Cobalt
Get Peak Download the app

Privacy Policy

Last updated October 26, 2026

This Privacy Policy explains how Cobalt Simulations (“Cobalt,” “we,” “us”) handles personal information when you use Cobalt Companion (iOS, and any other Companion clients we publish), Cobalt Bridge, Cobalt Peak, cobaltsim.com, api.cobaltsim.com, and relay.cobaltsim.com. It is written to match the product as shipped, not a generic template.

What changed on October 26, 2026

The marketing site now loads the Reddit Ads pixel so we can measure Reddit ads. Peak plan clicks and completed Stripe checkouts are sent to Reddit, including a hashed billing email after a purchase. Reddit is listed under Sharing. This replaces the earlier line that said we do not run advertising pixels.

What changed on October 21, 2026

Companion 2.2.1 and Bridge 1.3.1 added features that move new kinds of data, so this policy now describes them: pilot-edited flight times that sync with your account (section 3); SayIntentions.AI and BeyondATC radio logs read on your PC, and the ATC alert text that passes through our push service (section 3); radio-call pages you choose to share, which upload the audio and transcripts for that flight (section 3); where progressive-taxi airport maps come from (section 3, Integrations); and the on-device Speech Recognition permission (section 4). Nothing in how we sell Peak, share data with processors, or honour your rights has changed.

1. Who we are

Cobalt Simulations operates the Cobalt flight-simulation companion. The public site is cobaltsim.com. The API is api.cobaltsim.com. Away-from-home connections use relay.cobaltsim.com. Privacy and support mail: reports@cobaltsim.com.

For data-protection purposes Cobalt Simulations is the controller of personal data described here, except where a processor (for example Stripe) is an independent controller of payment data, or where a third-party service (VATSIM, IVAO, Giphy, Navigraph, SimBrief, SayIntentions.AI, BeyondATC) is controller of data you give them directly.

2. Scope

This policy covers:

  • Creating and using a Cobalt account (email and password).
  • Using Companion on a phone, iPad, Apple Watch companion, widgets, and Live Activities.
  • Installing and running Cobalt Bridge on a Windows or Mac PC next to Microsoft Flight Simulator or X-Plane.
  • Peak billing on cobaltsim.com via Stripe, Bridge activation codes, and the Peak customer portal.
  • Community features (feed, comments, DMs, follows, Atlas/passport cards you publish).
  • The marketing and support website, including the launch waitlist at /notify and creator referral cookies.
  • Guest / demo use on a single device without an account (local only, until you sign in).

It does not cover third-party sites and programs we link to or read from (VATSIM, IVAO, SimBrief, Navigraph, ChartFox, SkyVector, AirNav, SayIntentions.AI, BeyondATC, Discord, Apple, Google Play) except for the limited data we send or receive to make an integration you turned on work.

3. Information we collect

Account and profile

Email address and a hashed password (stored by our auth provider, Supabase Auth / GoTrue; we never store the password in plain text). Optional display name, handle, avatar, bio, and similar profile fields you enter. Account identifiers (user id) used to sync flights, Peak, Bridge licenses, and community.

An App Store purchase is attached to the Cobalt account that was signed in when you bought it (or when you tap Restore Purchases). For a web purchase, email is the key: use the same address at Stripe checkout as in Companion.

Simulator telemetry and logbook

When Bridge is connected to your simulator, Companion receives live session data needed to draw the map, systems, logbook, Live Activity, Watch complications, and widgets: position and heading, altitude, speeds, aircraft type and systems state (autopilot, engines, fuel, electrical, pressurization, lights), phase of flight, and similar variables the sim exposes. Peak may additionally carry remote-control commands you issue and sim camera frames to your device.

On your LAN this traffic stays between your PC and your phone (plain HTTP/WebSocket on the local network, which is why Companion asks for Local Network permission). With Relay, the same telemetry (and, with Peak, control and camera) is carried through relay.cobaltsim.com so you can leave the house. Bridge can keep recording on the PC (up to about 12 hours) if the phone disconnects, then sync the missing segment when you reconnect.

If you are signed in, flights and traces may sync to our database so Atlas, history, playback, debriefs, and share pages work on other devices. If you use Companion as a guest, that data stays on the device until you create an account.

