Privacy Policy

Account information. When you join the waitlist or create an account, we collect your email address.

Receipts you forward or share. Each account has a personal Cove forwarding address. When you forward an email to it, our email provider receives the message and we process its contents — sender, subject, date, body text, and product images — to find the purchase: merchant, item names, brands, sizes, colors, prices, and order date. The same applies to receipt screenshots, PDFs, or email text you share with the Cove app. To fill in each item's photos and original retail price, Cove also visits the retailer's product page that the email links that item to. We keep the sender address, subject, and date of each forwarded email, the details we extracted, a link to each item's product page, and the item's product photos (from that page, or else from the email) as your item's photos. We do not keep the email body, its attachments, or the files you share once they have been processed. Forwarding one email gives Cove no access to your inbox or any other message. Email sent to an address that doesn't belong to an account is discarded without being processed.

Gmail data. If you connect Gmail (where that option is offered), we request read-only access scoped strictly to purchase receipt emails. We extract merchant name, purchase amount, item descriptions, and order date from those emails. We do not read, store, or process any other email content. We do not access your contacts, calendar, or any other Google data.

Closet inventory. Item details you add — either parsed from receipts or entered manually — including product name, brand, size, color, condition, purchase price, original retail price, and photos.

Photos. Images you upload for closet items are stored securely in Supabase storage. AI analysis of photos may identify item type, brand, color, condition, and listing descriptions. Raw images are retained in your account until you delete the item or account. In the mobile app, we request camera and photo library access only so you can capture or choose an item photo — Cove does not access your device photo library beyond the image you select.

Marketplace credentials. If you connect eBay, Poshmark, or Depop, we store only the authentication tokens or session cookies required to list or delist on your behalf. These values are encrypted at rest using AES-256-GCM and are not exposed to the client. We never store your raw marketplace passwords in our database.

Purchase information. If you subscribe to Cove Pro, payment is handled entirely by Apple's App Store or Google Play. We never receive your card number or other payment details. Through our subscription provider, RevenueCat, we receive your subscription status and related purchase records: the plan, purchase, renewal, trial, and expiration dates, transaction identifiers, and the country and currency of the purchase. These records are linked to your Cove account ID so your subscription works on any device you sign in to.

Usage data. Standard server logs including IP address, browser type, pages visited, and timestamps. We use this for security monitoring and product improvement.

We use your information to:

• Build and maintain your digital closet inventory
• Estimate resale values and surface selling opportunities
• List or delist your items on connected marketplaces (eBay, Poshmark, Depop) on your behalf
• Provide Cove Pro: check whether your subscription is active, restore purchases, and show your trial and renewal dates
• Send transactional emails (magic links, job status notifications)
• Improve the accuracy of our AI models for receipt parsing and item analysis
• Detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising.

Cove's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the minimum Gmail scopes necessary to find purchase receipts
• We do not transfer Gmail data to third parties except as necessary to operate the Service
• We do not use Gmail data to serve advertisements
• We do not allow humans to read your Gmail data unless you have given us explicit permission or we are required to by law
• You can revoke Gmail access at any time from your Google Account settings at myaccount.google.com/permissions

We share data with the following service providers, solely to operate the Service:

• Supabase — database, authentication, and file storage (US-based; SOC 2 compliant)
• OpenAI — AI-powered photo analysis, item descriptions, receipt parsing, and resale estimates. Images and text snippets — including the text of receipt emails you forward and the receipt screenshots and PDFs you share — are transmitted for analysis only; OpenAI does not use your data to train models per their API data usage policy
• Google — OAuth authentication and Gmail API access
• eBay — marketplace listing via official eBay REST API
• Poshmark — marketplace listing via server-side browser automation using your encrypted stored session
• Depop — marketplace listing via server-side browser automation using your encrypted stored session
• Vercel — web hosting and edge functions (US-based)
• Railway — infrastructure for automation workers (US-based)
• Resend — transactional email delivery, and receiving the receipt emails you forward to your Cove address (Resend holds received messages for a limited period under its own policies)
• RevenueCat — subscription management for Cove Pro. Receives your Cove account ID and the purchase records described in Section 1 to validate App Store and Google Play receipts and track subscription status
• Apple and Google — process Cove Pro payments through the App Store and Google Play under their own privacy policies; we do not receive your payment details

We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Cove or its users.

We retain your data for as long as your account is active. You may delete your account from Profile or request deletion by emailing privacy@sellwithcove.com.

Upon account deletion, we delete your account record, closet inventory, receipts, photos, jobs, and stored marketplace connections, except where we are required to retain limited records for legal, security, or fraud-prevention purposes.

Disconnecting a marketplace deletes the stored token or session for that marketplace. Gmail OAuth tokens are revoked and deleted when Gmail is disconnected.

Forwarded receipt emails and shared receipt files are processed and then discarded; only the details listed in Section 1 are kept, for as long as your account is active. You can switch to a new forwarding address in the app at any time — mail sent to the old address is discarded from then on.

We take reasonable technical and organizational measures to protect your data:

• Marketplace credentials (eBay tokens, Poshmark session cookies, Depop session cookies) are encrypted with AES-256-GCM before storage and hidden from client-side reads
• All data in transit is encrypted via TLS 1.2+
• Row-level security (RLS) policies are enforced at the database layer — you can only access your own data
• Internal API endpoints require a shared secret in addition to user authentication

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@sellwithcove.com.

All users. You have the right to access, correct, export, disconnect integrations, or delete your personal data. Use Profile for self-service deletion and marketplace disconnects, or contact us at privacy@sellwithcove.com to exercise these rights.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale of personal information (we do not sell your data), and to non-discrimination for exercising your rights. To submit a CCPA request, email us at the address above.

EEA/UK residents (GDPR). Our lawful basis for processing your data is contractual necessity (to deliver the Service you signed up for). You have rights of access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your local supervisory authority.

On the web, we use only strictly necessary cookies — specifically the session cookie set by Supabase Auth to keep you logged in. In the mobile app, the equivalent sign-in session is stored securely on your device (using the platform's secure storage) to keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics or advertising SDKs, on the web or in the app. The app includes RevenueCat's SDK solely to process Cove Pro subscriptions; it is not used for advertising or to track you across other apps or websites.

The Service is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us at privacy@sellwithcove.com and we will delete it promptly.

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Continued use after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or to report a concern:

Cove
Email: privacy@sellwithcove.com