The short version
We collect what an order needs and very little else. We do not sell your data, we do not share it with advertisers, and there is no fuckin tracking here that follows you around other sites.
- An email address, so we can deliver your order.
- What you bought, so you have a record of it and we can support it.
- Deposit references, so a payment can be matched to your balance.
The rest of this page is the same thing said precisely.
What we collect
Account information. Your email address, a password (stored only as a cryptographic hash — we never see the password itself), and anything optional you add to your profile such as a display name, avatar or saved address.
Order information. The products you bought, what you paid, the delivery email, and the codes issued to you.
Payment information. The cryptocurrency you chose, the amount, the deposit address we showed you, and the transaction reference. We never see and never hold your wallet's private keys or seed phrase, and we could not access your wallet if we wanted to.
Payment screenshots. If you upload a screenshot to confirm a payment, we hold it only to verify that payment.
Technical data. IP address, browser and device type, and the pages you requested — the standard information a server receives in order to answer a request, used for security and diagnostics.
We do not ask for and do not want your card details, your bank details, or any government ID.
How we use it
- To deliver what you bought and to keep a record of it for you.
- To credit your wallet when a deposit confirms.
- To answer support requests and investigate problems with an order.
- To detect and prevent fraud, abuse of offers, and unauthorised access.
- To keep the accounting and tax records the law requires us to keep.
We do not use your data to build advertising profiles, and we do not make decisions about you by automated means that produce a legal effect.
Payments and the blockchain
Cryptocurrency payments are recorded on public networks. A transaction you send is visible to anyone, permanently, by design — we do not put it there and we cannot remove it.
What we store on our side is the transaction reference, the asset, the amount and the time, so a payment can be matched to your account.
Deposit addresses shown to you are ours. Your own wallet address is only ever known to us to the extent the network reveals it.
Payment screenshots
Screenshots you upload are sent directly to a dedicated image host and are not written into our main database alongside your account record. That separation is deliberate: an image proving a payment does not need to sit next to your order history to do its job.
They are used for one thing — confirming that a payment you say you made was made — and are removed once that has been settled.
Your rights
Depending on where you live, you have some or all of these rights over your data:
- Access — a copy of what we hold about you.
- Correction — to have something inaccurate fixed.
- Erasure — to have it deleted, where we are not required to keep it.
- Portability — a copy in a machine-readable format.
- Objection and restriction — to ask us to stop or limit a particular use.
- Withdrawal of consent — where a use rests on consent, at any time.
Email support@cobalt.com to exercise any of them. We will respond within 30 days, and we will not charge you for it or treat you differently for asking.
If you think we have handled your data badly, you can also complain to your local data protection authority. In the UK that is the Information Commissioner's Office.
Security
Traffic to the site is encrypted in transit. Passwords are stored only as hashes. Access to production data is limited to the people who need it to operate the service.
No system is perfectly secure, and anyone claiming otherwise is selling something. If we ever discover a breach affecting your personal data, we will tell you and the relevant authority as the law requires.
We will never email you asking for your password, your wallet's seed phrase, or your private keys. Nobody at COBALT needs them, and any message asking for them is not from us.
Where your data is held
Our providers may store or process data outside your country. Where data leaves the UK or EEA, it is protected by an approved transfer mechanism such as the UK Addendum or Standard Contractual Clauses.
Children
This service is not for anyone under 18, and we do not knowingly collect data about children. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
We will update this page when what we do changes. The date at the top always reflects the last revision, and material changes will be brought to your attention rather than quietly published.
Contact
Any question about your privacy, or any request about your data, goes to support@cobalt.com.