Privacy Policy
How MAUD LLC collects, uses, shares and protects your information when you use Cobblehop. Effective date: October 28, 2026.
- What we collect: your account details (name, email, phone number and a hashed password) if you create an account, what you type or say to plan trips, and basic device and usage information. Without an account, a random guest ID takes the place of account details.
- Location is your choice. We get your precise location only if you allow it in your browser, and we use it only to plan trips from where you are.
- No selling, no ad tracking. We do not sell your personal information or share it for cross-context behavioral advertising. We use no advertising cookies and no third-party ad or analytics trackers.
- Providers help us run Cobblehop, including Microsoft Azure (hosting and the AI that reads your questions), Cloudflare, Stripe, Google Play (for purchases in our Android app) and OpenStreetMap-based place search.
- Limited retention. We keep account data while your account is open, and trip and usage logs for up to 24 months.
- You are in control. Email team@cobblehop.com from your account email to access, correct or delete your data.
1. Who we are and what this policy covers
Cobblehop is operated by MAUD LLC, a Pennsylvania limited liability company based in Erie, Pennsylvania, USA ("Cobblehop," "we," "us" or "our"). This policy explains how we collect, use, share and protect personal information when you use cobblehop.com, the Cobblehop web app, any future Cobblehop apps, and related emails and support (the "service"), and the choices you have.
This policy is part of our Terms of Service. It does not cover services run by others, such as transit agencies, Stripe, Google Play or your browser's speech service, even if you reach them through Cobblehop. Their own privacy policies apply.
2. Information we collect
You give us some information directly, some is collected automatically when you use Cobblehop, and some comes from our service providers.
| Category | What it includes | Source |
|---|---|---|
| Account information | First name, last name, email address, phone number and password. We store your password only as an Argon2 hash, never in readable form. | You |
| Guest information | If you use Cobblehop without an account: a random guest ID, kept in a cookie, linked to your device ID. We use it to count the trips you plan before you need an account and to keep your chat on screen. | Your browser, automatically |
| Messages and trips | Questions and messages you type or speak, trip origins and destinations, places you search for, and the answers and route cards we give you | You and the service |
| Precise location (optional) | Your device's location, only if you allow it in your browser | Your device, with your permission |
| Device and technical data | IP address, browser and device information, a random device ID and timestamps | Your browser or device, automatically |
| Usage information | Usage events, such as signing up, logging in, planning a trip or starting a stop alert | Automatically, as you use Cobblehop |
| Feature requests and support | Feature requests, feedback and emails you send us, and our replies | You |
| Payment information | Payment status and basic purchase records, such as when you paid and when your paid access ends. We never see or store your full card number. | Stripe or Google Play, and you |
Voice input. If you use the microphone, your browser's speech service turns your speech into text in the browser, and Cobblehop receives only the text. Depending on your browser, that service may send your audio to its provider under the provider's own privacy policy.
Sensitive details. Trip requests can reveal sensitive information, such as a visit to a medical office or a place of worship. Please share only what you need to plan your trip. We do not use your trips to profile you or to draw inferences about you.
3. How we use information
- To provide Cobblehop: create and secure your account, sign you in, understand your questions, plan routes, show live departures, run stop alerts and answer support requests.
- To handle payments: confirm payments and manage paid passes.
- To communicate with you: send account and service emails (such as security notices and changes to our terms) and reply to you. We may send marketing emails, always with an unsubscribe option. We will not send you marketing text messages unless you separately opt in.
- To improve Cobblehop: fix problems, understand how features are used, review feature requests and improve answers, including by training and testing the AI models that power Cobblehop on past conversations. Before conversations are used for training, we remove names, email addresses and phone numbers and round locations to about a kilometer. Authorized members of our team may review messages, feature requests and support issues for these purposes.
- To keep Cobblehop safe: prevent and detect fraud, abuse, scraping and security incidents, and apply usage limits.
- For legal reasons: comply with the law, enforce our terms, and protect the rights, safety and property of our users, us and others.
We may create de-identified or aggregated information that cannot reasonably be linked to you. We keep it in de-identified form and will not try to re-identify it, except as the law allows. We do not use personal information to make automated decisions that have legal or similarly significant effects on you.
4. Legal bases
Where the law requires a legal basis for using personal information (for example, in the European Economic Area or the United Kingdom), we rely on: contract, to provide the service and process payments; legitimate interests, to secure, maintain and improve Cobblehop and prevent abuse, where your rights do not override those interests; consent, for precise location and optional marketing, which you can withdraw at any time; and legal obligation, for example to keep payment records.
