Privacy Policy

Effective Date: October 11, 2026

Cova ("we," "us," "our") operates Cova, an AI SRE agent, available at getcova.ai and app.getcova.ai (the "Service"). This Privacy Policy describes how we collect, use, store, and protect your information when you use the Service.

By using Cova, you agree to the collection and use of information as described in this policy.

1. Information we collect

Account information

You sign in with Google or GitHub. We receive and store:

• Email address - used to identify your account and to send you service emails, such as workspace invites.
• Name and profile photo - provided by Google or GitHub. You can change your name in the Service.

We don't store passwords.

Credentials for your tools

To use the Service, you may connect tools such as Datadog, Sentry, New Relic, Grafana, GitHub, GitLab and Slack, and add an API key for an AI provider (Anthropic, OpenAI or Google). These credentials are:

• Encrypted before they are stored, with an encryption key kept separately from the database.
• Used only to provide the Service.
• Never logged, shown in full, or shared with anyone else.
• Deleted when you disconnect the tool or your workspace is deleted.

Data from your tools and your team

When you use the Service, we store:

• Data read from your connected tools to detect and investigate problems: metrics, errors, deploys and pull requests for the services you choose.
• Incidents, investigations, postmortems and the notes your team saves about services.
• Questions you ask Cova, in the Service or in Slack, and Cova's answers.
• An audit log of actions taken in your workspace, by people and by Cova.

Technical logs

Our servers keep request logs, which can include IP addresses, for security and troubleshooting. These logs are held by our hosting provider for a limited period.

Website analytics

We use Google Analytics 4 on getcova.ai to collect anonymous, aggregated statistics such as page views and general geographic region. This data is not linked to your account.

Contact form

If you use the contact form on getcova.ai, we receive the email address and message you send us.

2. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate you and manage your account and workspace.
• Detect and investigate problems across your connected tools, and post findings where you choose, such as Slack.
• Send service emails, such as invites and access requests.
• Respond to your messages.
• Detect, prevent, and respond to fraud, abuse, or security incidents.

We do not:

• Sell or rent your personal data.
• Send marketing emails unless you opt in.
• Train AI models on your data.
• Share your data between workspaces.
• Share your data with advertisers.

3. Third-party services

The Service uses the following providers:

Provider	Purpose	Data shared
Google	Sign-in	We receive your email, name, and profile photo. We don't access other Google data.
GitHub	Sign-in, and deploy history and pull request checks if you install the Cova GitHub App	We receive your email, name, and avatar. With the GitHub App, we read deployments and pull request changes in the repositories you grant it.
GitLab	Deploy history and merge request checks, if you connect it	We read deployments and merge request changes in the projects you grant.
Slack	Posting findings and answering questions, if you connect it	We post to the channels you choose and read the messages in conversations where Cova is mentioned or messaged directly.
AI providers (Anthropic, OpenAI, Google)	Investigations, answers, and drafts	Only the provider whose API key you add. Incident data and your questions are sent through your own account with that provider. No credentials are sent.
Resend	Service emails	Your email address and the email's content.
Google Analytics	Website analytics	Anonymous page-view and session data.
Neon	Database hosting	All account and Service data, encrypted at rest.
Render	Application hosting	The Service runs on Render in the United States.

The full list of sub-processors is in our Data Processing Agreement.

4. Data storage and security

Data is stored in the United States, in a database encrypted at rest. Each workspace's data is kept separate, connections use HTTPS, and credentials are encrypted separately. See our Security page for details.

5. Data retention

• Account and workspace data: kept while your workspace is active.
• Credentials: deleted when you disconnect a tool or your workspace is deleted.
• Deleted workspaces: can be restored for 30 days, then permanently deleted.

6. Your rights

You can:

• View and change your profile information in the Service.
• Disconnect any tool, which removes its stored credentials.
• Export your workspace's audit log from the Service.
• Ask us to delete your account and associated data. Contact us at the email below and we will process your request within 30 days.
• Revoke Cova's access in your Google or GitHub account settings.

7. Children's privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. International data transfers

Your information is processed and stored in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date" above. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

10. Contact us