Skip to content

Privacy Policy

Effective: October 27, 2026

1. Scope and contact

Just Cobuild, Co. operates co.build ("we," "us," or "our"). This notice covers personal information handled for the directory, community features, project research, and related correspondence. Where applicable data protection law uses the term, we are the controller for processing whose purposes and means we determine.

Contact: dev@co.build.

This notice explains information practices; it is not a request for blanket consent. Accepting the Terms or reading this notice does not supply consent for an activity that legally requires a separate choice. Third-party projects and services, including GitHub and tools you independently choose, may also process information for their own purposes under their own notices. This notice covers our processing and processing carried out on our behalf; it does not govern those services' independent processing.

2. Information handled

  • Sign-in and account information. You can sign in with GitHub or an emailed link. GitHub supplies profile and account information, including name, email address, avatar URL, username, and GitHub account identifier, and handles entry of your GitHub credentials. Email sign-in uses the address you provide to send a sign-in link through Resend. We store your address, account name, email-verification status, and verification records, including a hashed sign-in token and expiry information. The account database also stores authentication-related identifiers, tokens supplied by a sign-in provider, and associated timestamps or expiry information. GitHub and email sign-in can link to the same account when their verified addresses match.
  • Connected apps. When you authorize an app or agent, we store the app identifier, its connection to your account, the permissions you grant, and associated timestamps. Authentication records also include access and refresh token records and expiry or revocation information. Registered apps supply metadata such as their name, website, icon, and callback addresses. We use these records to provide and check the app's access.
  • Sessions and technical information. Session records include an identifier, token, expiry and timestamps, and can include IP address and browser user-agent information. Requests to the site and its providers also expose technical information such as IP address, requested address, browser information, and request timing. Some of this information may appear in operational or diagnostic records; a session's expiry does not establish a log-deletion period.
  • Contributions and activity. We store comments, replies, optional result reports, device model and firmware information you supply, votes, device watches, requests, and project submissions, with account associations and timestamps. A device request can include the changes you picked for the device. Submissions can include a repository link, project name, summary, setup information, and retrieved GitHub metadata.
  • Installation reports from agents. If you connect an agent and approve a report, we store the mod and device, the hardware model if known, platform, firmware and mod versions, whether installation completed and whether functions were tested, whether the agent observed the result or you reported it, the agent's name and any AI model name it reports, and short notes on what was tested, what blocked setup, how it was fixed, setup time, prerequisites, steps, and tips. Before you approve, we keep a private preview with the app identifier that prepared it; after approval we keep the approved version's fingerprint, the consent version, and the time. If you ask for a check-in, we store its due time, status, and delivery attempts. We check the mod's public releases and may notify the reporter when a newer one is out.
  • Photos and edit history. Where you can edit a listing, we store uploaded photos, their descriptions, dimensions and URLs, upload times, account associations, and before-and-after photo lists. An upload can be stored even if you do not save it to a listing.
  • Notifications and email preferences. We store notifications about replies, new mods for watched devices, and devices you requested being listed, their account and content associations, creation times, read status and email-sending status, and your weekly-email preference.
  • Research records. Research can use submitted text, repository information, existing listings, and comments used to refresh listings. Records include research subjects, drafts, source material, outputs, status, error information, and workflow references. Processing can create copies separate from the original contribution.
  • Public-source information. We obtain project and contributor information from GitHub and other public pages, including Reddit and X. This can include names or usernames, avatars, biographies, author information, public posts, links, and project activity. People mentioned in these sources need not have a co.build account.
  • Correspondence and reports. If you contact us or submit a privacy, copyright, safety, or other report, we receive the information you send and the details needed to handle it.

Please do not submit passwords, access tokens, private device exports, medical records, or other confidential or sensitive information unnecessary to describe a project or technical result. A technical discussion can still identify a person or reveal health information. This request does not remove our obligations if personal information is received.

3. Public information and private account activity

Comments, replies, and result reports are public, including any model or firmware information you add. Public comment data includes the contributor's display name, username when available, avatar, and an account-linked identifier used by the site. Profile updates at sign-in can change the information associated with existing posts. A public contribution can also reveal any identifying information written in its text.

Installation reports you approve are published as comments under your account and show the device, model, platform, versions, status, notes, and the agent's name. Reports also feed public counts of owners who installed or tested a mod, and a written summary of what owners report.

For a new account created through email sign-in, the part of your email address before the @ becomes your display name. That name appears with public contributions, including posts made by a connected app. There is currently no self-service name-change control; contact dev@co.build to request a correction.

Directory entries can show public project authors and contributors, including usernames, avatars, and a short biography obtained from public sources. Publication on another site does not make information free of privacy or intellectual-property rights.