5. How we share information
We do not sell your personal information or share it for cross-context behavioral advertising. We share it only as described here. These providers and services help us run Cobblehop:
| Provider | What they do | What they receive |
|---|---|---|
| Microsoft Azure | Hosting, database, backups, and the AI model (Azure OpenAI) that reads your questions and writes answers | The information we store; your messages and related trip details when answers are generated |
| Cloudflare | DNS, network and security | IP addresses and request data as traffic passes through its network |
| Zoho Mail | Email: our team@cobblehop.com mailbox and account emails such as password-reset links | Emails you send us and our replies; your name, email address and language when we send you an account email |
| Stripe | Payments | The payment details you enter at checkout, and a reference linking the payment to you |
| Google Play | Payments in our Android app | The purchase reference Google gives the app, which we send back to Google to confirm the purchase. Google handles your payment details; we never see them. |
| Photon by Komoot and Nominatim (OpenStreetMap Foundation) | Place search and geocoding based on OpenStreetMap | Place names you search and, sometimes, an approximate location to rank results |
| MBTA V3 API | Live transit data | Trip and vehicle IDs only; no personal information |
| Our internal team tools (such as team chat) | Where our team reviews feature requests and support issues | The content of those requests and issues |
We may also disclose information for legal and safety reasons, if we believe in good faith it is required by law, subpoena or court order, or needed to protect the rights, property or safety of Cobblehop, our users or others, or to investigate fraud or abuse; in a business transfer, such as a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, as the law allows; and with your consent or at your direction.
6. Location data
Cobblehop collects your precise location only if you allow it through your browser's permission prompt (or, in a future app, your device's). We use it to plan trips from where you are, for example to find nearby stops and departures. When you search for a place, we may send an approximate location to our place-search providers so they can rank nearby results first. If your location is sent with a trip request, it may be stored with that request and kept as described in Section 8.
We use precise location only to provide the service you ask for, never for advertising or profiling. You can turn it off at any time in your browser or device settings and still plan trips by typing a starting point.
7. Cookies and local storage
We use only the cookies and browser storage Cobblehop needs to work. We do not use advertising cookies or any third-party advertising or analytics trackers.
| Item | Type | Purpose | How long |
|---|---|---|---|
| ch_session | First-party HttpOnly cookie | Keeps you signed in | 90 days, or until you log out |
| ch_guest | First-party HttpOnly cookie | Only if you use Cobblehop without an account: a random guest ID that counts the trips you plan before you need an account and keeps your chat. Removed when you sign up or log in | 30 days |
| Device ID | Local storage | A random ID for your browser, used to keep the app working, apply usage limits and understand how features are used | Until you clear your browser storage |
| Preferences | Local storage | Remembers your settings, such as whether you allowed location, and which chat you had open | Until you clear your browser storage |
If you block the session cookie, you cannot stay signed in. Providers such as Cloudflare and Stripe may set their own cookies needed for security or checkout, under their own policies. Because we do not track you across other websites, we do not change our practices in response to browser "Do Not Track" signals.
8. How long we keep information
- Account information is kept while your account is open. When you ask us to delete your account, we delete your account data, and delete or de-identify the trip and usage logs linked to it, within 30 days, except information the law requires us to keep, such as payment records.
- Saved chats (your questions and the route cards and answers we gave you) stay in your account so you can go back to them. Delete any chat from the chats menu, or delete your account to delete all of them. Without an account, your chat is kept with your guest ID so it stays on screen after a reload, and it moves to your account if you sign up or log in in the same browser; otherwise it is kept like trip and usage logs. A de-identified copy of a conversation, with no link to your account, may be kept to improve and train Cobblehop.
- Trip and usage logs (messages, trip requests, place searches, feature requests, support messages, usage events, IP addresses and device information) are kept for up to 24 months, then deleted or de-identified. De-identified conversations used to train our models may be kept for as long as they are useful for that.
- Payment records are kept as long as tax, accounting and other laws require.
- Backups roll off within 35 days, so deleted information may remain in backups until then.
- Browser storage: the session cookie expires after 90 days and the guest cookie after 30 days; local storage stays until you clear it.
Where the law allows, we may keep specific information longer if we need it to resolve a dispute, prevent abuse, enforce our terms or meet a legal obligation.
