Privacy Policy

Account information. When you join the waitlist or create an account, we collect your email address.

Gmail data. If you connect Gmail, we request read-only access scoped strictly to purchase receipt emails. We extract merchant name, purchase amount, item descriptions, and order date from those emails. We do not read, store, or process any other email content. We do not access your contacts, calendar, or any other Google data.

Closet inventory. Item details you add — either parsed from receipts or entered manually — including product name, brand, size, color, condition, purchase price, and photos.

Photos. Images you upload for closet items are stored securely in Supabase storage. AI analysis of photos may identify item type, brand, color, condition, and listing descriptions. Raw images are retained in your account until you delete the item or account.

Marketplace credentials. If you connect eBay, Poshmark, or Depop, we store only the authentication tokens or session cookies required to list or delist on your behalf. These values are encrypted at rest using AES-256-GCM and are not exposed to the client. We never store your raw marketplace passwords in our database.

Usage data. Standard server logs including IP address, browser type, pages visited, and timestamps. We use this for security monitoring and product improvement.

We use your information to:

• Build and maintain your digital closet inventory
• Estimate resale values and surface selling opportunities
• List or delist your items on connected marketplaces (eBay, Poshmark, Depop) on your behalf
• Send transactional emails (magic links, job status notifications)
• Improve the accuracy of our AI models for receipt parsing and item analysis
• Detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising.

Cove's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the minimum Gmail scopes necessary to find purchase receipts
• We do not transfer Gmail data to third parties except as necessary to operate the Service
• We do not use Gmail data to serve advertisements
• We do not allow humans to read your Gmail data unless you have given us explicit permission or we are required to by law
• You can revoke Gmail access at any time from your Google Account settings at myaccount.google.com/permissions

We share data with the following service providers, solely to operate the Service:

• Supabase — database, authentication, and file storage (US-based; SOC 2 compliant)
• OpenAI — AI-powered photo analysis, item descriptions, receipt parsing, and resale estimates. Images and text snippets are transmitted for analysis only; OpenAI does not use your data to train models per their API data usage policy
• Google — OAuth authentication and Gmail API access
• eBay — marketplace listing via official eBay REST API
• Poshmark — marketplace listing via server-side browser automation using your encrypted stored session
• Depop — marketplace listing via server-side browser automation using your encrypted stored session
• Vercel — web hosting and edge functions (US-based)
• Railway — infrastructure for automation workers (US-based)
• Resend — transactional email delivery

We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Cove or its users.

We retain your data for as long as your account is active. You may delete your account from Profile or request deletion by emailing privacy@sellwithcove.com.

Upon account deletion, we delete your account record, closet inventory, receipts, photos, jobs, and stored marketplace connections, except where we are required to retain limited records for legal, security, or fraud-prevention purposes.

Disconnecting a marketplace deletes the stored token or session for that marketplace. Gmail OAuth tokens are revoked and deleted when Gmail is disconnected.

We take reasonable technical and organizational measures to protect your data:

• Marketplace credentials (eBay tokens, Poshmark session cookies, Depop session cookies) are encrypted with AES-256-GCM before storage and hidden from client-side reads
• All data in transit is encrypted via TLS 1.2+
• Row-level security (RLS) policies are enforced at the database layer — you can only access your own data
• Internal API endpoints require a shared secret in addition to user authentication

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@sellwithcove.com.

All users. You have the right to access, correct, export, disconnect integrations, or delete your personal data. Use Profile for self-service deletion and marketplace disconnects, or contact us at privacy@sellwithcove.com to exercise these rights.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale of personal information (we do not sell your data), and to non-discrimination for exercising your rights. To submit a CCPA request, email us at the address above.

EEA/UK residents (GDPR). Our lawful basis for processing your data is contractual necessity (to deliver the Service you signed up for). You have rights of access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your local supervisory authority.

We use only strictly necessary cookies — specifically the session cookie set by Supabase Auth to keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

The Service is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us at privacy@sellwithcove.com and we will delete it promptly.

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Continued use after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or to report a concern:

Cove
Email: privacy@sellwithcove.com