Votes and watches are associated with accounts internally; public directory views use counts. Requests and project submissions are reviewed rather than published as a public submission feed. Their project information and text can inform a published listing or summary, and research providers can process that material as described below. These features are not a confidential channel.

Photos uploaded for listing edits use publicly accessible storage URLs, including before an uploaded photo is saved to a listing. Photo descriptions become public when saved to the listing. Removing a photo from the current listing does not necessarily remove its stored file or edit history. Do not upload private photos for listing edits. Photo search is handled separately, as described in section 5.

Account email addresses, authentication tokens, and session records are not intended for public display. Public pages, images, and posts can be copied, indexed, or retained by others. Removing a source or account does not automatically remove every such copy.

4. Purposes

Information is used to provide sign-in, send sign-in links, and deliver requested account features; authorize connected apps and check their permissions; publish contributions and counts; store photos and edit history; deliver notifications and notification emails according to account settings; review requests and submissions; research, prepare, correct, and maintain directory content; operate and diagnose the service; address abuse and rights complaints; respond to correspondence; and meet applicable legal obligations or establish, exercise, or defend legal claims.

Account information is necessary for features that require sign-in. Posting a comment, voting, watching, or submitting a request is optional. You can use public directory information without contributing account-linked content.

5. Research and AI processing

A device request or project submission can create a research draft. Research may remain queued for later work or be completed outside the online workflow by administrators. When the online research workflow runs, it uses Vercel AI Gateway to access an Anthropic model and can call the research services described in section 6. It prepares content for review; it is distinct from an agent you run yourself.

Research inputs can include your submitted description and repository link. Refreshing an existing listing can include recent comment text and reported results. The prompt construction does not separately add the submitter's account name or email address, but submitted text, comments, listings, and retrieved pages can themselves contain identifying or sensitive information. Search queries and page requests derived from that material may also disclose it to research services.

Typing a device name into the request form sends that text to OpenAI to check whether we already list the device, whether it names a specific model, and which changes owners of it commonly want. This can happen before you sign in or send the request. The check does not add your account name or email address, but the text you type can itself identify you if you include identifying details.

Photo search sends a resized copy of your selected photo to OpenAI only when you choose Identify device. The browser and server remove image metadata before sending it. We do not save these photos to our database or public image storage, and request that the API response not be stored. OpenAI may retain data under its own processing and abuse-monitoring policies. The visible contents of a photo can still contain personal information; keep personal details out of the frame. The suggested device name becomes a search query only when you confirm the search.

When an agent prepares an installation report, the free-text notes and any AI model name are sent to OpenAI for a privacy review that removes personal details before you see the preview. We first remove common identifiers such as email addresses, local file paths, and network addresses ourselves. If the review cannot complete, notes are not published. To summarize what owners report about a mod, we send OpenAI the already-reviewed public text of that mod's reports, without account names. We request that these responses not be stored. Automated redaction can miss things; review the preview before approving it.

Research records, workflow inputs and results, and copies processed by providers may remain separate from the original contribution or account. Removing the original does not automatically remove those copies. See section 9 for retention and deletion.

If you copy a co.build prompt into your own coding agent, that provider processes what you give it under its own arrangements. Copying the prompt does not itself send your local files to co.build. A prompt may ask the agent to prepare a report link containing the mod, model, firmware, and result in its URL. Opening that link sends those URL values to the site and redirects them to the relevant mod page; that redirect does not itself publish a comment or result. URLs can also appear in browser history and other request records. Avoid adding sensitive information to them.

6. Providers and other recipients

The services used depend on the feature and research configuration:

  • GitHub handles OAuth sign-in and answers repository and public contributor lookups. Research can request repository descriptions, documentation, releases, commits, and issues. GitHub also receives requests for images loaded from its services.
  • Vercel provides the AI Gateway used by the online research path and Vercel Blob image storage. The gateway can process research prompts, included source material, tool results, and related request information. Images saved for public listings use publicly accessible Blob URLs.
  • Resend sends sign-in links, notification emails, and a check-in email you ask for after an installation report, when email delivery is configured. It receives the recipient address, subject and email content, including the sign-in link or relevant notification details, links and any quoted reply text. Email providers and recipients can retain copies outside the original comment or account. Keep sign-in links private: someone with a valid link can use it to sign in.
  • Connected apps and agents receive account information and can act for you according to the access you authorize. This can include your account identifier, profile information, email address, and the results of API actions such as posting a comment, submitting a request, voting, or preparing, publishing, listing, or withdrawing installation reports you approve. Apps receive tokens for their granted access. If you allow an app to stay connected, it can renew access without a new sign-in each time. Review the permissions shown when connecting and the app provider's privacy notice; its independent processing follows its own practices.
  • Anthropic supplies the model in the online research path through the AI Gateway. Model processing receives research prompts and the source or tool results included in them.
  • OpenAI receives the device name typed into the request form, photos you submit for photo search, installation-report notes for privacy review, and reviewed public report text for owner summaries, with related request information, for the features described in section 5.
  • Exa receives web-search queries and returns search results and excerpts used in research.
  • Reddit receives searches made through its public search endpoint and returns posts and related information.
  • context.dev can receive page URLs for extraction of page text and images, as well as domain lookups for brand information and logos.
  • Kernel can run a hosted browser to read research pages, processing the requested pages and their content. The visited sites and resources can receive the resulting network requests.
  • An X reader service can receive search queries or public-post URLs and return post or thread text. The configured default service is x.pcstyle.dev; a different configured reader may be used. X's own syndication service can also supply public post statistics.
  • Other website and infrastructure recipients include sites fetched directly during research and the hosting, database, and communications services needed to store records, serve pages, or handle correspondence. Remote images, including avatars, may cause your browser to contact the image host and disclose ordinary request information.

