Cove — Privacy Policy

Effective date: 5 October 2026

In short

Cove holds some of the most private information a household has: your children's routines and photographs, what you earn and what you owe, what you are struggling to get done. We are telling you plainly what we do with it.

• We do not sell it, rent it, or use it for advertising. Ever.
• We do not use it to train artificial-intelligence models.
• Your household's data is visible only to the people you give a login to, and you choose what each login can see.
• It is stored on servers in Canada (Montréal). A few things happen outside Canada — AI features, email, payments, push notifications, connected calendars and encrypted backups. Section 7 says which, and why you should care.
• You can download it or delete it whenever you like, without asking us.

This summary is here to be read. The rest of the document is the part that is binding.

1. Who we are

Cove is operated by Craft Dreams Co. ("we", "us"), a partnership based in Ontario, Canada.

We are the organisation accountable for the personal information described here under the federal Personal Information Protection and Electronic Documents Act ("PIPEDA").

Privacy questions, access requests and complaints: privacy@craftdreamsco.com Person accountable for privacy: our Privacy Officer, one of the two partners in Craft Dreams Co., who can be reached at the address above. Ask and we will tell you who it is.

2. Who this applies to

This policy covers Cove — the web application at app.craftdreamsco.com, its wall display, and the website at cove.craftdreamsco.com — together "the Service".

Cove is offered to households in Canada, except Quebec, and the United States. Our website can be read from anywhere, but Cove is not offered, marketed or sold anywhere else, and we do not set out to collect information about people who live elsewhere. The website's optional surveys (section 3.6a) can be answered by anyone, including people in Quebec.

A Cove household is the unit of privacy. One adult signs up and creates it; they may then add logins for other people aged 16 and over. Each login is given one of three levels of access:

• Full access — everything in the household, including Budget, account balances, billing, settings and other people's logins.
• Limited — the household's day-to-day organising, but not Budget, account balances, billing, settings or other people's logins.
• View only — can see what a limited login sees, and cannot change anything.

Where a household enters information about a person who does not have a login — a child, a relative, a partner who does not use the app — the person who entered it is responsible for having the authority to do so. Section 6 says more about children.

3. What we collect

3.1 Information you give us to open an account

• Email address. This is how you sign in and how we reach you.
• A password, which we never store. We store a PBKDF2 hash with a per-account salt, from which the password cannot be recovered.
• Optionally, a household name, a first name for yourself, and display preferences (currency, time zone, theme, appearance, text size).
• Optionally, how you heard about Cove, chosen from a short list, and the tag on the link that brought you, if it had one (for example ?ref=fb-group on a link we shared). We count sign-ups and paying households by these, in totals only (section 3.5).

3.2 Information your household puts into the Service

This is the substance of the product, and it is unusually sensitive. It includes, depending on what you use:

• Household members. Names, relationships, colours, and photographs, pictures and sounds you upload for them. A flag marking a member as supervised (in practice, a child). Each person's usual bedtime and school-day leaving time, if you set them for the wall display's timers.
• Children's activity on the wall display. Chores and routine steps ticked off, jobs claimed, keys and rewards earned, and progress in Cove's Adventures. These are recorded under your household, not under the child.
• Capacity. The number of hours each person says they have for tasks in a day, an optional answer to "How's today?" (low, steady or ready) for that day only, and records of how much was done in a week. Cove does not ask for health information: there are no medication or sleep records.
• Financial information, only where Budget is switched on for your household. Income and expense categories and amounts, monthly budgets, savings goals and contributions, and monthly totals derived from bank statements.
• Calendar and scheduling. Events, tasks, routines, chores, reminders.
• Meals and groceries. Recipes, weekly plans, shopping lists, and estimated and actual grocery spend.
• Free text you write. Brain dumps, notes, requests for help.
• Religious or devotional content, only where the daily passage is switched on for your household.

3.3 Information about bank statements — read this one carefully

When you import a bank statement, the statement file never leaves your device. It is read in your browser. What is sent to us is the monthly total per category, plus any description-to-category rules you chose to save.

