Privacy Policy

Version 1.8 — 23 September 2026

This is the same policy shown in the Covo app under Settings. If you spot a difference between the two, the app is not more current than this page — they are updated together — but please tell us at covosocialapp@gmail.com.

1. Who We Are

Covo is operated by Covo Social Ltd, a company registered in England and Wales. In this policy, "we", "us", and "Covo" refer to Covo Social Ltd. We are the data controller for personal data collected through the Covo app.

You can contact us at covosocialapp@gmail.com for any privacy-related questions.

2. Information We Collect

Information you provide directly:

• Account details: name, username, email address, password (stored hashed), date of birth, profile photo
• Profile details: interests, bio, Instagram or LinkedIn handle (if you choose to link them), emergency contact name and phone number (if you add one)
• Sensitive interests: two of the interests you can choose — Faith & Religion, and Prayer — say something about your religious beliefs. UK data law calls this special category data and holds it to a higher bar. We only store it if you give explicit permission at the moment you pick it, we record which wording you were shown and when, and unticking it removes it straight away with no confirmation step. If you never pick one, we never hold any.
• Event content: events you create or join, messages you send, posts, comments, likes, safety ratings you submit
• Verification data: for university verification, your society invite code; for business verification, your company name and Companies House number; for social verification, links to your public Instagram and LinkedIn profiles

Information we collect automatically:

• Device information: device type, operating system, app version
• Technical data: IP address, time and date of requests
• Location data: the location of events when you create or join them (this is a core feature — events have places). When you post something publicly, the app asks your phone where you are and records that spot, rounded to about a hundred metres, so your post can appear in the local feed for the city you are in. That location is never shown to anyone — not on the post, not on your profile, not to other users — and we keep it only so we can spot someone faking where they post from. If your location is off, you can still post; the post reaches your friends as normal and simply does not appear in any city's local feed. We do not track your location in the background. When you search for a venue, look up a postcode, drop a pin on a map, or post publicly, what you typed or a rounded version of the coordinates is sent to our servers, which ask a mapping provider on your behalf to name the place — see section 5.
• Push notification token: an identifier issued by Expo, used to send you the notifications you have opted into — see section 5.

3. How We Use Your Information

We use your information to:

• Provide the Covo app, including showing events, enabling messaging and calls, and running communities
• Verify your age (18+) and, where applicable, your university, business, or social verification tier
• Send account emails (verification codes, password resets) and push notifications you have opted into
• Screen publicly posted images for explicit or unsafe content
• Investigate safety reports, enforce our Terms of Service, and comply with legal obligations
• Improve the app (understanding which features are used, fixing bugs)

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract: to provide the Covo service you signed up for (account management, events, messages)
• Legal obligation: to comply with UK law, including tax, consumer protection, and safeguarding
• Legitimate interests: to keep the platform safe (image screening, abuse investigation, moderation, retaining safety reports), to keep it working (diagnosing crashes and errors), and to improve the app
• Consent: for optional features like push notifications, linking social accounts, and emergency contacts. You can withdraw consent at any time.
• Explicit consent (Article 9(2)(a)): the only basis we rely on for the sensitive interests described in section 2. Nothing else we do relies on it, and withdrawing it deletes the interest rather than merely switching a setting.

5. Who We Share Your Information With

We do not sell your personal data and we do not use it for advertising.

We share data with the service providers below, who process it on our behalf. Each entry says what that provider actually receives.

WHERE COVO RUNS

• Supabase (database) — hosts our main database, in Ireland (EU)
• Railway (app hosting) — runs our backend API, in the Netherlands (EU)
• Cloudinary (images and video) — stores profile and cover photos, event and community banners, and the photos and videos you attach to posts, messages and forum threads

SAFETY SCREENING

• Amazon Web Services — images you post PUBLICLY are automatically checked for explicit or unsafe content using Amazon Rekognition, in Amazon's London (eu-west-2) region. We send the image to Amazon directly from our own servers, and we do it before the image is stored anywhere, so an image that fails is never saved. This covers photos on Explore and in posts, profile and cover photos, event and community banners, community icons, forum photos, and business logos and offers. Images you send PRIVATELY are never sent to Amazon: direct messages, community and channel chats, and personal stickers. Videos are never sent to Amazon. We have opted out of Amazon using these images to improve its machine-learning services.

MESSAGING, CALLS AND NOTIFICATIONS

• LiveKit (calls and live rooms) — when you make a call or join a live audio or video room, your voice and video are routed in real time through LiveKit's servers to the other people in it. Calls and rooms are not recorded or stored, by us or by LiveKit — nothing remains when they end.
• Expo (push notifications and app updates) — we send push notifications through Expo, which passes them to Apple (APNs) or Google (FCM) for delivery. Expo receives your push token and the content of the notification, which for a direct message includes the sender's name and the beginning of the message itself. Separately, the app asks Expo for a JavaScript update each time it starts; that request tells Expo your IP address, device type and app version.
• Resend (email) — delivers emails such as verification codes, password resets and account notices.

