Privacy Policy

Last updated: September 2, 2026

1. About this policy

This Privacy Policy explains how CogShield processes information when you use the CogShield cognitive security service.

CogShield is currently being prepared for international commercial launch. The legal identity and production contact details of the service operator will be published before commercial launch.

1. Information we process

Depending on how you use the service, CogShield may process:

• Account identity information provided by an authentication provider, including a provider-specific account identifier and, when supplied by the provider, an email address and email verification status.
• Session information required to keep you securely signed in.
• Text or documents that you intentionally submit for analysis.
• Analysis results and related metadata, including analysis type, timestamps, model/provider metadata when applicable, usage information, and risk assessment results.
• Subscription plan, usage counters, limits, and account status information.
• Technical and security information reasonably required to operate, protect, troubleshoot, and prevent abuse of the service.

CogShield does not receive or store your Google password. The current Google sign-in architecture does not require CogShield to store Google access tokens or refresh tokens.

1. How submitted content is used

Text and documents you submit are processed for the purpose of performing the analysis you requested.

When an external AI provider is enabled, submitted content may be transmitted to that provider as necessary to perform the requested analysis. Provider selection, data handling requirements, and applicable contractual safeguards are part of the production service configuration.

CogShield history is designed to retain analysis results and metadata rather than the original source text or uploaded source files.

1. Why we process information

Information may be processed to:

• create and maintain your account;
• authenticate your session;
• provide requested analysis;
• enforce plan limits and service entitlements;
• display your analysis history;
• protect the service against misuse and security threats;
• diagnose technical problems;
• comply with applicable legal obligations;
• improve the reliability and quality of the service.

Where applicable law requires a specific legal basis, processing may rely on performance of the service requested by you, legitimate operational and security interests, compliance with law, or consent where consent is required.

1. Cookies and session security

CogShield uses a strictly necessary secure session cookie named __Host-cogshield_session.

The session cookie is used to authenticate your browser session. It is configured with security protections including HttpOnly, Secure, SameSite=Lax, and Path=/.

This session mechanism is necessary for authenticated parts of the service.

1. Retention

Different categories of information may have different retention periods.

Analysis history currently uses a 30-day retention period. The applicable retention period is also displayed in the product interface.

Original text and uploaded source files are not stored as part of analysis history.

Account, authentication, subscription, security, and legally required records may be retained for as long as reasonably necessary for their respective purposes.

1. Sharing and service providers

CogShield does not sell personal data.

Information may be shared with service providers only where reasonably necessary to operate the service, such as infrastructure, authentication, security, analytics, or AI processing providers when those services are enabled.

Information may also be disclosed where required by applicable law, a valid legal process, or to protect the security and rights of users, the service, or others.

1. International processing

Because CogShield is an international service, information may be processed in countries different from your country of residence.

Where required, appropriate safeguards should be used for international transfers of personal data.

1. Your rights

Depending on applicable law and your location, you may have rights relating to your personal data, including rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where consent is the legal basis.

Requests can be made using the contact details published on the Contact Us page once production contact channels are configured.

1. Security

CogShield uses technical and organizational measures intended to protect account and service data, including secure session handling, restricted database permissions, non-public database networking, and least-privilege application access.

No internet service can guarantee absolute security.

1. Changes to this policy

This policy may be updated as CogShield moves from pre-launch configuration to commercial operation, adds service providers, or changes legal or technical requirements.

The current version will be published on this page.

1. Contact

For privacy or data protection inquiries, see the Contact Us page.

Production operator identity and contact information will be added before commercial launch.