Privacy Policy
1. Who is responsible
Covey, [Company mailing address], is the controller of personal information processed through Covey. Contact: privacy@example.com.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Parent account | Name, email, hashed password, optional mobile number, notification preferences, consent records | You |
| Child profile | First name or nickname, age range, avatar, hashed PIN, interests, settings you choose | You (the parent) |
| Conversations | Messages your child sends, AI replies, safety classifications, topics, timestamps | Your child, our safety system |
| Alerts and requests | Flagged excerpts, severity, your notes, topic-unlock requests | Our safety system, your child, you |
| Usage | Daily minutes, message counts, token counts | Derived |
| AI provider credentials | API keys (encrypted), model names, server URLs | You |
| Technical | IP address and timestamps for login attempts (rate limiting), session cookies, server logs | Your device |
We do not collect precise location, contacts, photos, or device identifiers, and children are never asked for personal information. Our filters detect and remove phone numbers, email addresses, and street addresses a child types before the message leaves our servers.
3. How we use it
- To provide the Service: route screened messages to your chosen AI provider, enforce your limits, and show you transcripts.
- To keep children safe: classify messages, raise alerts, and notify you according to your preferences.
- To secure accounts: rate limiting, lockouts, fraud and abuse prevention.
- To communicate with you: verification, password resets, alerts, digests, and material changes to our terms.
- To comply with law and enforce our terms.
We do not use personal information for advertising, sell or “share” it for cross-context behavioral advertising, build profiles for marketing, or use conversations to train machine-learning models.
4. Legal bases (EEA/UK)
Performance of our contract with you (providing the Service); your consent (child data, as described in the Children's Privacy Notice, and optional SMS); our legitimate interests in securing the Service and preventing abuse; and compliance with legal obligations.
5. Who we share it with
- Our AI provider (included AI). Unless you connect your own provider, screened message text and recent conversation context are sent to Anthropic as our service provider, under commercial terms that do not permit it to train AI models on that content. We send no account identifiers, names, or contact details beyond what appears in the message itself.
- Your own AI provider (optional). If you connect your own provider, the same screened text goes to that provider under your account and its privacy terms instead.
- Service providers that host our infrastructure, deliver email and SMS, and monitor errors, bound by data-processing agreements.
- People you choose. If you create a share link for something your child made, anyone with that link can view a read-only copy. We leave out flagged messages, scrub phone numbers and emails, hide your child's name unless you opt in, and ask search engines not to index it. You can turn a link off at any time, and it is deleted along with the conversation.
- Other adults in your family. Co-parents and caregivers you invite can see everything you can, except they cannot delete the family.
- Legal. When required by law, to protect a child's safety, or to enforce our terms.
- Business transfers. If Covey is acquired or merges, with notice to you.
6. Retention
- Conversations and alerts: 365 days, then deleted, unless you delete them sooner.
- Account and child profiles: until you delete the family or the account is inactive for 24 months.
- Login-attempt records: 30 days. Server logs: 90 days.
- Consent records: retained as evidence of consent for as long as the account exists plus the applicable limitation period.
7. Security
Passwords and PINs are hashed with bcrypt. AI provider keys are encrypted with AES-256-GCM using a server-side key held separately from the database. Sessions use HTTP-only cookies. Data is encrypted in transit. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of personal information, and to withdraw consent. Covey builds these in: review any conversation in your dashboard, download everything from Settings → Your data, and delete the entire family from Settings. For anything else, email privacy@example.com; we respond within 30 days and will not discriminate against you for exercising your rights. California residents may designate an authorized agent. EEA/UK residents may lodge a complaint with their supervisory authority.
9. Cookies
We use only strictly necessary cookies: a session cookie for signed-in parents and a separate, shorter-lived session cookie for signed-in children. We do not use analytics, advertising, or third-party tracking cookies, so no cookie banner is required.
10. International transfers
Our servers and service providers may be located in the United States or other countries. Where required, we rely on standard contractual clauses or equivalent safeguards. Your AI provider may process data in other regions under its own terms.
11. Children
Covey is designed for children to use under a parent's account. We collect children's information only with verifiable parental consent, as detailed in the Children's Privacy Notice. Parents may review, delete, or withdraw consent at any time.
12. Changes
We will post updates here and, for material changes affecting children's data, obtain fresh parental consent before they apply.
Questions about these documents: privacy@example.com · Covey, [Company mailing address]