We do this deliberately. A year of transaction descriptions says where you shop, bank, drink, worship and see a doctor, and we do not want it. The features that sound as though they need it can be computed on the device that already has the file.

3.4 Information you give us if you connect something

• A calendar. If you connect Google Calendar, we store the tokens Google issues so Cove can read the list of your calendars and read and write events in the one you choose, and the calendar account's email address, so Settings can show which account is connected. If you connect Apple iCloud Calendar, we store your Apple ID and the app-specific password you create for Cove. The tokens and the password are stored encrypted, never shown back to anyone, and left out of the copy of your household you can download.

  While a calendar is connected, Cove keeps a copy of the events in the calendar you chose (title, description, location and times) in your household, so they show in Cove and on the wall display, and sends events you add in Cove back to that calendar. Disconnecting deletes the tokens or password straight away and stops syncing. Events already copied stay in your household until you delete them or the household. You can also remove Cove's access from your Google account's security settings at any time.

  Cove's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is used only to show and sync the calendar you chose. It is never used for advertising, never sold, never used to train AI models, and never read by a person at Cove unless you ask us to for support, or the law or security requires it.

• Notifications. If you turn on notifications on a device, we store the address your browser's push service gives that device, and the keys that let us encrypt what we send to it.

3.5 Information we generate

• Session cookies, so you stay signed in (section 12).

• Sign-in, sign-up, password-reset, help-form and survey attempts, with the IP address they came from. These are kept only as long as needed to stop repeated attempts and are deleted automatically, normally within two hours.

• A count of the AI requests your household has made this calendar month, and the date it used up the month's allowance if it did (section 5), to cap cost and prevent misuse. Each month's count replaces the last. We look only at totals across all households, such as how many used up the allowance and on which day of the month, never at which household did.

• A per-day count of confirmation emails sent for your household, for the same reason. It is deleted after a day.

  Neither count holds an IP address.

• Totals across all households, worked out once a day from what the Service already keeps: how many households signed up each week, put something in during their first week, came back later and pay; how many used each part of the Service in the last 30 days (for example tasks, routines or the wall display); and how households are made up (number of logins, whether there are children, household type, country). We use them to decide what to build, fix and charge. They are counts only and never say which household did what. This is not tracking: nothing is added to what we keep about you, and no outside analytics service is involved.

• Logs and error reports. Our hosting provider (Cloudflare) keeps a log of requests to the Service and of anything that went wrong, for up to a week. A log line can include the address requested, technical details of the request such as an IP address, and occasionally the email address of the login involved. We also keep a copy of each error message, with email addresses removed, in our own support system for 90 days, and receive an email alert about it.

3.6 Information you send us when you ask for help

If you use the help form or email us, we keep your name, email address, message, the page you were on and, if you were signed in, which household you belong to, with its type, how many people are in it, its plan and the dates of its trial and renewal, so we can answer you and keep a record of the conversation. A copy of each email also arrives in our Google mailbox, and, if a partner has turned it on, in that partner's own mailbox.

3.6a Survey answers

Our website has short, optional surveys about running a home. They do not ask for your name. We keep your answers, any "about you" answers you choose to give (province, who lives in your home, children's ages in bands, your age band, and whether you identify as ADHD, autistic or AuDHD) and the day they arrived. We do not keep your IP address or anything about your device with them. We look at them as totals, to decide what to build and how to price it, and we never publish or share answers one by one.

Whether you identify as ADHD, autistic or AuDHD is information about health. It is always optional, you give it by choosing to answer, and we treat it as sensitive: it is never sold, never used for advertising, and never shared with anyone outside Cove. Some US states (for example Washington and Nevada) give this kind of information extra protection as "consumer health data"; wherever you live, you can ask us at privacy@craftdreamsco.com to delete your survey answers. Because we do not keep your name or email with them, tell us roughly when you answered and what you said, so we can find them.

