Privacy policy

Last updated November 9, 2026.

The short version

Cove is a journal that lives on your phone. There is no account. Photos and notes stay on the device unless you publish a family link or turn on an encrypted backup.

If those features are not connected, nothing is uploaded.

The public copy of this policy is at https://covejournal.app/privacy. The text in the app is the copy that ships with this version.

What stays on this device

A single child profile: name, an optional photo, and a birth date or due date.

Memory entries: photos, a note, a date, and an optional milestone. Photos are copied into the app’s private storage. The journal reads the date from a photo when it can, and does not save location data from the photo.

A family page, if you publish one, copies the photos and notes you have not marked private, and the child’s name. People you invite can look, leave a heart, and write a short note. Letters and anything you mark private are never copied. Turning the page off deletes the photos, notes, comments, and the child’s name from the server. It cannot delete a picture someone already saved.

Encrypted backup, if you are a Plus member and the host is connected, sends a locked copy. The recovery code stays with you. The host stores the locked file and does not receive the key.

Who receives data

Supabase stores a family page when you publish one: the child’s name, the memory notes you did not mark private, and the JPEG photos on that page. It also stores invite labels, hearts, and short notes from people you invited. Supabase can read a family page. It cannot read an encrypted backup. The backup is AES-GCM ciphertext, and the recovery code stays with you.

Supabase stores this data in its West US (Oregon) region, in the United States.

If you join the launch waitlist on covejournal.app, Supabase stores your email address and the date you joined. It is used only to tell you when Cove is available, and is deleted after the launch email. To be removed sooner, email the support address.

RevenueCat, when purchases are connected, receives an anonymous app user id and the store receipt. Apple and Google process the payment. Cove does not receive your card number.

How long it is kept

A family page is kept until you turn it off or delete the journal. Turning it off deletes the photos, notes, comments, hearts, and the child’s name from the server. A revoked marker can remain so the old link does not open. That marker does not include the child’s name.

Backup ciphertext is kept until you delete the journal, which removes it from the server, or until you write to support and ask for that backup id to be removed.

Delete journal also deletes the backup key and the family keys stored on the phone. If the server cannot be reached, Delete journal stops and leaves the phone as it was.

Export and deletion

To delete a family page, open Family and turn family sharing off. To delete the journal and the encrypted backup, open Settings and choose Delete journal. You can also email support and ask for the server copy to be removed.

Children

Cove is for a parent or caregiver. It is not directed at children, and it does not create a child account. Do not list it in the Kids category or as Designed for Families.

What we do not do

No ads. No third-party advertising SDK. No sale of personal information. No account. No analytics SDK in this version. We do not track you across other companies’ apps or websites. There is no App Tracking Transparency prompt.

Contact

Questions about privacy: support@covejournal.app.