Privacy policy

Cove is run by Sansa Group AB, a company registered in Sweden ("we", "us"). We are the controller for the personal data described here. You can reach us about privacy at support@covespaces.my.

Everything you put in Cove is end-to-end encrypted: the content of your messages, photos, videos, voice notes, Board posts, comments, reactions, Space names and descriptions, profiles you set inside a Space, and your calls. It is locked on your device with keys that are made there and shared only with the people in that chat or Space.

Our servers store and deliver this content only in its locked form. We do not have the keys, so we cannot read, scan, analyse or hand over its content, and we never use it for advertising or to train AI.

To run the service we process this information about you:

• Account details: your email address, your name and handle, and your passkeys' public keys.
• Device and key details: the public keys of your devices and a public log of key changes, so the people you talk to can check they're talking to you.
• Membership: which chats and Spaces you belong to, your role in them, and invites you create or accept.
• Delivery information: when messages and posts were sent, how large they are, and when calls started and ended and who joined.
• Storage use: how much encrypted storage you use, so we can apply your plan's limits.
• IP addresses: kept for up to 30 days to protect the service from abuse, then deleted.
• Notifications: if you turn them on, the address your browser gives us for delivering them. Notifications are locked like everything else.
• Payments (when paid plans launch): handled by the app stores or by Stripe as the seller of record. We receive your plan status, not your card details.
• Support messages you send us by email.

• To provide Cove (performance of our contract with you): creating your account, delivering your content and calls, applying your plan.
• To keep Cove safe (our legitimate interest): preventing spam, fraud and abuse, and securing our systems.
• To meet legal obligations, such as bookkeeping and answering lawful requests, which can only ever include the information listed above, never readable content.

We use Cloudflare to host Cove, store your encrypted content, connect calls and send sign-in emails. If you turn on notifications, your browser's push service (run by Apple, Google or Mozilla) delivers them, still locked. When paid plans launch, Apple, Google and Stripe handle payments. Each acts on our instructions under a data processing agreement. Some of them may process data outside the EU/EEA; where they do, we rely on the EU's standard contractual clauses or an adequacy decision.

We don't sell your data, share it with advertisers or use third-party trackers.

We keep your account information for as long as you have an account. When you delete content, we delete our encrypted copy. When you delete your account, we delete your account information and your encrypted content from our systems. IP addresses are kept for at most 30 days. We may keep limited records longer where the law requires it, for example for accounting.

You can ask to see, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent where we rely on it. Write to support@covespaces.my from the email on your account and we'll answer within one month.

If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.

You need to be at least 13 to have your own Cove account, or older where the law in your country requires it. Families often share photos of children; those photos are encrypted like everything else and visible only to the people in your Space.

Cove is in private beta and this policy may change before launch. If we make a change that matters, we'll tell you in the app or by email before it takes effect.