Security and privacy

What CoBlick receives

When a coding agent uses a CoBlick action, CoBlick receives the action name and the fields needed for that request, such as a search query or block name. Signed-in requests also use your account and selected project to check access.

• Your provider API keyStays in the coding agent. CoBlick does not request or store it.
• Your full conversationStays in the coding agent unless it places text into a CoBlick tool field.
• Downloaded block filesGo to the coding agent for the requested block. CoBlick does not store a second copy in agent activity.

Tokens

• Project tokenLets shadcn download Pro blocks for one CoBlick project. Store it as COBLICK_UI_TOKEN.
• MCP access tokenLets a coding agent connect when browser sign-in is unavailable. It starts with cui_mcp_.
• Browser sign-inLets the coding agent request approved access without a token you copy manually.

Project and MCP access tokens are shown once and expire after 90 days. CoBlick does not store the complete value. Revoke one immediately if it is exposed.

Activity history

CoBlick keeps MCP activity for 30 days. An entry can include the tool, time, result, block name, and counts such as files or dependencies.

Activity history does not store catalog queries, prompts, conversations, provider API keys, complete tokens, or downloaded block files. You can review it from Agent activity.

Remove access

1. 1
   Disconnect the agent

   Remove the CoBlick server from the coding agent when you no longer use it.

2. 2
   Revoke its token or connection

   Use Manage access for agent access or Direct install for a project token.

3. 3
   Archive a retired project

   Archiving revokes that project's tokens and coding agent connections. Files already added to your project are not deleted.

Account export and deletion are available from the dashboard. Read the Trust center and Privacy notice for the full policy.