Privacy: what leaves the box
Cobblr makes no unsolicited phone-home. There's no telemetry, no analytics, no
error reporting, and no update check. Your data stays in your Postgres. A few
features reach third-party services only when you use them, and each has an
off-switch in .env:
| Feature | Contacts | Turn off |
|---|---|---|
| Barcode lookups | product catalogs (upcitemdb, Open Facts, DuckDuckGo; go-upc if you opt in) | COBBLR_SCAN_EXTERNAL_LOOKUPS=false |
| Item image search | DuckDuckGo image search, when you fetch a catalog photo for an item | no dedicated switch yet; it only fires when you use the image picker or photo enrichment |
| AI features | your chosen LLM provider (needs your own key) | COBBLR_AI_ENABLED=false |
| Marketplace | the extension catalog on GitHub | set COBBLR_EXTENSIONS_URL to your own, or don't open it |
Each barcode provider is switchable on its own, and you can supply your own API key
where one exists (for example COBBLR_SCAN_GOUPC_API_KEY). For a fully air-gapped
install, set COBBLR_AI_ENABLED=false and COBBLR_SCAN_EXTERNAL_LOOKUPS=false, use
the offline TLS option, and skip the image-picker features; with no outbound network
those calls simply fail quietly rather than leaking.
The repo's docs/SELF_HOSTING.md carries the deepest version of all this: the
per-provider barcode knobs and the full air-gap recipe.