Privacy Policy

Cove is built on a simple principle: your photos belong to you. This policy explains what data we collect, how we use it, and the choices you have. It applies to the Cove iPhone app, the website at covesearch.com, and any related services.

The short version

• We do not copy or store your photo library. Thumbnails are sent to our servers one batch at a time for AI processing, then automatically deleted within 7 days.
• We store only what we need to power search: AI-generated captions and 512-dimension vectors that represent the content of each photo. Not the photos themselves.
• We use OpenAI as a subprocessor to generate captions and embeddings. Your data is not used to train AI models.
• We do not run ads, analytics, or third-party tracking. The queries you search for stay between you and your iPhone.
• Deleting your account removes everything from our servers.

Information we collect

Account information

When you sign in with Apple, we receive a stable, anonymized user identifier from Apple. If you choose to share your name during sign-in, we store it so we can address you in the app. We do not receive your real Apple ID email unless you choose to share it (Apple offers a relay email option).

Photo data

When you index your library, the Cove iPhone app generates a small thumbnail of each photo (256×256 pixels) and uploads it to our servers along with limited metadata: the photo's creation date, GPS coordinates (if present), and a stable identifier the app uses to find the photo locally on your phone. We do not receive the full-resolution photo.

Thumbnails are stored briefly in Amazon S3, sent to OpenAI for AI captioning, then automatically deleted from our servers within 7 days under an S3 lifecycle policy. We do not keep a copy of your photos.

AI-generated data we retain

For each photo, we keep:

• An AI-generated text caption describing the photo.
• Two 512-dimension vector embeddings — mathematical representations of the photo's content that power search.
• Limited metadata you sent (date, season, time of day, city/country derived from GPS coordinates).
• The photo identifier so the app can match results back to your library.

Search queries

When you ask Cove a question, your query is sent to OpenAI to generate a vector, which is then compared against the vectors in your library on our servers. We do not log the queries you make.

Technical information

Standard AWS infrastructure logs (request timestamps, IP addresses, and error events) are retained for 14 days for operational and security purposes. We do not associate these logs with your photo content.

How we use information

• To provide the core search service.
• To enforce the free-tier photo limit and other product limits.
• To communicate transactional matters about your account (sign-in issues, account deletion, security notices).
• To diagnose operational issues. We do not look at the content of your photos for debugging.

Service providers (subprocessors)

To operate Cove, we share data with a small number of trusted service providers, each performing a specific role:

• AI/ML providers — receive photo thumbnails (one at a time) for captioning, and your search queries for embedding into searchable vectors. They do not receive your account identity, and your data is not used to train their models.
• Cloud infrastructure providers — host our servers, briefly store photo thumbnails (deleted within 7 days), and hold operational state.
• Database providers — host our managed database, where account records, AI-generated captions, and vector representations are stored.
• Authentication provider — Apple, through Sign in with Apple. Apple confirms that you sign in to Cove but does not receive your photo data or search queries.

We can share the specific providers in each category on request.

We do not sell your data. We do not share it with advertisers, data brokers, or for marketing purposes.

Data retention

• Photos (thumbnails): deleted within 7 days of upload.
• Captions and vectors: retained until you delete your account or specific photos.
• Account data: retained until you delete your account.
• Operational logs: 14 days.

Your rights

You can, at any time:

• Delete your account. Use Settings → Delete Account in the iPhone app. We remove your account data, captions, vectors, and any in-flight photo data from our servers.
• Request a copy of your data. Email hello@covesearch.com.
• Ask questions about how we handle your data. Email hello@covesearch.com.

If you are in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, and CCPA, including the right to access, correct, port, and erase your data, and the right to object to processing. To exercise any of these rights, contact us at hello@covesearch.com.

Security

We use industry-standard practices: HTTPS for all network traffic, encryption at rest on AWS, and the iOS Keychain to store authentication tokens. No system is perfectly secure; we work to follow current best practices.

Children's privacy

Cove is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected such information, contact us and we will delete it.

International users

Cove is operated from the United States. If you use the app from outside the US, your data will be transferred to and processed in the US.

Changes to this policy

If we change this policy materially, we will update the "Last updated" date and notify you in the app or by email before the changes take effect.

Contact

Questions about this policy or your data? Email hello@covesearch.com.