9. Security
We use reasonable safeguards to protect your information, including encryption in transit (TLS), storing passwords only as Argon2 hashes, HttpOnly session and guest cookies, access controls that limit who on our team can see personal information, and Cloudflare network security. No system is perfectly secure, and we cannot guarantee the security of your information. Use a strong, unique password and tell us right away at team@cobblehop.com if you think your account has been compromised. If a data breach affects your personal information, we will notify you as the law requires.
10. Your rights and choices
You can ask us to:
- Access the personal information we hold about you;
- Correct information that is inaccurate;
- Delete your account and personal information;
- Get a copy of your information in a portable, machine-readable format;
- Opt out of marketing emails (use the unsubscribe link), and of any sale, sharing, targeted advertising or profiling with legal or similarly significant effects. We do none of those today; if that changes, we will update this policy and honor opt-out preference signals such as Global Privacy Control; and
- Withdraw consent, for example by turning off location in your browser settings.
Delete your account yourself at any time in the app (tap your initial, then Delete my account). See how to delete your account.
How to ask. Email team@cobblehop.com from the email address on your account and tell us what you want. We may need to verify your identity before we act. We will respond within the time the law requires, usually 45 days, and may extend that time where the law allows. We do not charge for requests unless they are clearly excessive and the law permits a fee.
Authorized agents. You may have an authorized agent make a request for you. We may ask the agent for proof of your signed permission, and ask you to verify your identity or confirm the request directly, unless the agent holds a valid power of attorney.
Appeals. If we decline your request, you can appeal by replying to our decision or by emailing team@cobblehop.com with "Privacy appeal" in the subject line. We will respond in writing within the time the law requires. If you are not satisfied, you may contact your state attorney general.
No discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you exercised your privacy rights. Because using Cobblehop beyond a few trips requires an account, however, we cannot provide the full service after your account is deleted.
11. US state privacy rights
Several US states have comprehensive privacy laws. This section gives residents of those states additional information, to the extent those laws apply to us.
California
California residents have the rights in Section 10 under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). In the past 12 months, we have collected the categories below from the sources described in Section 2, for the purposes described in Section 3.
| CCPA category | Examples | Disclosed for a business purpose to | Kept for |
|---|---|---|---|
| Identifiers and customer records | Name, email address, phone number, IP address, device ID, account ID, guest ID | Microsoft Azure, Stripe, Zoho, our team tools | While your account is open; guest IDs, IP addresses and device IDs in logs up to 24 months |
| Commercial information | Payment status and purchase records | Microsoft Azure, Stripe, Google Play | As long as the law requires |
| Internet or other electronic network activity | Messages, trip requests, place searches, usage events, browser and device information | Microsoft Azure (including Azure OpenAI), place-search providers (search terms only), our team tools | Up to 24 months |
| Sensitive personal information: precise geolocation | Your device's location, only if you allow it, used only to provide the service | Microsoft Azure; place-search providers may receive an approximate location | Up to 24 months, if stored with a trip request |
| Sensitive personal information: account log-in | Email address and password (stored only as a hash) | Microsoft Azure | While your account is open |
| Inferences | None. We do not create profiles or draw inferences about you. | Not applicable | Not applicable |
Cloudflare also processes all of these categories in transit, as part of carrying traffic to and from Cobblehop. We do not sell or share personal information, including that of consumers under 16, and have not done so in the past 12 months. We use sensitive personal information only for purposes the CCPA permits, such as providing the service you request and securing your account, so the right to limit its use does not apply. We do not disclose personal information to third parties for their own direct marketing.
Other states
Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas and Virginia, may have similar rights to access, correct, delete and port their data, to opt out of targeted advertising, sale and certain profiling, and to appeal our decisions. We do not sell personal information, engage in targeted advertising or use profiling for decisions with legal or similarly significant effects. Where these laws require consent to process sensitive data such as precise geolocation, we ask for it through your browser's location permission before collecting it. To use your rights or appeal a decision, follow the steps in Section 10.
12. Children
Cobblehop is not directed at children under 13, and we do not knowingly collect personal information from them. Users under 18 may use Cobblehop only with a parent or guardian's permission. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has given us personal information, contact us at team@cobblehop.com.
13. International users
Cobblehop is intended for use in the United States, and your information is processed and stored in the United States. If you use Cobblehop from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.
14. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the effective date at the top. If we make material changes, we will also notify you in the app or by email. Where the law requires, we will ask for your consent before using personal information in a materially different way.
15. Contact us
Questions or requests about your privacy? Contact MAUD LLC (Cobblehop), Erie, Pennsylvania, USA, at team@cobblehop.com. For privacy requests, please write from your account email and put "Privacy request" in the subject line.