If you edit a flight’s times (off blocks, takeoff, touchdown, on blocks, or the schedule), the edits are stored beside the recorded values, never over them, and sync to your account with the flight when you are signed in. Reverting removes the edit on every device.

ATC text and alerts

ATC text from your pilot client (vPilot or xPilot) and, with Bridge 1.3 or later, from SayIntentions.AI or BeyondATC running on the same PC, is read by Bridge and sent to your phone like any other live data. To deliver an “ATC is calling you” alert while Companion is closed, Bridge sends the station name and the message text (up to 500 characters) to api.cobaltsim.com, which forwards it to Apple’s push service. We do not keep that text. Replies you send from your phone go back through the same program on your PC.

Radio-call recordings and shared radio calls

Radio-call debrief is optional and off by default. If you turn on “Record my ATC audio for debriefs” in Bridge, Cobalt records the audio you already hear on your tuned frequency, including other pilots and controllers, on that PC only, for personal replay. Audio is deleted after 30 days or when the 500 MB cap is reached; transcripts can stay. Transcription runs on that PC, or on your iPhone with Speech Recognition, never on our servers. We do not upload those recordings to Cobalt unless you share them.

Shared radio calls (Peak): when you tap Share on a flight’s radio calls, Companion uploads that flight’s audio clips and transcripts, its route, times and callsign, and your display name, handle and avatar to our storage so the link (cobaltsim.com/c/…) plays without the app. The page is not listed or indexed, but anyone with the link can open it, and someone who opens it in Companion keeps a copy on their phone under Shared with you, which Stop sharing cannot recall. A share expires 90 days after you last shared it; Stop sharing deletes the page and its audio immediately. Deleting your account removes your shares.

Network overlays (VATSIM / IVAO)

Live traffic and ATC come from those networks’ public data feeds. We do not receive your VATSIM or IVAO password. If you optionally enter a VATSIM CID (or similar public identifier), we use it to show your public network hours on Atlas. Adopting a network flight as “yours” or a friend’s stores that association on your account so Live Activities and follows work. Cobalt is not affiliated with, endorsed by, or partnered with VATSIM Inc. or IVAO. The full trademark and affiliation notice is at https://cobaltsim.com/legal.

Peak and payments

In Companion, Peak is sold as an Apple In-App Purchase (weekly, monthly, yearly, or lifetime; the price shown on the paywall in your App Store storefront controls). Apple processes the payment and we never see your card. From Apple we receive signed transaction records (product, original transaction identifier, expiry, and, when you were signed in at purchase, an anonymous account token) so we can turn Peak on for your account and on the Bridge.

Where Apple's rules allow it (currently the United States), Peak is also sold on cobaltsim.com by Stripe (currently shown around US $9.99/month, US $79.99/year, and US $199.99 lifetime; the price and tax at checkout control). Stripe processes card, Link, Apple Pay, or other methods they support. We receive Stripe customer and subscription or payment identifiers, billing email, plan, status, and similar metadata, but not your full card number or CVC. Every Cobalt account, free or Peak, has a Bridge activation code (one PC on the free plan, up to three PCs with Peak by default). We show it in Settings after Face ID / device passcode and email it via Resend at purchase or when you ask.

Community and user content

Posts, comments, likes, follows, direct messages, group-chat names and photos, and flight cards you share. Photos you attach are uploaded to our storage. GIFs you pick are fetched from Giphy using your search text; Giphy’s policy applies to that request. Public Atlas / share links (cobaltsim.com/u/…, /f/…, /p/…) show what you published.

