Privacy Policy
Last updated: October 25, 2026.
This policy explains what personal information Cobalt Owl (a brand of Organic Media Buying, LLC, "we") collects, why, how long we keep it, and your choices. It is written to meet US privacy rules, including the California Consumer Privacy Act as amended by the CPRA.
What we collect, and why
| Category | What exactly | Why |
|---|---|---|
| Identifiers | Your email address (if you unlock a report, join the waitlist or subscribe); your IP address | Send your report and alerts, account and billing, follow-up emails you can opt out of, preventing abuse and rate limiting |
| Information about your site | The URL you scan, the app builder you choose, scan results and score. Any secret key we detect is masked before we store it. For Supabase apps: the number of rows in a table, never row contents | Run the scan, show and email your report, power Owl Watch |
| Commercial information | Which plan you bought and when | Deliver what you paid for, billing, tax and accounting |
| Payment details | Handled by Stripe. We never receive your full card number | Take payment |
| Technical logs | Basic request logs kept by our hosting provider | Security and keeping the site running |
We get this information from you and from the public pages of the site you ask us to scan. We don't collect sensitive personal information as defined in the CCPA.
Cookies and analytics
We don't use advertising cookies, tracking pixels or third-party analytics. Links in our emails may include a short ?r= code so we can count which email or post a visit came from. If you arrive through such a link, we set one first-party, functional cookie, co_r, that holds only that short code for 30 days, so we can count (in aggregate) whether visits from that source go on to scan or join the waitlist. We also keep anonymous daily totals of page views and button clicks (for example “12 scans today”). These counts store no IP address, no identifier and nothing about you personally. We may also use Cloudflare Web Analytics, which is cookieless. Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads.
We don't sell or share your information
We do not sell personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined in the CCPA. We have not done so in the past 12 months. We also honor Global Privacy Control signals, although there is nothing for them to switch off.
Service providers we use
- Cloudflare: hosting, storage of scan results and security.
- Stripe: our payment processor. Stripe collects your card details, email and billing info at checkout and processes payments under its own privacy policy. We receive only the payment status, your email and the last digits/brand of your card.
- Resend: sending emails (reports, alerts, follow-ups).
- Google Fonts: website fonts.
They may use the information only to provide their service to us. We may also disclose information if the law requires it, to protect against abuse, or as part of a sale of the business.
How long we keep it
- Full scan reports: 30 days, then deleted automatically.
- Shared badges (site address, score and scan date): 1 year, and visible to anyone who opens the badge or its verification link.
- Scan logs (site address, IP address, score): 90 days.
- Owl Watch scan history: 90 days; your monitored sites while your subscription is active.
- Your email and report requests: until you unsubscribe or ask us to delete them, and at most 24 months after your last activity.
- Waitlist entries without an account: 12 months.
- Billing records: as long as tax and accounting law requires (usually up to 7 years).
- Unsubscribe requests: kept so we keep honoring them.
Your rights
Depending on where you live (for example California, Colorado, Virginia and other US states), you have the right to: know what personal information we have and how we use it; get a copy of it; correct it; delete it; and opt out of sale, sharing and targeted advertising (we don't do these). We won't treat you differently for using these rights.
How to ask: email [email protected] with your request and the email address you used with us. We'll confirm we received it within 10 business days and answer within 45 days. We may need to confirm the request comes from you, usually by replying from that email address. You can use an authorized agent; we'll ask for proof of the authorization.
Marketing emails
Every marketing email has an unsubscribe link that works without logging in. We honor opt-outs right away and never later than 10 business days.
Children
Cobalt Owl is a tool for people building websites and is not directed to children under 13 (or under 16). We don't knowingly collect personal information from them. If you think a child gave us information, email [email protected] and we'll delete it.
Security
We use reasonable measures to protect information, including encryption in transit and masking of any secrets found during scans. No system is perfectly secure.
Changes
If we make material changes, we'll update the date above and, where appropriate, tell you by email.
Contact
Organic Media Buying, LLC, doing business as Cobalt Owl
[email protected]
Mail: 131 Continental Dr, Suite 305, Newark, DE 19713, USA