Privacy policy

Kova is built and run by its founder, a student at Western University in London, Ontario, Canada. In this policy, “Kova”, “we” and “us” mean the service and the person running it. Questions or requests about your data go to Kova support.

• Your account: email address, name, and either a hashed password or, if you use Google sign-in, the name, email and profile picture Google shares (Kova doesn't keep Google's access tokens). Also your plan, when you signed up, when you agreed to the terms, and an optional bio and profile picture link.
• Your study profile and settings: your school if you add it, daily card and study-time goals, time zone, reminder time and reminder choices, theme, default chat model, and any custom instructions you write for Kova.
• Your courses: names, colours, exam dates, and the topics and lecture schedule Kova reads from a syllabus you upload.
• Your course material: the text extracted from files you upload or notes you paste, with the file name, page count and size. The original file isn't kept. To answer questions about a course, Kova also stores a searchable index of passages from that text.
• What you make in Kova: study guides, flashcards, practice quizzes and your answers, course notes you write or save from chat, and your review history (which cards you rated and when), which is what makes scheduling work.
• Your chats: conversations with Kova, including files you attach (their text is saved as part of the message) and a note where you attached an image: the AI sees the image for that reply, but it isn't kept.
• Memory, only if you turn it on: short notes about your studies that Kova picks up from what you type in chat: your program, year, courses, exam dates, or how you like things explained. Kova never saves health or disability details, religion, sexuality or gender identity, ethnicity, immigration status or financial details there. You can see and delete them in Account, under About you. Deleting a chat doesn't delete notes taken from it.
• Reminders: if you allow browser notifications, the push address your browser gives Kova and the name of the browser it came from; and a log of which reminder and recap emails were sent when, so you aren't emailed twice.
• AI provider keys, if you add one: stored encrypted, used only for your own requests, and deleted when you remove them.
• Usage: counts of chat messages, lectures and quizzes, and the estimated cost of each AI request (token counts and price, never what was written), so plan limits and your AI allowance (see the terms) can be enforced.
• Billing: once you start a checkout, your Stripe customer ID; if you pay, your plan, what you paid for the current billing period, renewal or expiry date and payment status. Never your card number.
• Security log: sign-ins, failed sign-in attempts, sign-ups, email confirmation, password resets and changes, signing out everywhere, settings changes, adding or removing an AI provider key, and data exports, with the IP address and browser they came from. This is how break-in attempts are spotted.

When you upload a PDF, PowerPoint or Word file, Kova usually reads it in your browser and sends only the extracted text. If your browser can't read a file, Kova sends the file itself to its server and reads it there instead. Either way, the original file is discarded once the text is out, and only the text is kept.

Kova relies on these services. Each only gets what it needs for its job. The list matches this deployment: a service that's switched off here isn't listed.

• OpenAI: always indexes your course material for search (it turns passages of the text into numbers that can be searched by meaning), whichever chat model you pick. By default it also writes your study guides, flashcards and quizzes from your material, grades written quiz answers, reads syllabi, names your chats from their first message, and answers the homepage demo. It receives the text it works on: your material, your question, your answer.
• The chat model you pick, from OpenAI, Anthropic, Google (Gemini) or Groq: receives your chat messages and the images you attach, earlier messages in that chat, the course passages relevant to your question, your custom instructions and, with Memory on, your saved notes. If the model you picked isn't responding, Kova may send the same request to another model, which can be from another of these providers, and the chat says when it did.
• Anthropic: with Memory on, each message you type is also sent to Anthropic (Claude Haiku) to pick out notes worth saving, whichever chat model you use.
• Serper: if you turn on web search in a chat, the start of your question (up to 256 characters) is sent to Serper, a Google search API, as the search.
• Resend: delivers Kova's emails (listed under emails), so it receives your email address and each email's content. Reminders and recaps include your course names, exam dates and how many cards are due.
• Browser push services (Google, Mozilla, Apple or Microsoft, depending on your browser): if you turn on notifications, they deliver Kova's encrypted reminder messages. They see the push address, not the content.
• Stripe: handles payments and stores your card details. When you start a checkout it receives your email address and your Kova account ID; Kova never sees your card number.
• Google sign-in, if you use it: Google confirms who you are and shares your name, email address and profile picture with Kova.
• Vercel and Neon: Kova runs on Vercel, and its database (everything listed above) is hosted by Neon. Like any web host, Vercel sees the requests your browser makes, including your IP address. Your data may be stored and processed in the United States or other countries where these providers operate.

