Cobalt

Security

Reporting a security flaw

All the watch’s code is public. So we expect people to look for flaws in it, and we want to know what they find. This page says how to tell us and what we do next.

What is in scope

  • The firmware of the watch and its protocol, Cobalt Link.
  • The Cobalt Agent and Cobalt Agent Dev apps.
  • The online gateway of the Pro and Max plans.
  • This website.

How to report

Write to jean@cobalt-watch.com, in English or in French. Please don’t open a public issue for a flaw.

Tell us:

  • what you found, and on which version;
  • how to reproduce it;
  • what an attacker could do with it.

We don’t have a PGP key yet. If you want one before sending the details, ask and we will create one.

What we do, and when

  • We acknowledge your report within 5 working days.
  • Within 15 days, we tell you whether we confirm it and what we intend to do.
  • We aim for a fix within 90 days, and we set the publication date with you.

What we promise you

If you act in good faith, keep to the scope above, don’t read or keep other people’s data, and give us a reasonable time before you publish, we will not take legal action against you.

We thank publicly the people who report a flaw, if they want us to.

Advisories and thanks

We publish our security advisories on the public repository. There are none so far, and nobody to thank yet.

Our own obligations

European law, with the Cyber Resilience Act, requires a manufacturer to report to the authorities any flaw in its products that is being actively exploited. If your report is about one, that is what we will do.

Be told as soon as Cobalt is available.

We only use your address to tell you. Privacy policy

Legal notice

Publisher

Cobalt Watch, a French simplified joint-stock company (SAS) with a share capital of Content missing euros.
Registered office: Content missing, Paris 2e, France.
Paris Trade and Companies Register (RCS): 106 218 159.
VAT number: Content missing.
E-mail: jean@cobalt-watch.com
Telephone: Content missing

Publication director

Jean de Bailliencourt, president of Cobalt Watch.

Host

Hostinger International Limited
61 Lordou Vironos Street, 6023 Larnaca, Cyprus
hostinger.com/contact

Other names

Cobalt Watch and CB-91AI are the names of our company and of our board.

The other company and product names on this site belong to their owners. We name them to say what our board and our app work with, or to compare them with our products.

Licences

The firmware of the watch is published under the Apache-2.0 licence.

The other texts, the photos, the videos and the logo belong to Cobalt Watch. For any other use, ask us.

Credits

Typefaces: Hanken Grotesk, Martian Mono, Instrument Serif and IBM Plex Sans, under the SIL Open Font License. Photos and videos: Cobalt Watch.

The Android robot is reproduced or modified from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License.

Accuracy

We do our best to keep this site accurate and up to date. It can still contain a mistake, and we change it as the project moves. If you spot one, tell us.

Applicable law

This site is governed by French law.

Privacy policy

This site sets no cookie and loads nothing from other companies: no analytics, no advertising, no embedded video. So there is no consent banner. Here is the little we do handle.

Who is responsible

Cobalt Watch SAS, the company that publishes this site. For any question about your data, write to jean@cobalt-watch.com.

What we handle

WhatWhyHow longWhere
The e-mails you send usTo answer you. We have a legitimate interest in doing so.Content missingOur mailboxes, at Hostinger
Your e-mail address, if you subscribed to our newsTo send you the news you asked for. This rests on your consent.Until you unsubscribeBrevo, our mailing provider, in France
The server’s logs: IP address, date, page requested, browserTo keep the site running and secure. We have a legitimate interest in doing so.Content missingHostinger, our host
Your name and your e-mail address, if you join the waitlistTo tell you when the campaign opens, and to contact you if you asked to test. This rests on your consent.Until you ask us to remove you, or Content missingA Google spreadsheet, filled by a Google Apps Script

Content missing

Who receives it

Hostinger, which hosts the site and our mailboxes, Brevo, which sends our news, and Google, which keeps the waitlist. We don’t sell your data and we don’t pass it to anyone else.

In your browser

If you switch language with the FR / EN button, your browser remembers that choice so that you get the same language next time. This choice stays in your browser and is never sent to us. Nothing else is stored there.

Your rights

You can ask us for a copy of your data, have it corrected or deleted, object to its use, and withdraw your consent at any time. Write to jean@cobalt-watch.com: we answer within a month.

If you think we handle your data badly, you can lodge a complaint with the CNIL, the French data protection authority.

The app

The Cobalt Agent app has its own privacy policy, because it handles something else: your voice notes. It is on its own page.

Notice about Casio

We are independent. Cobalt Watch is not affiliated with Casio Computer Co., Ltd. or with any of its subsidiaries. Casio has not endorsed or sponsored our products or this website.

The names. “Casio” and “F-91W” are trademarks of Casio Computer Co., Ltd. We use them for one reason only: to say which watch the CB-91AI board is made for. When a Casio watch appears in a photo or a video on this site, it is there to show that compatibility.

What we make. The CB-91AI is an electronic board that we design ourselves. It replaces the board of a watch that you already own. We don’t make the watch, and we don’t sell Casio watches.

Modifying your watch. Fitting the board means opening and modifying your watch. You do it at your own risk. It ends the manufacturer’s warranty on that watch, and we can’t be held responsible for damage done to it while fitting the board.