If you leave your email address and tick the box asking us to email you, we keep that address separately, with only the month it arrived. It is not linked to your answers, and we use it only to email you about testing Cove and when it opens. Every email has a way to unsubscribe.

3.6b If you leave

When you delete your household, let a yearly plan stop, or cancel on Stripe's page, we ask why. Answering is optional. Your answer (one reason from a short list, and anything you choose to write, with email addresses and phone numbers removed) is sent to us without your household, name or email, and kept with only the month it arrived. We look at these as totals, to learn what to fix.

3.7 What we do not collect

We have no analytics, no advertising identifiers, no third-party trackers, and no session-recording tools. We do not track you across other websites.

Every font, picture and script in the app comes from us. The sign-up page alone also loads Cloudflare Turnstile, a check that you are a person (section 8).

If you turn on Read aloud, your browser speaks the words using a voice on your device. Some browsers also offer online voices (often named "Natural" or "Online"); if you choose one, your browser sends the words to its maker (for example Microsoft or Google) to be spoken. That is between you and your browser, and Cove does not receive anything back.

4. Why we collect it, and our legal basis

We rely on your consent. You give it by signing up and by choosing to enter information; you may withdraw it at any time by deleting your household (section 10), subject to any legal retention we are required to observe.

We use household data only to:

1. Run the Service — show you your calendar, compute your totals, send the reminders you asked for.
2. Keep it working and secure — diagnose faults, prevent abuse, maintain backups.
3. Communicate with you about your account — password resets, email confirmation, billing, service notices, answers to your questions, and notification of a privacy breach if one occurs.
4. Meet legal obligations — tax records for payments, breach records under PIPEDA.

We do not send marketing email without your separate permission, and every marketing email will have a working way to stop it.

We do not use your household's data to train, fine-tune or evaluate artificial-intelligence models, and we do not permit our suppliers to.

5. Artificial intelligence

Some features send the text, photo or file you supplied to a model run by Cloudflare (Workers AI) so it can be structured. They are:

• turning a brain dump into tasks, schedule items or a savings goal;
• breaking a task into steps (only the task's title is sent);
• reading a photo or file you choose to capture, such as a school notice, a flyer, an invitation, a receipt or a recipe.

Photos you capture are not kept. Only the details you approve are saved, in your household, in Canada. The first time you use one of these features on a device, Cove tells you this and asks before sending anything; if you say not now, nothing is sent.

• What is sent is the content of that one request (and the file's name, if you uploaded a file), plus the little the model needs to sort it: today's date, your household's task category names, and, when it is reading a photo, a file or a schedule you typed, the first names of the people in your household, so it can say who something is for. Not your budget, not your calendar, not your household's other data.
• It is sent to produce your result and for no other purpose.
• Cloudflare states that it does not use this content to train any model, and treats it as our customer content, not shared with anyone else.
• Each household can make 300 AI requests a calendar month (150 on the Cove plan). When they are used up, these features pause until the 1st of the next month, and Cove says so.
• If you would rather not use it, do not use those features. Everything else in the product works without them.

6. Children

Cove is built for households, and households contain children. It is a console for the adults: a parent or guardian records a child's chores, schedule, countdowns and photograph, and the child uses Cove only on the wall display, which needs no login.

• A household may only be set up by an adult: 18 or over, or the age of majority where they live. Sign-up asks you to confirm it.
• Logins are for people aged 16 and over. The adult adding one confirms the person's age. Children under 16 have a profile, not a login, and use the wall display. We do not collect information directly from children: what is held about a child is entered by their parent or guardian, who consents to it on the child's behalf. If we learn that a login belongs to someone under 16, we remove the login (not the household's information) and tell the household.
• The adult may create logins for other members of the household, including teenagers, and chooses each login's level of access (section 2).
• Information about a child is entered by the adult running the household, who is responsible for having the authority to enter it.
• We do not knowingly allow a child to set up their own household.
• Children under 13 in the United States. Cove is not directed to children and we do not knowingly collect personal information directly from a child under 13. What the household holds about a child is entered, or tapped on the wall display, under the household's own account, which belongs to the parent or guardian who set it up. If you believe a child has given us information directly, write to us and we will delete it.
• A child's information is visible to the household's logins and on the wall display if the household uses one, so think about where that screen is.
• A parent or guardian may see, correct or delete a child's information at any time through Settings, or by writing to us.