Integrations you connect

  • SimBrief. Username you enter, to pull an OFP you already own. Resync OFP times fetches that plan again from SimBrief when you ask; the plan itself is stored with the flight.
  • SayIntentions.AI (Bridge 1.3+). Bridge reads your active flight’s radio log from the SayIntentions client on your PC and, using the pilot key that client exposes locally, from SayIntentions’ API. That key is sent only to sayintentions.ai and never to Cobalt. If you paste a SayIntentions developer key into Bridge it is stored in Bridge’s encrypted settings on that PC. SayIntentions’ own policy covers what they keep.
  • BeyondATC (Bridge 1.3.1+). Bridge connects to the local channel BeyondATC’s own in-sim toolbar uses, on the same PC, to read the radio log and send the responses you tap. Cobalt never tunes radios, starts flights, or sends free text to BeyondATC, and receives nothing from BeyondATC’s servers.
  • Progressive taxi. With Bridge 1.3 or later the taxiway layout comes from your own simulator’s scenery and goes only to your phone. Otherwise Companion asks public OpenStreetMap (Overpass) servers for the airport’s layout directly from your device, so those servers see your IP address and the airport area. If Share my taxi times is on (Settings → Integrations), your taxi-out and taxi-in durations for an airport, hour and gate area are sent to api.cobaltsim.com and stored under a salted hash rather than your account; turn it off any time.
  • Navigraph. If we have app credentials configured, OAuth tokens to load charts you are licensed for. We do not harvest Navigraph’s database.
  • Calendar. Write-only: we add events only when you ask to put a scheduled flight on your calendar.
  • Photos. Saving a share card to your library, or picking a photo for a post or hangar aircraft. We do not scan your library in the background.
  • Charts links. Opening ChartFox, SkyVector, or AirNav in a browser does not give us those sites’ accounts.

Onboarding, analytics, and diagnostics

Optional survey answers (simulator, experience, goals, how you found Cobalt). Coarse product events such as which onboarding step you reached (for example onboarding.peak) so we can see where people drop off. App version, OS, coarse connectivity and crash signals. Push tokens (APNs) if you allow notifications. We do not sell this data and we do not use flight traces to train public AI models.

Website

Standard request logs (IP address, user agent, path) on our host (Vercel) for security and debugging. If you arrive with a creator code (?code=, ?ref=, ?creator=), we store cobalt_ref in a first-party cookie for 180 days (and a copy in localStorage) so a later Peak checkout can attribute the sale. If you join the waitlist at /notify, we store that email to send a launch note and occasional product updates. Each of those emails includes an unsubscribe link (also one-click in supporting clients). Support forms send the message you type plus optional contact email. Marketing pages load the Reddit Ads pixel, which records page views. If you arrive from a Reddit ad, the link can include rdt_cid. We store that click id in a first-party cookie (rdt_cid, 90 days) and attach it to the Peak checkout link. On the Peak page, viewing plans sends a content view, and clicking Monthly, Yearly, or Lifetime sends an add-to-cart before Stripe opens. When Stripe confirms a payment, our server sends Reddit a purchase with the amount charged, a hashed billing email, and the click id when we have one. The billing success page sends the same purchase with the same id, so Reddit counts it once.

Support

In-app reports and cobaltsim.com/support: category, subject, message, screenshots you attach, contact email, and basic app context.

4. iOS permissions (what they are actually used for)

  • Local Network / Bonjour (_cobalt._tcp). Find Cobalt Bridge on your Wi-Fi. We do not scan unrelated devices for advertising.
  • Face ID / Touch ID / passcode. Only to reveal your Bridge activation code in Settings. Biometric templates never leave the device.
  • Photo library (add). Save share cards you export.
  • Calendar (write). Add a scheduled flight when you tap to add it.
  • Notifications / Live Activities / background refresh. Flight phase, TOD, ATC, community, and widgets. Each notification category can be turned off in Settings. During taxi the Live Activity shows your next turn from the data already on your phone.
  • Speech Recognition (on-device). Optional transcripts for radio clips when the desktop model did not produce one. Audio is not sent to Apple or Cobalt for that fallback.
  • Alternate app icons. Changing the icon is handled by iOS on the device; nothing is sent to us beyond the Peak check that unlocks them.

Companion does not use the phone camera. “Camera” in Peak means views from the simulator, delivered by Bridge.

5. How we use information

  • Provide Companion, Bridge, Relay, accounts, sync, widgets, Watch, and Live Activities.
  • Match Peak to the Cobalt account with the same email; issue and enforce Bridge seats.
  • Operate community features you use, including public pages you publish.
  • Send transactional email we can deliver (Bridge code, support, Peak claim, sign-in) via Resend.
  • Send waitlist and launch emails you opted into, until you unsubscribe.
  • Secure the service (rate limits, abuse, fraud, debugging).
  • Improve onboarding and reliability using the survey and funnel events above.
  • Measure Reddit ads: page views, Peak plan clicks, and purchases.
  • Comply with law and App Store / Play disclosure rules.