AI providers process what they receive under their API terms. Kova itself never uses your course material or chats to train AI models.

Kova counts page visits and product events (like “created a course”) with its own analytics, which don't use cookies. Visitors who aren't signed in are counted with a code made from a hash of their IP address and browser that changes every day; Kova's analytics never store the IP address itself.

Where you came from. If you arrive from a tagged link (utm_source, utm_medium or utm_campaign, or a short ref code) or from another site, Kova notes that tag and the other site's name (never the full address). The first one is kept in your browser's local storage, not a cookie, for up to 90 days; if you create an account, it's recorded once with your sign-up, so we can tell which links bring students. Each visit to Kova's public pages also sends that visit's own tag and site name with the anonymous visit count.

The homepage demo. Notes you paste into the demo, and the cards Kova made from them, are saved in your browser so you can keep them if you sign up within two hours. After that Kova no longer offers them, and removes them from your browser the next time it looks. They aren't stored on Kova's servers unless you add them to a course.

Guest chat (without an account) is limited per network, so Kova keeps a scrambled (hashed) form of your IP address and network for about two days to count guest messages. Text you send in guest chat or the homepage demo goes to an AI provider like any chat message, so leave personal details out of it.

Cookies are used only to keep you signed in and to count guest chat messages. There are no advertising or cross-site tracking cookies. Your browser's local storage also keeps a few things on this device only: your light or dark theme, small layout choices, and drafts you haven't saved yet, such as quiz answers and notes.

• Account emails: confirming your address, password links, and security notices: your password changed, sign-in was paused after many wrong passwords, or someone tried to sign up with your address. These go out whenever they're needed.
• Your first few days: if you haven't confirmed your email, up to two reminders to do it (about a day and three days after signing up), with a fresh link. If your address is confirmed but you haven't added anything to study yet, one “finish setting up” email about a day after signing up. These only go out in your daytime.
• Study reminders and the weekly recap: a reminder at the hour you choose on days you have cards due, and a recap on Sunday evening. They only go to a confirmed address.

To stop them, use the unsubscribe link at the bottom of any reminder, recap or setup email, or the switches in Account under Study & reminders: “Daily email” turns off the reminders and the setup and confirm-your-email emails, and “Weekly recap email” turns off the recap. Account emails can't be turned off while you have an account: they're how you confirm, recover and protect it.

• Sell or rent your data to anyone.
• Show ads.
• Train AI models on your course material or chats.
• Share anything with your school or instructors.

Nothing you make is public unless you share it. If you create a share link for a chat, anyone with the link can read that chat as it was when you shared it, until you turn sharing off or delete the chat. Shared pages ask search engines not to index them.

• Your account and everything you make: until you delete them or your account.
• Chats you delete: hidden straight away, with their images and share link deleted at once; the chat itself is erased for good within 30 days.
• Security log: the IP address and browser are removed after 90 days; the entries after 2 years.
• Anonymous page-visit counts: 13 months.
• Guest chat counters (hashed IP addresses): about 2 days.
• Expired confirmation and password links: deleted a week after they expire.

You can delete a file, a course, a flashcard, a chat or your saved memories at any time from inside Kova. Deleting a course deletes its materials, study guides, flashcards, quizzes and notes, but not the chats you had in it: those stay in your chat list (and can quote short passages from the course) until you delete them too.

Deleting your account (Account, then Privacy & security) permanently erases your account and everything in it, including images you attached in chat, and cancels any active subscription so you aren't charged again. It can't be undone. A few records stay without your name on them: security log entries (without the IP address or browser), product analytics events, and the cost records of your AI use (token counts and estimated cost, never what you wrote) are kept but no longer linked to you. Your Stripe customer record is deleted too; Stripe keeps its own record of past payments, as the law requires.

Kova is made for university and college students. You need to be 13 or older to use it, and if you're under 18 you need a parent's or guardian's permission. In Quebec, anyone under 14 needs a parent's or guardian's consent before using Kova. If we learn that an account belongs to someone under 13, or to someone under 14 in Quebec without that consent, we delete it.

You can download a copy of your data at any time from Account, under Privacy & security. To have something corrected or deleted, or for anything the export doesn't cover, email Kova support. You also have the rights given to you by the privacy law where you live, including Canada's PIPEDA.

If this policy changes, the date at the top changes too. If a change affects how your data is used, you'll hear about it before it takes effect. See also the terms of service and the security page.