Who controls the data
InstaBlick LLC is the controller for CoBlick UI account and app data. Contact help@coblick.com or visit instablick.com for privacy requests.
Data we collect
- Account data such as name, email address, avatar, verification state, and secure password hashes.
- Session and security data such as session identifiers, device or browser details, IP address, and authentication timestamps.
- Billing data such as Stripe customer and subscription identifiers, plan, interval, status, renewal timing, and checkout events. Stripe, not CoBlick UI, handles full payment-card details.
- App data such as saved blocks, project-token details, personal access-token details, connected AI coding agent names, permissions, connection dates, support messages, and block activity needed to provide the service. When an AI coding agent uses CoBlick, we record the CoBlick action, selected block, status, timing, and small counts. We do not store prompts, conversations, provider API keys, or downloaded block files in this activity record.
- Service data such as request, error, security, and installation logs.
Why we use it
We use account, billing, and app data to perform the contract, provide access, fulfill purchases, prevent abuse, secure accounts, answer support requests, and maintain the service. A first-party, cookie-free conversion record measures a small set of app steps using a pseudonymous daily identifier and is deleted after 90 days. We use records where necessary to comply with tax, accounting, consumer, and legal obligations. Optional analytics or marketing that requires consent will not be enabled without an appropriate consent choice.
Service providers and transfers
Data may be processed by vendors used for hosting and infrastructure, PostgreSQL database hosting, Stripe billing, Resend email delivery, security, and support. When you connect an AI coding agent, that agent receives the CoBlick responses it requests. Your provider API key remains in the agent and is not sent to CoBlick UI. We limit vendors to the data needed for their role and use contractual or other lawful safeguards for international transfers where required.
Retention
Account and subscription data is kept while the account is active. Browser connection tokens are removed when the connection is disconnected or after they expire. Unused connection registrations are removed after seven days. MCP access tokens expire after 90 days and can be revoked at any time. AI connection activity expires after 30 days. After account deletion, data is removed or anonymized unless it must be retained for billing, fraud prevention, dispute handling, backups, or legal obligations. Security and service records are kept only for the period reasonably needed for those purposes.
Privacy requests
Depending on your location, you may request access, correction, deletion, restriction, portability, or objection. You may withdraw consent where consent is the basis and complain to your local data-protection authority. We may need to verify identity before completing a request. Email help@coblick.com.
Cookies and sessions
CoBlick UI uses essential cookies or local storage for authentication, security, and interface state. These are required to provide signed-in features. Any non-essential analytics or advertising cookies will require a separate choice before use.
Security and children
We use access controls, hashed passwords and tokens, short-lived browser connection tokens, signed billing webhooks, and encrypted transport in production. No system is perfectly secure. CoBlick UI is not directed to children under 16, and we do not knowingly create their accounts.