What we collect. Your email address and sign-in details (handled by Supabase), your subscription and payment status (handled by Stripe; we never see your card number), your generation balance and history (including prompts, until you delete them), and the network address a request comes from, which we use for rate limits and to stop abuse. At sign-up, Cloudflare Turnstile checks that you are a person.

Crash reports. When the app hits an error, it sends a short technical report so we can fix it. Reports never include your boards, files, prompts, links or email address; a signed-in report carries only a scrambled (salted and hashed) form of your account id. They are deleted after 30 days.

Your content. Cloud boards, uploaded files, and generated media are stored on our infrastructure (Cloudflare) so your work syncs across devices and survives your laptop. Deleted files and boards can be restored for 30 days, then are destroyed along with their chats, documents, and version history. Deleting your account erases everything immediately, and the backup copies of your files are destroyed 72 hours later. Two backups expire on their own schedule and cannot be opened for one person: full database backups (kept on Cloudflare and in a private GitHub repository), kept 14 days, and a locked offsite copy of our backups at Backblaze, kept 30 days. Thirty days after any deletion, no copy of that work remains, except where the law requires us to keep something, such as material we have reported to the authorities.

We don't look at your boards. We don't browse your boards or review your files. The only exceptions: when the law requires it, when you ask us to for support, or when we are acting on a specific report about a specific item.

AI processing. When you generate, your prompt and any reference media are sent to fal.ai, which runs the models. We tell fal not to store them: prompts and outputs are processed, returned, and not kept on their systems. When you talk to Cove, your conversation and any board content you show it are sent to Anthropic (the maker of Claude) to produce the response; Anthropic does not use this content to train its models.

Who we share it with. Only the companies that run Coveboard for us: fal.ai and the model providers behind it (generation), Anthropic (Cove), Stripe (payments), Supabase (sign-in), Cloudflare (hosting, storage and bot checks), Resend (email), GitHub and Backblaze (backups). We do not sell your personal information and we do not show ads.

Legal requests. We hand over information only when the law requires it, such as a valid court order, and we tell you first unless the law forbids it. If we find material that is sexual and involves a minor, we report it to the National Center for Missing & Exploited Children, as US law requires.

Why we keep it. We use your information to run the service you signed up for, to keep it secure and stop fraud and abuse, to meet our legal duties, and to email you about your account. Product-update emails are occasional and every one has an unsubscribe link.

How long. Account details and your work are kept while your account is open and deleted on the schedule above. Crash reports are kept 30 days. Billing records are kept as long as tax law requires. Reports people send us through the report form are kept as long as needed to handle them and meet our legal duties.

Where. Coveboard is run from the United States, and your information is stored and processed in the US.

Your rights. You can see, fix, download or delete your information. Download any board as a zip from the app, and delete your account in Settings. For anything else, including a copy of the information we hold about you or an objection to how we use it, email [email protected] and we will answer within 30 days. If you live in the EU or UK, you can also complain to your local data protection authority.

Age. Coveboard is for people 18 and older. We don't knowingly collect information from anyone younger, and we delete it if we find out.

Changes. If we change this policy in a way that matters, we will say so in the app or by email before it takes effect.