A provider's own policy does not replace our obligations for processing on our behalf.

We may disclose relevant information to advisers or authorities when needed for a legal obligation, valid legal process, a rights or safety matter, or a legal claim. Copyright notices and counter-notices may be shared with the other party, including contact details required by the applicable procedure. A proposed or completed corporate transaction can require disclosure to relevant parties, subject to applicable confidentiality and data protection requirements; it does not itself authorize an incompatible new use.

Advertising and sale of information

co.build does not run ads. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We do not use personal information for the types of profiling subject to opt-out rights under U.S. state privacy laws.

7. Cookies and browser storage

co.build uses cookies and local browser storage for sign-in and interface behavior. We do not use analytics, advertising, or tracking cookies, and we do not load third-party trackers.

  • Authentication cookies support GitHub and email sign-in, session recognition, and connected-app authorization. The authentication session cookie is HttpOnly, so ordinary page scripts cannot read it. Session validity can be renewed during use and ends on expiry or sign-out; this is separate from retention of server records and an app's granted access.
  • The signed-in display hint is a separate cookie named signed-in. It tells the interface to reserve space for the account menu while the session loads. It is readable by page scripts, is not the authentication credential, and is set for up to seven days, refreshed or cleared as the interface updates its sign-in state.
  • Theme preference is stored locally by the theme feature, normally under the key theme, to remember your light, dark, or system preference. Local storage has no built-in cookie-style expiry and remains until changed or cleared by you, the browser, or the site.

Our no-sale and no-targeted-advertising practices apply whether or not your browser sends a Global Privacy Control or Do Not Track signal. These signals do not turn off cookies needed for sign-in.

Browser settings can block or clear cookies and site storage. Blocking authentication cookies can prevent sign-in; clearing preference storage can reset appearance. Other sites, including GitHub's sign-in pages, control their own storage. Third-party image or page requests can disclose technical information even without an advertising cookie.

8. Legal bases where European or UK data protection law applies

We rely on the following bases for the uses described in this policy, where applicable:

  • Contract necessity: information necessary to provide the account and interactive features you request under an agreement with us. This does not make unrelated research or advertising necessary to that agreement.
  • Legitimate interests: maintaining a useful and accurate directory, appropriately limited public-source research, service security, moderation, and handling claims, where the processing is necessary and your interests and rights do not override ours or those of others.
  • Legal obligations: processing necessary to comply with a legal duty that actually applies to us.
  • Consent: a specific activity for which applicable law requires consent, obtained separately and capable of withdrawal. Acceptance of the Terms or this notice is not a substitute.

Sensitive information can require an additional legal condition. Public availability, a device-related topic, or the content license in our Terms does not itself supply one. You may object to processing based on legitimate interests as described below.

9. Retention and deletion

We retain personal information for the purposes described in this policy. How long depends on whether an account or feature remains in use; whether content or research is still needed for an accurate listing; the need to resolve a request, abuse report, dispute, or legal obligation; the sensitivity of the information; and applicable deletion and recovery requirements. We do not retain personal information indefinitely merely because storage is available.

Account records, authentication records, activity, public contributions, research history, operational records, images, and provider copies do not all have the same deletion mechanism. Session expiry and signing out end that session's authenticated access; they do not establish when all stored copies disappear.

Sign-in verification records, app authorizations, and token records are also subject to these retention principles. A sign-in link or token expiring does not by itself delete every related record. Disconnecting an app removes its authorization to act through our API, but does not delete prior contributions, operational records, or copies the app already holds.

Deleting a comment or reply through the available control clears its text, result, model, and firmware fields and hides its public author information. A record remains to preserve discussion structure, and the internal association with the account is not cleared by that comment-delete action.

