Privacy policy

CovePet is made by MSDC Ltd. (“MSDC”). MSDC is responsible for the personal information in this policy.

This policy covers the CovePet apps for iPhone and Android, the CovePet web app, the covepet.com website, vet-summary links, and the email CovePet sends. The Terms of service explain the rest of the agreement between you and MSDC Ltd.

CovePet stores information you choose to provide so it can organize your pet’s care history. This can include:

• Account details such as your name, email, and phone. The household owner’s name and phone, when saved, are printed on every vet summary the household shares.
• Pet profiles, baseline health context, and vet contact details.
• Symptoms, behavior changes, medications, diet changes, and vet notes.
• Photos, videos, and documents you attach to a health record, and vet documents you add or forward to your household’s CovePet email address.
• Vet summary links and the sharing choices connected to them.
• Household invitations, caregiver membership, and who added or changed shared records.
• An email address you leave on the site to hear when CovePet ships.

CovePet keeps the sign-in providers linked to your account, and the subscription provider (Apple, Google Play, or Stripe through Superwall), plan status, renewal status, and limited billing identifiers used to verify access and prevent an App Store purchase from being linked to the wrong CovePet account.

To deliver and protect CovePet, the hosting provider handles technical information such as your IP address and browser type with each request. CovePet does not use it to build a profile of you.

When something fails in the app, the site, or the service, an error report is sent to Sentry. It says what failed, and can include the app version, operating-system version, browser, and device model. CovePet removes names, email addresses, pet and health information, IP addresses, and device identifiers before a report is sent. A report keeps CovePet’s own account and household numbers, so a fault can be traced and fixed.

If you allow notifications, CovePet keeps a push token for your device, and removes it when you sign out.

CovePet’s server counts a few events: an account is made, a household saves its first note, a vet summary is shared, and a subscription starts or is cancelled. Each count carries the account and household numbers, the platform, and for a purchase the product and amount. It holds no note text or pet information, stays with Cloudflare, and is never used for ads.

CovePet uses this information to authenticate your account, save and display your records, prepare vet summaries, provide support, find and fix errors, and protect access to the service.

When you type or say a note, your phone or browser reads it to suggest records, with CovePet’s own reader. Speech becomes words through your phone’s own speech recognition (on some Android phones, Google’s speech service). The text of a note is not sent to CovePet or to any AI service for this step. Only what you review and save is sent to CovePet and stored with your account. That includes the note the records came from.

If your phone can’t turn your voice into English words itself, the recording goes to CovePet’s server, which turns it into words with a speech model (Whisper, made by OpenAI) that Cloudflare runs in Workers AI. CovePet does not keep the recording.

When you add a vet document, or forward vet email to your household’s CovePet address, CovePet’s server gets its text: from the file, from text recognition CovePet runs for scans, or from what your phone already read. CovePet’s own reader looks for records first.

The text is also sent to an AI text model (Gemma, made by Google) that Cloudflare runs for CovePet in Workers AI. Cloudflare doesn’t keep the text after it answers and doesn’t use it to train models. Google doesn’t receive it. The model suggests records, and you check each one before it’s saved.

It’s off until you say yes, which CovePet asks before your first document. Turn it off at any time in Account. Off, CovePet’s own reader still reads the document.

CovePet sends email about your account, such as sign-in codes. Product updates go only to addresses that asked for them, and every update email carries an unsubscribe link.

Where the law asks for a legal basis, CovePet uses this information to provide the service you asked for, for MSDC’s legitimate interest in keeping the service secure and working, with your consent for product update email and for reading documents with AI, and to meet legal obligations such as billing records.

CovePet uses essential session cookies to keep you signed in and protect account access. If essential cookies are disabled, signed-in parts of CovePet may not work correctly.

The covepet.com website counts page views with Cloudflare Web Analytics. The count sets no cookies and does not build a profile of you. CovePet does not use advertising cookies. The apps run no analytics or advertising code; the counts in 2.4 are made on CovePet’s server.

These providers process information only as needed to operate the service:

• CovePet runs on Cloudflare Workers. Account and pet records are stored in Cloudflare D1 and Durable Objects. Attached photos, videos, and documents, and shared vet summary PDFs, are stored in Cloudflare R2. Cloudflare also sends account and product update email, and keeps the counts in 2.4.
• Cloudflare Workers AI runs the AI text model described in 3.3, only for people who allow it, and the speech model described in 3.2 when a phone can’t transcribe.
• Better Auth, running inside CovePet, manages account sign-in and session records.
• An address on the product-updates list is stored in Cloudflare D1.
• Apple’s push service and Google’s Firebase Cloud Messaging deliver notifications to your phone. They carry short household notices, such as a caregiver joining.
• Superwall manages subscriptions and their status, and the purchase screens. Apple processes subscriptions bought in the iPhone app, Google Play those bought on Android, and Stripe those bought on the web.
• Sentry receives the error reports described in 2.3.

If you choose Sign in with Apple, Apple confirms your identity and may provide either your email or an Apple private relay address. If you choose Google, Google confirms your identity and provides your basic profile and verified email. CovePet does not request access to Gmail, Drive, Calendar, contacts, or other Google data.

