Privacy policy

Who we are

Cove is run by [Company legal name], a company registered in [Governing law — e.g. England and Wales] under number [Company number], at [Registered address]. For anything about your data, email [Contact email for privacy].

When your team uses Cove, the workspace owner decides who is in the workspace and what it is for. This policy explains what Cove itself collects and does with it. It is written in plain English and is not legal advice.

What we collect and why

• Your account: your email address and, if you choose one, your password. Sign-in is handled by Supabase, which stores the password in a form we can’t read. You can also sign in with a link sent to your email.
• Your profile: first name, surname, username, and optionally a phone number, a position and a profile photo. Other people in your workspace see these so they know who they are talking to. Profile photos and workspace logos are stored at web addresses that are hard to guess but not private: anyone given the exact address can open the image.
• What you write and share: messages and their edits, reactions, pinned items, files and images you upload, and the channels, sections, groups and direct messages you are part of. When a message is deleted, its text is erased and its file is detached; a marker that a message was there remains.
• Where you are up to: how far you have read in each conversation, and the conversations you have muted or archived, so unread counts are right on every device.
• Presence: which room you are in, whether you are online or away (away after 10 minutes without activity), and a check-in about once a minute while Cove is open, so people aren’t shown in a room after they have gone. Knocks and room invites are kept so the person you knocked on can answer.
• Settings: your theme and a few workspace preferences, stored with your profile so they follow you between devices.
• Phone and desktop notifications: if you turn them on, the address your browser gives us for delivering notifications and a description of the device and browser, so we can send to it and you can tell your devices apart.
• Invites: when an admin invites someone by email, we keep the address and a record of each email sent, so the invite can be resent and so invites can’t be used to send spam.

Calls are voice and video in real time. Cove does not record calls and does not keep what is said. There are no advertising or analytics trackers in Cove, and we don’t sell your data.

Lawful bases

Under UK data protection law we rely on these bases. [To be confirmed with legal advice.]

• Contract: to provide your account, workspace, messages, calls and notifications.
• Legitimate interests: to keep Cove secure, prevent abuse such as invite spam, and fix problems.
• Consent: for phone and desktop notifications, which you can turn off at any time.
• Legal obligation: where the law requires us to keep or share data.

Who we share it with

We use a small number of service providers to run Cove. They act on our instructions and can use your data only to provide their service to us.

• Supabase: database, sign-in, live updates and file storage. Data is stored in [Supabase data region].
• Vercel: hosts the Cove app and runs its servers.
• Daily.co: carries voice, video and screen sharing. Daily receives your name so it can show it in the call.
• Resend: sends invite emails.
• Apple, Google and Mozilla: if you turn on notifications, your browser’s push service delivers them. They receive the notification, which can include who sent a message and the start of it, encrypted on its way.

People in your workspace see what you share there, and workspace owners and admins can manage its content and members. We share data with anyone else only if the law requires it.

International transfers

Some of our providers may process data outside the UK. Where they do, we rely on [Transfer safeguards — e.g. UK adequacy regulations or the International Data Transfer Addendum].

How long we keep it

• Your account and profile: for as long as you have an account.
• Messages and files: for as long as the workspace keeps them, unless they are deleted.
• Notification devices: until you turn notifications off, sign out on that device, or delete your account.
• Invite email records: [Retention period for invite send records].
• Backups and provider logs: [Retention period for backups and logs].

Leaving a workspace, or being removed from one, ends your access but keeps what you wrote there, so the conversation still makes sense to the people in it.

Deleting your account removes your login, and your name, phone number, position and photo. Messages you wrote in shared conversations stay, shown as from a former member. If you own a workspace that has other people in it, make someone else the owner before deleting your account.

Your rights

You have the right to:

• get a copy of the data we hold about you
• correct it, which you can do for your profile in Settings
• have it deleted, which you can do by deleting your account in Settings
• object to or restrict how we use it
• take your data to another service

For anything Settings doesn’t cover, email [Contact email for privacy] and we will reply within one month. If you aren’t happy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and local storage

Cove uses only what it needs to work. There are no advertising or analytics cookies.

• Sign-in cookies, set by Supabase, that keep you signed in.
• A cookie that remembers which workspace you last opened, kept for a year.
• Settings kept only in your browser: sidebar width and whether it is collapsed, collapsed sections, the size of the call window, sound and desktop notifications being off, call volume, your chosen microphone, camera and speaker, noise reduction, and your call background. A background image you upload stays in your browser and is not sent to us.
• A small count the app keeps on your device for the unread badge on its icon.

Children

Cove is for teams at work and is not meant for anyone under 16. [Confirm minimum age.] If you think a child has given us their data, email [Contact email for privacy] and we will delete it.

Changes

If we change this policy, we will update the date at the top. If a change matters to how your data is used, we will tell you in Cove or by email before it takes effect.

Contact

[Company legal name], [Registered address]. Email [Contact email for privacy].