FEATURES THAT SEND TEXT OR A PLACE ELSEWHERE

• DeepL (translation) — if you tap to translate a message or a comment, the text of it is sent to DeepL and the translation comes back. This includes the text of private messages. The request goes through our servers, so DeepL receives the text but not your IP address.
• Giphy (GIFs) — GIF searches go through our servers to Giphy, so Giphy receives the search term but not your IP address or device.
• OpenStreetMap (venue search and addresses) — when you search for a venue, or drop a pin while creating an event, the request goes to our servers, and our servers ask the mapping provider. The provider receives what you typed, or the coordinates of the pin — but it receives our server's IP address, not yours, because your phone never contacts it directly. When you post publicly, a rounded version of where you were (about ten metres) is sent the same way, to name the city; nothing about who you are goes with it.
• Komoot (place search) — the same arrangement, through its Photon service, for the place picker.
• Postcodes.io (postcodes) — UK postcode lookups, sent to our servers, which ask the provider on your behalf.
• Apple and Google (maps) — map screens draw their tiles from Apple Maps on iOS and Google Maps on Android, which shows them the area of the map you are looking at.
• Companies House (business verification) — if you verify a business, we send the company name and number to the UK Companies House API to confirm it.

CRASH AND ERROR REPORTING

• Sentry (crash and error reporting) — when the app hits an error or crashes, it sends a diagnostic report to Sentry so we can find the fault and fix it. The report contains the error message and the line of our own code it came from, which screen you were on, which of our API addresses were called and whether they succeeded, your device model, operating system and app version, and a numeric account id — that last one so we can tell one person hitting an error fifty times from fifty people hitting it once. It does not contain your name, email address, username or IP address, the content of your messages, or anything you typed: search terms, postcodes and everything after the "?" in a web address are removed on your phone, before the report is sent. Sentry processes this in the EU (Germany), and reports are deleted after 30 days.

PAYMENTS

Covo does not currently take payments. Events are free, no card or bank details are collected, and nothing is sent to a payment processor. When paid events launch we will use Stripe to process them, and we will update this policy and tell you before that happens.

OTHER PEOPLE

Other Covo users will see information you choose to make visible, based on your privacy settings: your name, username, profile photo, bio, interests, and events you host or attend. Private messages are visible to the people you send them to.

We may disclose information to law enforcement, courts, or regulators where legally required, or where necessary to investigate a safety incident.

6. International Transfers

Where the parts of Covo we operate are located:

• Our database is in Ireland (EU)
• Our backend API runs in the Netherlands (EU)
• Image safety screening runs in Amazon's London region, in the UK
• Crash and error reports are in Germany (EU)

Some of the providers listed in section 5 are based outside the UK and EU, or may process data outside it — this includes Cloudinary, LiveKit, Expo and Giphy. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another safeguard permitted under UK data protection law.

7. Data Storage & Security

We take reasonable technical and organisational measures to protect your personal data. Passwords are stored hashed using bcrypt. Access to production systems is limited and authenticated. Data in transit is protected by TLS.

No system is perfectly secure. If we become aware of a data breach that affects you, we will notify you and the Information Commissioner's Office where required by law, within 72 hours of becoming aware of it.

8. How Long We Keep Your Data

This section describes what actually happens, rather than what we intend to build.

• Your account and your content — deleted immediately and permanently when you delete your account. That covers your profile, your messages, your posts and comments, your event attendance, your login history, and the accounts you have blocked or muted. It is not a scheduled job and there is no waiting period.
• Where you were when you posted — kept with the post and deleted with it. Delete the post and it is gone; delete your account and it goes with your posts. It is not a scheduled job.
• Events you are hosting — you cannot delete your account while you are hosting an event that has not happened yet, so that people who signed up are not left without a host. Cancel or complete it first, then delete.
• Safety reports you MADE — kept, but your identity is removed from them. The report, the reason, and anything you wrote stay; the link to you is erased. We do this because a report that the person it concerns could erase by deleting their account would not do its job.
• Safety reports ABOUT you — the report is kept, what you wrote in it is not. We keep that a report happened, its reason and its outcome, because a record of a safety decision has to survive the account it was about; we delete the free-text description, which is the part that describes an identifiable person.
• We do not delete safety reports on a schedule. We keep them for as long as they are needed to keep the platform safe.

Two things the identity removal does NOT do, said plainly rather than left to be assumed. It is pseudonymisation, not anonymisation: the report remains personal data, and our obligations about it do not end. And it does not touch anything you typed into the report yourself — if you named a person in the text you wrote, that text is unchanged.

• Server logs — our hosting provider keeps request logs for a period it sets, not us. We do not use them to build a profile of you.

You can get a copy of your data, or delete your account, in the app under Safety & Privacy.

9. Cookies and Similar Technologies

The Covo app does not use browser cookies. We use storage on your device to keep you signed in and to remember your settings.

Apple, Google and Expo may use device identifiers as part of delivering push notifications and app updates.

This web page sets no cookies of its own, runs no analytics, and loads nothing from anywhere else — there are no scripts on it at all. This paragraph has no equivalent in the app, because it is a statement about a website.

10. Your Rights

Under UK GDPR, you have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (the "right to be forgotten"), subject to the safety-report exception described in section 8
• Restrict or object to certain types of processing
• Receive your data in a portable format
• Withdraw consent for any processing based on consent
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk)

You can exercise most of these rights directly in the app: download your account details under Safety & Privacy, and delete your account under Settings. For anything else, email covosocialapp@gmail.com and we will respond within one month.

11. Children

Covo is for users aged 18 and over. We verify age at sign-up. If we discover that a user is under 18, we will close the account and delete the associated data. If you believe a child under 18 is using Covo, please contact us at covosocialapp@gmail.com.

12. Changes to This Policy

We may update this policy from time to time. The version number and date at the top of this screen indicate when it was last changed. If we make a material change that affects how we use your data, we will notify you through the app or by email and, where legally required, ask for your renewed consent. Continued use of Covo after a change means you accept the updated policy.

13. Contact

For any privacy question, data access request, or complaint:

Covo Social Ltd

covosocialapp@gmail.com

If you are not satisfied with our response, you can contact the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113.