CovePet does not receive your full card number or your Apple, Google Play, or Stripe payment credentials. CovePet checks current subscription status and stores normalized billing identifiers needed to provide access, process renewals or revocations, prevent duplicate account links, and support billing recovery.

When you search for your pet’s clinic in the iPhone app, the search goes from your iPhone to Apple Maps, not through CovePet. On the web, CovePet’s server sends your search words and a rough area from your connection to Apple Maps. CovePet does not ask for your location. If you pick a clinic, CovePet keeps its name, phone number, and Apple Maps place ID so it can open the clinic in Maps later.

When you create a shared vet summary, anyone with its link can open that summary until the link expires or is switched off. You can review active links and revoke access at any time. Revoking a link stops future access through that URL. CovePet records when a link was last opened and shows it to your household.

A household owner can invite caregivers, who can view every current and future pet in the household. Free includes one read-only caregiver. On CovePet Pro, caregivers can add health notes, update pet details, and prepare vet summaries. CovePet records who makes shared changes. The owner can remove a member, and a member can leave at any time.

CovePet support can read a household’s records only while its owner has Support Access on, for 1, 7, or 30 days, and can’t change them. Each visit is listed for the owner with its reason, and the owner can turn access off at any time.

CovePet may disclose information when the law requires it, or to protect the safety and integrity of the service.

If MSDC Ltd. is part of a merger, acquisition, or sale of assets, your information may move to the new owner, who must keep handling it under this policy. CovePet will post a notice before that happens.

CovePet does not sell your personal information, and does not share it for advertising.

CovePet keeps your active account information so it can provide the service. Deleting your account removes your active profile, pet records, attached photos, videos, and documents, shared vet summaries, and sign-in records from CovePet’s active systems. Backups clear within 30 days.

If an App Store subscription has been linked to the deleted account, CovePet retains only a keyed, non-readable digest of the account token for 400 days. This prevents the same subscription from being silently attached to another account and supports a verified recovery request through one complete annual renewal cycle. CovePet does not store signed Superwall webhook bodies. Normalized billing status, non-readable identifiers, and audit records may be retained as needed for payment integrity, fraud prevention, legal obligations, and support.

Information travels over encrypted connections and is stored by Cloudflare, which encrypts it at rest. Access is limited to what is needed to run and support the service. No system is perfectly secure. CovePet will tell you if a breach affects your information, as the law requires.

The household owner can download a data export. Anyone can update their account, revoke links they made, turn reading documents with AI on or off, delete pets and records without deleting the account, or delete the account itself in the app or the web app. Without the app, email hello@covepet.com from the account’s address to have it deleted.

In the CovePet app or the web app, go to Account, then Delete Account. It removes your pets, every record, attached photos, videos, and documents, vet summary links, your household, and your sign-in on every device. It cannot be undone, so use Export Data in Account first if you want a copy.

If you are a member of someone else’s household, you leave it and their records stay. Removing the app from your phone does not delete your account.

Deleting does not cancel a subscription. Cancel it where you bought it: in Apple’s Settings, in Google Play, or on the web in Account, then Plan.

Without the app, or if you cannot sign in, email hello@covepet.com from the address you sign in with and ask for the account to be deleted. The address covepet.com/delete-account brings you here. CovePet confirms within 30 days. From another address, CovePet checks that it is you first.

Depending on where you live, you can ask CovePet to:

• Confirm whether CovePet holds your information, and give you a copy.
• Correct information that is wrong or incomplete.
• Delete your information.
• Give you your information in a portable format.
• Stop or limit a use you object to.
• Withdraw a consent you gave, such as product update email.

Email hello@covepet.com. CovePet may need to confirm your identity first, and answers within 30 days.

If you are not satisfied with the answer, you can complain to your privacy regulator. In Canada, that is the Office of the Privacy Commissioner of Canada. In the European Economic Area or the United Kingdom, it is the data protection authority where you live or work.

Under the California Consumer Privacy Act, you can ask to know what personal information CovePet collects, uses, and discloses, and to correct or delete it. CovePet does not sell or share personal information for cross-context behavioral advertising, and does not use sensitive personal information beyond what is needed to provide the service. CovePet will not treat you differently for using these rights.

Email hello@covepet.com. CovePet may need to confirm your identity first. An authorized agent can ask for you with written permission. CovePet answers within 45 days, and will say if more time is needed, up to 90 days in total.

CovePet’s providers run in many countries, so your information may be stored or processed outside the country where you live, including in Canada and the United States. Privacy laws there may differ from yours. Those providers protect information under contract.

CovePet is not directed to children under 16, and does not knowingly collect their personal information. If CovePet learns that a child under 16 has given personal information, CovePet will delete it.

This policy may change as CovePet and its privacy practices change. The latest revision date is at the top of this page. If a change materially affects how CovePet uses your information, CovePet will tell you in the app or by email before it takes effect.

For privacy questions, requests, or concerns about how CovePet handles information, email hello@covepet.com.