7. Where your data is stored — and why we are telling you

Your household's data is stored in Canada, in Amazon Web Services' Canada (Central) region in Montréal, by our database provider Supabase.

Some of it still leaves Canada, and you should know exactly when:

• Getting to the database. Cove runs on Cloudflare's network, and reaches the database through Cloudflare's connection service (Hyperdrive). Your data passes through on its way; it is not stored there.
• AI features. If you use a brain dump, break a task into steps, or ask Cove to read a photo or file (section 5), the text or image you send is processed by Cloudflare Workers AI, which may run it outside Canada. It is processed there, not stored there.
• Backups. Encrypted copies of the database are kept with GitHub, in the United States.
• Email and payments go through Resend and Stripe, in the United States. Messages to our help address are received in a Google mailbox.
• Push notifications pass through the push service that runs your device's notifications — Apple, Google or Mozilla, depending on your browser. They are encrypted before they leave us, and the push service cannot read them.
• A connected calendar. If you connect Google or iCloud, events are exchanged with Google or Apple, wherever they keep your calendar.

This matters, and PIPEDA requires us to be straightforward about it. Our suppliers — Supabase included — are United States companies, so even data held in Canada can be subject to United States law:

Where your personal information is in the United States, or held by a company subject to United States law, it may be accessible to United States courts, law enforcement and national-security authorities under those laws, including where no Canadian court order would be required. This applies whatever protections we and our suppliers put in place.

We use contractual and technical measures comparable to those we apply in Canada — encryption in transit, encryption at rest, row-level isolation between households, encrypted backups. But we cannot contract out of another country's laws, and we are not going to pretend otherwise.

If you are not comfortable with this, please do not put information into the Service that you would not want subject to it.

8. Who else can see it

We do not sell, rent or trade personal information. We share it only with suppliers who need it to run the Service, each bound to use it only on our instructions:

If you connect a calendar, Cove exchanges calendar events with that provider at your instruction:

We may also disclose personal information where the law requires it — a court order, warrant, subpoena or other lawful demand. Where we are permitted to tell you, we will.

If the business is ever sold or merged, household data may transfer to the buyer, who would be bound by this policy or by one no less protective. We would tell you before it happened.

9. How long we keep it

• While your household exists: as long as you keep it. Access closes 30 days after a household becomes read-only, and everything stays intact so that subscribing again restores it and you can still download a copy. If access has closed and nobody signs in for 12 months, we email the household's full-access logins 60 and 14 days ahead, then delete it in the usual way below (with 30 days to undo). Signing in or subscribing at any point stops this. You can delete it yourself at any time, including after access has closed.
• After you delete your household: it is immediately inaccessible, and is permanently erased after 30 days. The window exists so a deletion made in a bad week can be undone. During it you may restore it from the link we email you.
• Backups: encrypted daily backups are kept for 30 days and then destroyed. A household deleted today disappears from backups within 30 days of being erased.
• Attempt records (section 3.5): deleted automatically, within two hours (the daily email count, which holds no address, within a day; the monthly AI count is replaced when the next month's count starts).
• Help requests: kept while we are helping you and for two years after the conversation ends, so we can see the history if you write again, then deleted. Ask us to delete them sooner and we will.
• Survey answers: as long as they help us decide what to build, and no longer than three years.
• Why-you-left answers: no longer than three years.
• Survey email addresses: until you unsubscribe or ask us to remove it, and no longer than two years after it arrived.
• Calendar events copied from Google or iCloud: as long as your household keeps them, like anything else you put in (section 3.4).
• Logs at our hosting provider: up to a week.
• Billing records: kept as long as Canadian tax law requires (generally six years), by us and by Stripe.
• Privacy breach records: 24 months, as PIPEDA requires — including breaches we assessed and decided were not reportable.

