Privacy Policy

Effective Date: January 16, 2026

Coves Team ("we," "our," or "us") operates the Coves mobile application and website. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

Summary: Coves is built on the atProto protocol. Your data is stored on your Personal Data Server (PDS), which you control. We only index and cache publicly available data from the network to provide our service.

1. Information We Collect

1.1 Account Information

When you sign in to Coves, we receive the following from your atProto identity:

Decentralized Identifier (DID): Your unique identifier on the atProto network
Handle: Your username (e.g., yourname.bsky.social)
Profile Information: Display name, bio, and avatar that you've set on your PDS

1.2 Content You Create

When you use Coves, the content you create is written to your PDS:

Posts and comments
Votes (likes and downvotes)
Community memberships

1.3 Information We Do NOT Collect

Data Type	Collected?
Passwords	No - OAuth only
Device identifiers (IMEI, serial numbers)	No
Location data	No
Contacts	No
Photos/media from your device	No
Analytics or telemetry	No
Advertising identifiers	No
Crash reports	No

2. How We Use Your Information

We use the information we collect to:

Authenticate you and maintain your session
Display your profile and content within the app
Show you posts, comments, and communities
Process your votes and interactions

We do not use your information for advertising, profiling, or selling to third parties.

3. The atProto Protocol and Federation

Important: Coves is built on the atProto (AT Protocol), a federated social networking protocol. This affects how your data works.

3.1 Your Personal Data Server (PDS)

Your content (posts, comments, votes) is stored on your PDS, not on Coves servers. You may host your own PDS or use a hosted provider. You maintain control over your data at the PDS level.

3.2 What Coves Stores

Coves operates an AppView that indexes publicly available data from the atProto network firehose. This means:

We cache and index your public content to provide fast access
Your authentication tokens are stored encrypted on your device
We do not store copies of your private data

3.3 Federation

Because atProto is federated, your public content may be visible on other applications and services that use the protocol. This is a feature of the protocol, not something Coves controls. When you post content, consider that it may be indexed and displayed by other atProto services.

4. Data Storage and Security

4.1 Where Data is Stored

Your device: Authentication tokens are stored in encrypted storage (iOS Keychain / Android EncryptedSharedPreferences)
Your PDS: Your content is stored on your Personal Data Server
Our servers: Located in Canada, used for indexing public atProto data

4.2 Security Measures

OAuth 2.0 with DPoP for authentication
Encrypted token storage on device
HTTPS for all network communications
No plaintext storage of sensitive data

5. Third-Party Services

We use the following third-party services:

Cloudflare: For content delivery, DDoS protection, and DNS. Cloudflare may process your IP address and request metadata. See Cloudflare's Privacy Policy.

We do not use third-party analytics, advertising networks, or tracking services.

6. Data Retention and Deletion

6.1 On Coves Servers

When you delete content or your account:

Your data is removed from our index immediately
We do not retain backups of deleted content
Cached data is purged from our systems

6.2 On Your PDS

Content stored on your PDS is managed by you or your PDS provider. Deleting content from Coves removes it from our index, but the original data on your PDS must be managed separately according to your PDS provider's policies.

6.3 Federation Caveat

Due to the federated nature of atProto, content that was public may have been indexed or cached by other services before deletion. We cannot control data held by other parties on the network.

7. Your Rights

You have the right to:

Access: View all data associated with your account
Delete: Remove your content from our index by deleting it in the app or signing out
Control: Manage your data directly on your PDS
Portability: Your data lives on your PDS and can be moved to another atProto service

To exercise these rights, contact us at support@coves.social.

8. Age Requirement

Coves is intended for users who are 18 years of age or older. We do not knowingly collect information from anyone under 18. If you are under 18, please do not use this service.

If we learn that we have collected personal information from a user under 18, we will take steps to delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

Posting the new policy on this page
Updating the "Effective Date" at the top
Notifying you through the app when appropriate

We encourage you to review this policy periodically.

10. Future Features

We may introduce analytics, crash reporting, or other features in the future to improve the service. If we do, we will:

Update this Privacy Policy before implementing such features
Use privacy-respecting options where possible
Be transparent about what data is collected and why

11. Contact Us

If you have questions about this Privacy Policy or our practices, contact us at:

Coves Team
Email: support@coves.social