Skip to main content

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains what information Cowpin ("Cowpin", "we", "us"), operated by Cowpin LLC, collects, how we use it, and the choices you have. Cowpin is a bookmark-management service available at cowpin.com. If you have questions, contact us at help@cowpin.com.

Information we collect

  • Account information. When you sign up, we collect your email address and name. If you sign in with Google, we receive your basic profile (name, email, profile picture) from Google — we never receive your Google password.
  • Content you save. The bookmarks you create — URLs, titles, notes, tags, and read-later/privacy settings.
  • Archived page text. When you save a bookmark, we fetch the page and store a text copy of its contents so your saved links remain searchable and readable even if the original goes offline. We identify ourselves as Cowpin/1.0 when fetching.
  • Usage analytics. We use no advertising trackers, no tracking cookies and no third-party analytics scripts (we removed Google Analytics on 18 October 2026). We measure aggregate traffic and the use of main buttons in two ways. First, Vercel Web Analytics (our hosting provider's analytics), which is cookieless. Second, our own counters, which store daily totals only — for example "page /pricing viewed 12 times today, mostly from search engines" or "the Windows download button was clicked 3 times today on the home page" — with no IP address, no cookie, no account identifier and no device fingerprint. None of this tracks you across websites or builds a profile of a visitor.
  • Daily visitor count (no cookie). To count unique visitors without a cookie we use the same method as privacy-focused analytics tools such as Plausible and Fathom: when a page loads, our server computes a one-way hash of your IP address and browser identifier together with a random value ("salt") that changes every day. The IP address itself is never stored. With that hash we record, for that day only, your country (as reported by our hosting provider's network, not looked up from your IP), device type (desktop/mobile/tablet), browser and operating system family, the site that referred you, the first page you opened, how many pages you viewed and how long pages were visible. The daily salt is deleted after two days, and so are these per-visitor rows, once they've been added into daily totals; after that nobody, including us, can link a visit to an IP address or to your visits on other days. If you create an account on the same day, we note which site referred you and which page you first opened. Nothing is stored on your device for any of this. If your browser sends a Global Privacy Control or Do Not Track signal, we skip this step entirely and only count the page view in the anonymous daily total. Legal basis: legitimate interests (understanding which pages and channels work), Art. 6(1)(f) GDPR.
  • Newsletter. If you subscribe, we store your email address and when you subscribed. About once a week, only when something changed, we send what's new in Cowpin and new blog posts. Newsletters contain no tracking pixel: we don't record whether you opened an email. Links go through cowpin.com so we can count how many times each link in an issue was clicked, in total — the count isn't tied to you or your address. We do keep whether each email was delivered or bounced, so we can stop mailing addresses that fail. Every issue has an unsubscribe link (and your mail app's one-click unsubscribe works too); unsubscribing stops all newsletter mail immediately. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.
  • How you use Cowpin, when signed in. For your account we count, per month, how many times you use the main features (for example saves, imports, searches, tags and AI features) and which of our apps you use. We store counts and labels, never the content of your searches, your bookmarks' text or anything you type, and we use them only to understand which features to improve. They're deleted with your account.
  • Technical data. Standard server logs (e.g., IP address, request time) needed to operate and secure the service.
  • Which Cowpin app you use. For your account we record which of our apps you used each day (the website, the Mac, Windows, Linux or mobile app, the browser extension, the command-line tool or an AI-agent connection) and how many bookmarks you saved from each per month. It's a label and a count, nothing about your device, and it helps us decide which apps to improve.
  • Billing information. If you subscribe, Stripe (our payment processor and merchant of record) collects your payment details. We receive your subscription status, plan, renewal date and a Stripe customer ID — never your full card number.
  • AI usage counts. We count how many times each AI feature is used per account per month, to apply fair-use limits and understand our costs. We store the counts, not the content of your requests.
  • Affiliate information. If you join the affiliate program, we store your affiliate code, PayPal email for payouts, the website you told us about, and the commissions you've earned. If you signed up through an affiliate's link, we record which affiliate referred you so they can be paid. Affiliates see only counts and amounts (signups, paying customers, earnings), never who you are.

How we use your information

We use your information solely to provide and improve Cowpin: to authenticate you, store and display your bookmarks, power search and AI features, send you service email (such as sign-in codes and account notices), and keep the service secure and reliable. We do not sell your personal information, and we do not use your bookmarks to serve advertising.

AI features

When you use AI features (for example "Ask your bookmarks", tag suggestions, or summaries), the relevant text — your question and the content of the bookmarks involved — is sent to our AI provider (currently OpenAI) to generate the result. We send only what is needed to produce the response. We do not use your content to train our own models.

