1. Overview and Local Storage
Cobalt is a free, open-source personal capture and knowledge archive. Your notes, captured media, and organizational data are stored locally on your device. Cobalt does not operate a user account system, and there is no Cobalt cloud note synchronization service.
Saved notes, Markdown files, media recordings, and database tables are stored in Cobalt's private application storage without separate app-level encryption. Optional service credentials—specifically your Gemini API key, TMDb API key, and Trakt OAuth tokens—are stored encrypted using Android Keystore (AES-256-GCM). Hardware backing for this storage depends on your device hardware and Android platform support.
2. Optional AI Features
When you use Gemini-powered OCR, Cobalt transmits the cropped screenshot region you selected. If you do not select a crop region, the entire captured screenshot is transmitted. When you use voice memo transcription, Cobalt sends the recorded audio file. When you format speech text, Cobalt sends the transcribed text and formatting instructions.
These requests are sent to Google's Gemini API over HTTPS using the Gemini API key you provide. Cobalt tracks aggregate token counts and request counts locally on your device to show your usage; these counters are never uploaded or shared.
3. Media and Remote Content
When you search for movies and TV shows, Cobalt contacts The Movie Database (TMDb) using your configured API key. When you search for anime, Cobalt contacts Jikan; new anime searches require an active internet connection, though previously saved anime details can be viewed offline. Uncached remote images will not load while offline.
Posters, backdrops, cast photos, user avatars, and other remote images load automatically when media cards or details are displayed. When you save or share a URL, Cobalt automatically contacts the host website to fetch page titles and preview metadata. Opening saved items that reference remote media may download and cache those media files locally. Cobalt does not contact OMDb; that integration is unused.
4. Trakt Synchronization
Connecting Trakt is optional. Authentication uses OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange) via an external browser or Chrome Custom Tab redirecting to https://cobalt.hanan-bhatti.site/callback, with an alternative Device Code flow (trakt.tv/activate) supported for convenience. Cobalt never handles or stores your Trakt password and never embeds a client secret in distributed software.
When connected, Cobalt reads your Trakt profile, watched movie and TV history (including episode plays), ratings, and watchlist. Cobalt sends updates to Trakt when you mark movies or episodes as watched, rate items, or change watchlist status. Cobalt runs an initial sync upon connecting and updates when you tap "Sync Now". Cobalt does not run scheduled periodic background sync.
Disconnecting Trakt clears your stored Trakt tokens and session details locally and attempts server-side revocation on Trakt's servers. If your device is offline or the revocation request fails, local disconnect still completes, and you can revoke Cobalt's access at any time through your Trakt account settings on trakt.tv. Previously synchronized items remain in your local Cobalt library. Disconnecting Trakt, uninstalling Cobalt, or deleting local items does not remove your watch history, ratings, or watchlist from your Trakt account.
5. YouTube Trailers
Trailer playback in media details uses an embedded Android WebView that loads the YouTube embed player. Network requests to YouTube and Google begin automatically whenever you open the detail screen of a movie or TV show that includes a trailer link.
The embedded player runs with JavaScript, web storage, and third-party cookies enabled. YouTube and Google process these requests under their own terms and privacy practices. This external web playback is independent of Cobalt, which contains no analytics or tracking SDKs.
6. Crash Reports and Feedback
Cobalt does not include an analytics SDK and does not automatically upload crash reports.
When an unexpected crash occurs, Cobalt writes a report locally. Crash reports include the app version, device manufacturer, device model, Android OS version, thread name, timestamp, exception message, and technical stack trace. Because exception messages and stack traces are not redacted, they may contain sensitive details such as file paths, identifiers, or URLs associated with the crash.
Selecting "Send" opens an external email chooser. The report is sent only if you complete the action inside your email application. The developer receives the report and your email address. If you use in-app feedback export, a Markdown copy is saved to the app's cache directory and shared through your chosen application. Crash report and feedback files in cache are not automatically deleted.
7. Sharing, Retention, and Deletion
Exporting or sharing content is initiated by you. Note exports are generated as plaintext Markdown; app settings and API credentials are excluded, but any personal information or secrets written inside your notes will be included in the export. Shared copies are handled by the destination app you choose. Temporary share copies remain in the app cache until cleared.
Deleted items move to Trash and are kept for 30 days before automatic removal, or you can delete them permanently at any time. Automatic Android backup and device-to-device transfers are disabled in Cobalt's configuration, though behavior can vary across customized operating system builds. Clearing app storage or uninstalling Cobalt removes your local notes, media, and credentials permanently. Externally saved exports and data stored on third-party services like Trakt remain unaffected.
8. App Updates
Cobalt can check GitHub for application releases. Automatic release checks are disabled by default. Manual checks in the Release Updates screen contact GitHub's API. Cobalt sends standard HTTP request headers without user identifiers or personal data. Cobalt does not automatically download or install app updates; update links open the GitHub releases page in your browser.
9. Third Parties, Website Hosting, and Contact
Third-party services—including Google Gemini, TMDb, Jikan, Trakt, YouTube, and GitHub—operate independently of Cobalt. Their own terms and privacy policies govern how they handle connection metadata and request content.
Cobalt uses Trakt but is not endorsed or certified by Trakt. Cobalt uses the TMDB API but is not endorsed or certified by TMDB.
This public website is hosted as a static site on GitHub Pages. The website serves static files only, sets no tracking cookies, loads no external fonts or tracking scripts, and collects no personal data or login credentials.
For privacy questions or concerns, contact hannanbhatti2006@gmail.com.
Cobalt's source code is publicly inspectable at:
github.com/hanan-bhatti/cobalt