6. Legal bases (EEA / UK)

Contract: running the service you signed up for, including Peak you purchased. Legitimate interests: security, preventing abuse, attributing creator referrals, product improvement with coarse events. Consent: optional survey, notification permission, calendar/photos/Face ID, and the launch waitlist. The Reddit pixel on the website measures ads. Email us if you want that matching stopped for you. Legal obligation: tax and accounting records Stripe keeps, and any lawful request we must honour.

7. Sharing

We do not sell personal information. We share with processors under contract:

  • Supabase: authentication, database, and file storage.
  • Vercel: website and API hosting.
  • Stripe: Peak payments and customer portal (independent controller of payment method data).
  • Resend: transactional email and waitlist / launch messages.
  • Apple: App Store distribution, APNs, Live Activities, In-App Purchase for Peak bought in Companion, Sign in with Apple if we offer it later.
  • Giphy: GIF search if you use GIFs in community (your query goes to Giphy).
  • Reddit: advertising measurement on cobaltsim.com (the Reddit Ads pixel and Conversions API). Reddit receives page and checkout events, a click id, and a hashed billing email after a purchase.

Public posts, passports, and share URLs are visible as you configure them. We may disclose information if required by law, to protect Cobalt or other users, or in a merger where this policy still applies or you are notified.

8. Retention

Account and synced flights, including edited times, remain until you delete the account in Companion Settings (that removes the Auth user; related rows cascade) or we close the account for a terms violation. Shared radio-call pages expire 90 days after the last share or when you stop sharing. Bridge radio recordings stay on your PC for 30 days or up to 500 MB. ATC alert text is forwarded to Apple and not retained. Stripe retains billing records as required for tax, disputes, and their services agreement. Support tickets are kept as needed to resolve them. Creator referral cookies expire after 180 days. The Reddit click-id cookie expires after 90 days. Waitlist emails stay until you unsubscribe (the address is then kept only as unsubscribed so we do not email it again). Guest/local data is removed when you delete the app or sign in and migrate, depending on the feature.

9. Security

HTTPS to our API and site. Hashed passwords. Relay and license tokens scoped by role (telemetry vs full Peak). Bridge codes should be treated like a password. Local Bridge HTTP is only for your LAN; do not expose it to the public internet. No method of transmission is perfectly secure.

10. International transfers

Hosting and processors may be in the United States and other countries. Transfers from the EEA/UK rely on processor terms such as standard contractual clauses where they offer them.

11. Your rights

Depending on where you live you may request access, correction, deletion, export, restriction, or objection, and withdraw consent. Email reports@cobaltsim.com. You may lodge a complaint with your local authority. California: we do not sell personal information. The Reddit pixel may count as “sharing” for cross-context advertising under the CPRA. Email us to opt out. We do not use sensitive personal information to infer characteristics. You can delete the account in Settings without emailing us.

12. Children

Cobalt is not directed at children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect their personal information. Contact us if you believe we have, and we will delete it.

13. Automated decisions

We do not make legally significant automated decisions about you. Peak access follows Stripe payment state. Abuse rate limits are automated safety measures, not credit scoring.

14. Changes

We will update this page and the in-app copy when the policy changes, and revise the date above. Material changes may also be noted in the app or by email if we have one on file.

15. Trademarks and affiliations

Cobalt Simulations is an independent developer. We are not affiliated with, endorsed by, sponsored by, or partnered with VATSIM, IVAO, Microsoft, Xbox Game Studios, Asobo Studio, Laminar Research, Navigraph, SimBrief, SayIntentions.AI, BeyondATC, or any airline, airport, or aircraft developer. Microsoft Flight Simulator, MSFS, X-Plane, VATSIM, IVAO, SayIntentions, BeyondATC, and the other names we mention are trademarks of their respective owners. Cobalt does not own those marks and does not claim a trademark registration in them. The full notice is at https://cobaltsim.com/legal.

16. Contact

Cobalt Simulations · reports@cobaltsim.com · https://cobaltsim.com/support · Terms of Use · EULA.

Get Cobalt free