Service providers

We rely on a small number of trusted providers to run Cowpin, who process data only on our behalf:

  • Supabase / Amazon Web Services — database and file storage (hosting your account and bookmarks).
  • Vercel — application hosting.
  • Google — sign-in (OAuth), if you choose it.
  • OpenAI — powering the AI features described above.
  • Stripe — subscription payments; Stripe acts as merchant of record and processes your payment details and sales tax.
  • PayPal — paying commissions to affiliates (only if you're an affiliate).
  • Brevo — sending transactional email (sign-in codes, account notices).
  • Amazon SES — sending operational email and receiving save-by-email messages.
  • Vercel Web Analytics — cookieless aggregate analytics.

Cookies

We do not use advertising or third-party tracking cookies, and nothing we set follows you to other websites. We set these first-party cookies:

  • Sign-in cookies — necessary to keep you signed in and operate the service.
  • We no longer set a referral cookie (cowpin_attr, retired 18 October 2026). If your browser still has one from an earlier visit, our site deletes it.
  • One affiliate cookie (cowpin_via). Only if you arrive through an affiliate's link (a ?via= address), we store that affiliate's code so they're credited if you sign up. It holds just the code, expires after 60 days, and can be deleted at any time.
  • One app cookie (cowpin_client), only in our Windows and Linux apps. It says "windows-app" or "linux-app" so we can tell which app a request came from (see "Which Cowpin app you use"). It holds nothing else.
  • One page-layout cookie (cowpin_lp_variant). We test two versions of our home page; this cookie stores "A" or "B" so you see the same one each visit. It expires after 90 days.

Your rights and choices

  • Access & export. You can export your entire library at any time from the app (Netscape HTML, Pinboard JSON, or XML).
  • Deletion. You can delete individual bookmarks or your whole account. In-app account deletion immediately purges your bookmarks, embeddings, tags, notes, and personal data from our active database; residual copies in backups are purged on our normal backup rotation.
  • Corrections. You can edit your account details, tags, and bookmark content at any time.
  • Paid plans and your data. Cowpin is a paid service after a 14-day free trial. Export tools and privacy controls are always available, whether or not you subscribe. If you don't subscribe, your library is kept read-only and is never deleted because of non-payment; it's deleted only if you delete it or your account.

To exercise any right you can't complete in the app, email help@cowpin.com.

European Privacy Rights (GDPR)

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you have specific rights under the General Data Protection Regulation (GDPR) and UK GDPR:

  • Legal bases for processing: We process your personal data under the following legal bases:
    • Contractual necessity (Art. 6(1)(b) GDPR): To create your account, authenticate you, store and search your bookmarks, generate your reading digests, and deliver the service you request.
    • Legitimate interests (Art. 6(1)(f) GDPR): To secure our infrastructure, prevent spam and abuse, and measure aggregate, cookieless platform usage.
    • Consent (Art. 6(1)(a) GDPR): Where you explicitly opt in to optional communications or experimental features.
  • Your Data Subject Rights (Articles 15–22 GDPR):
    • Right of access (Art. 15): The right to obtain confirmation and a copy of the personal data we hold about you.
    • Right to rectification (Art. 16): The right to correct inaccurate or incomplete personal information.
    • Right to erasure / "Right to be Forgotten" (Art. 17): The right to request permanent deletion of your account and associated data.
    • Right to restriction of processing (Art. 18): The right to restrict how we process your data under certain circumstances.
    • Right to data portability (Art. 20): The right to receive your personal data in a structured, commonly used, machine-readable format.
    • Right to object (Art. 21): The right to object to processing based on legitimate interests.
  • Right to lodge a complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA) / supervisory authority in your EU member state or the UK Information Commissioner's Office (ICO) if you believe our processing violates data protection law.
  • International data transfers: Cowpin's primary databases and servers are hosted in the United States (AWS / Supabase / Vercel). We ensure all service providers maintain adequate safeguards through Standard Contractual Clauses (SCCs) and adherence to the EU-US Data Privacy Framework (DPF).

Data retention

We keep your account and content for as long as your account is active. When you delete content or your account, we remove it as described above.

Security

We use industry-standard measures to protect your data, including encryption in transit (TLS/HTTPS) and encryption at rest. No system is perfectly secure, but we work to protect your information and to promptly address issues.

Children

Cowpin is not directed to children under 16, and we do not knowingly collect their personal information.

International users

Cowpin is operated with infrastructure in the United States. By using Cowpin, you understand your information may be processed there subject to the safeguards described above.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by the "Last updated" date above, and where appropriate we'll notify you.

Contact

Questions or privacy requests: help@cowpin.com.