Installation-report previews expire after 30 minutes and are deleted within 48 hours. Withdrawing a report, from My devices or through your agent, or deleting its comment, clears its public text and report details, deletes related previews, and cancels a pending check-in. A check-in email already handed to Resend cannot be recalled. Owner summaries are regenerated without withdrawn reports.

Account removal and content removal are separate. If we delete the user record for your account, its linked sign-in records, votes, watches, notifications, requests, submissions, and drafts attached to those requests or submissions are deleted from those database tables. Comments lose their account association, but their text and any information identifying you within it can remain unless separately removed. Photo-upload and photo-edit records lose their account association but can remain, as can the stored files and descriptions. Other drafts, published listings, workflow records, images, emails, logs, backups, or provider copies can require separate handling. Removing an account association does not make all remaining content anonymous.

For a deletion request, identify whether you want account removal, removal of particular contributions or profile details, or both. We will assess the relevant records and take the action required by applicable law, including required steps concerning recipients. We may retain information when law permits it for a concrete legal, security, or dispute purpose, and will explain a material refusal or limitation where required. Copies controlled independently by other people or services may require a separate request to them; that does not excuse our own obligations.

10. Your choices, rights, and appeals

Use the available controls to delete your comments or replies and change votes or watches. Weekly emails summarizing unread notifications are enabled by default for eligible accounts. Turn them off in the notification bell settings or through an email's unsubscribe link. Notification emails can include a reply excerpt; deleting the reply later does not recall an email already sent. An email preference does not turn off the in-site notification list. For account requests, correction of a public-source profile, or other personal information requests, contact dev@co.build. You do not need a co.build account to ask about information obtained from public sources. Identify the relevant content or account using only what is needed; do not send passwords or tokens. We may request proportionate information to verify identity or authority.

Depending on the law that applies and its conditions, you may have rights to:

  • Know about processing and recipients, access information, obtain a copy, correct inaccuracies, or request deletion.
  • Request restriction of processing in circumstances provided by applicable law.
  • Withdraw consent for a consent-based activity without affecting processing lawfully performed before withdrawal.
  • Opt out of a sale, targeted advertising, or specified profiling, or limit certain sensitive-data uses, where those activities occur and the law provides the right.
  • Use an authorized agent where the law permits, and receive a response within the applicable legal period.
  • Appeal a denied request where an appeal right applies, and complain to the appropriate privacy regulator.

Right to object. Where the GDPR or UK GDPR applies, you may object at any time, for reasons relating to your situation, to processing based on legitimate interests, including public-source research. Contact dev@co.build to exercise this right. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims.

To appeal, reply to our decision or contact the same address and identify it as a privacy appeal. We will explain the outcome and available regulator complaint route where required. We do not penalize you for exercising a legal privacy right; a feature may nevertheless need the information necessary to provide it.

You may also complain to us about our handling of your personal information at dev@co.build. Where UK data protection law applies, you have a right to make that complaint to us. We will acknowledge and respond to complaints as required by applicable law.

For EEA matters, you may contact your competent data protection authority; for UK matters, you may contact the Information Commissioner's Office. Our process does not limit your right to complain to a regulator; a regulator may ask you to raise your concern with us first.

You can also revoke co.build's GitHub authorization in GitHub's settings. Revocation is distinct from deleting existing co.build records and may not immediately end an existing co.build session; sign out and separately request deletion when needed.

To withdraw a connected app's access, open Connected apps from your account menu and select Disconnect. Our API checks that the app remains connected on each authenticated request, so disconnecting stops it from acting for you through the API until you authorize it again. Signing out of the website alone does not withdraw an app's access. Disconnecting does not undo earlier actions or delete information the app already received; contact its provider about those copies.

11. International processing and security

Information may be processed outside the country where you live by the recipients described in section 6. Data protection laws and government-access rules can differ between countries. Any transfer restricted by applicable data protection law requires a valid transfer basis; accepting this policy does not supply one. Contact dev@co.build for information about relevant processing locations and any applicable transfer safeguards.

No online service can guarantee that unauthorized access, loss, or disclosure will never occur. Report a suspected security or privacy issue to dev@co.build. This notice does not limit security or breach-response duties imposed by applicable law.

12. Children and sensitive information

co.build is intended for adults aged 18 or over. People under 18 should not create an account or submit personal information. If you believe information about a child has been collected, contact us so it can be assessed and handled as applicable law requires.

The directory is not a place to submit medical records or request individualized healthcare advice. If a technical contribution nevertheless contains health or other sensitive personal information, its handling remains subject to applicable law; its presence on a public page does not automatically remove those protections.

13. Changes to this notice

The effective date appears at the top of this notice. We will provide notice of material changes as required by law and obtain a separate choice or consent when required for a new use. Updating a notice does not retroactively authorize undisclosed or incompatible processing of information already collected.