10. Your rights

Under PIPEDA you may:

• See what we hold. Most of it is on your screen already. Ask us and we will give you the rest, within 30 days and at no charge.
• Correct it. Nearly everything is editable in the app. If something is not, tell us.
• Take it with you. Settings → Your data gives you a complete, readable copy of your household, which you can save or print, at any time and without asking us — including after your access has closed. Routines and completed tasks can also be exported to CSV.
• Delete it. Settings → Your data → Delete this household. You download a copy first (Cove asks for one from the last hour, so nothing is lost by accident), confirm with your password, and type a confirmation phrase. It is real deletion, and it cascades through every table. See section 9 for the 30-day window. If you would rather not keep a copy on your device, write to privacy@craftdreamsco.com and we will delete it for you.
• Withdraw consent, by deleting your household. We cannot run the Service without the data it holds, so withdrawal and deletion are the same act.
• Complain. Write to privacy@craftdreamsco.com. We will respond within 30 days. If we cannot resolve it, you may complain to the Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376.

We will ask you to confirm your identity before acting on a request, so that someone else cannot make it on your behalf.

If you live in the United States

Whatever state you live in, you have the same rights described above: to know what we hold, to get a copy, to correct it and to delete it, and we answer within 30 days (45 where a state's law allows that and we need it, with a note saying why). We do not sell personal information, we do not "share" it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of; a Global Privacy Control signal from your browser is respected all the same. If we decline a request, you may ask us to reconsider by replying to our answer, and if you are still not satisfied you may contact your state's attorney general. We will not treat you differently for using any of these rights.

11. How we protect it

• Each person has their own login and their own password. Passwords are stored as salted PBKDF2 hashes.
• Every household's rows are separated by database-enforced row-level security, forced on every table. The database account the application uses cannot switch it off, and cannot read a row outside the household it is serving even if asked directly.
• Sessions use cookies that page scripts cannot read, sent only over HTTPS.
• Sign-in, sign-up, password reset and the help form are rate-limited.
• The wall display is given a session with strictly less access than the person who set it up: it can read a short list of screens and can change almost nothing.
• Backups are encrypted before they are stored.

No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm to you, we will report it to the Privacy Commissioner and tell you, as PIPEDA requires. If you live in the United States, we will also notify you, and any regulator, as your state's breach-notification law requires. Our internal plan for doing so is written down.

12. Cookies

We use cookies only to run the Service:

• dt_session — keeps you signed in. Expires after 90 days.
• dt_display_session — marks a device as the wall display. Expires after one year.

Both are strictly necessary. We set no advertising or analytics cookies, so there is nothing here to opt out of. Your browser can refuse them, but you will not be able to sign in.

Your device also stores display preferences locally so the app does not flash the wrong colours while it loads, a copy of today's screens so they can still be read without a connection, a brain dump you have started but not sent, and changes made while offline until they can be sent. That stays on your device until it is sent to us as you asked. Signing out removes the unsent brain dump, the offline changes and the copy of today's screens.

On our website, if you arrive through a link with a tag (like ?ref=fb-group), your browser keeps the tag for that visit only, so the "Start free" buttons can pass it to sign-up. It is not a cookie, it holds nothing else, and it is gone when you close the tab.

Decisions made by software

Cove does not make decisions about you by automated means that have legal or similarly significant effects. The AI features (section 5) suggest tasks, steps and details for you to accept, change or discard; nothing they produce is saved until you choose it.

13. Changes

If we change this policy we will update the effective date at the top. If the change is significant — a new category of data, a new country, a new supplier with access to household data — we will email you before it takes effect.

14. Contact

Craft Dreams Co. Ontario, Canada privacy@craftdreamsco.com

Office of the Privacy Commissioner of Canada — priv.gc.ca — 1-800-282-1376