrain is made for people at work. It is not aimed at children under fourteen and we do not knowingly collect their data.
If this notice changes in a way that affects you, we tell you by email before the change takes effect. The date at the top says when it was last updated.