Privacy policy

Last updated 6 November 2026

The short version: Cobalt doesn't collect any data. It has no analytics, no tracking, no advertising and no accounts of its own. It only ever talks to Azure DevOps, using the access token you give it.

What Cobalt stores on your device

Access tokens: kept in the iOS Keychain, set so they stay on this device and aren't included in backups or synced to iCloud.
Settings: the organisations you've added, your name as Azure DevOps reports it, items you've pinned or viewed recently, files you've marked as viewed in pull requests, and your app preferences, kept in the app's own storage.

Removing an organisation in Cobalt deletes its token from the device, and a fresh install clears anything left behind by an earlier one. Removing it from Cobalt doesn't revoke it: revoke the token in Azure DevOps if you no longer need it.

If you turn on Face ID in Cobalt's settings, iOS checks your Face ID, Touch ID or passcode and only tells Cobalt whether it succeeded. Cobalt never sees your biometric data.

Who Cobalt connects to

Cobalt connects directly from your device to Azure DevOps (dev.azure.com, its search and identity services, and the older visualstudio.com addresses), using the token you add, to read and change the things you ask it to. It doesn't use a relay or server of its own, and it makes no other network connections, apart from images in Markdown you view and links you tap, which open in Safari.

If you turn on notifications, Cobalt checks Azure DevOps in the background and shows notifications from your device. Nothing passes through a notification server.

Your use of Azure DevOps is covered by Microsoft's privacy statement and your organisation's policies. Changes made through Cobalt are recorded in Azure DevOps like any other change you make.

Data we collect

None. Cobalt has no third-party SDKs, analytics, crash reporting services or advertising. If you opt in to sharing crash reports or diagnostics with app developers in iOS Settings, Apple may share anonymised crash logs with us under Apple's privacy policy.

If you install a beta through TestFlight, Apple shares the information described in its TestFlight privacy notice, such as your name, email and any feedback you choose to send.

This website

This website doesn't use cookies or analytics. Fonts are loaded from Google Fonts, which receives your IP address when you visit.

Children

Cobalt isn't aimed at children and doesn't knowingly collect information from anyone.

Changes

If this policy changes, the new version will be posted here with a new date at the top.

Contact

Questions about privacy? Email cobalt@mattoddie.dev.