Security

When you upload a PDF, PowerPoint or Word file, Kova usually reads it in your browser and sends only the extracted text. If your browser can't open a file, Kova reads it on its server and then discards it. Either way the original file isn't stored, only the text taken from it.

Every request is checked against your signed-in account, and every database lookup for courses, lectures, flashcards, quizzes and chats is limited to your own records. Asking for someone else's course by its ID returns “not found”, the same as a course that doesn't exist.

• Passwords are hashed with Argon2 and never stored in plain text. You can also sign in with Google and skip the password entirely.
• After 8 wrong passwords from one network, sign-in to that account from that network pauses for 15 minutes. Sign-in attempts are also rate-limited per network.
• If an account gets a lot of wrong passwords in an hour from many networks, password sign-in for it pauses. Its owner gets an email, and resetting the password gets them back in straight away.
• Sessions are kept in encrypted, HTTP-only cookies that page scripts can't read. They end after 14 days without use, and 30 days after you signed in however much you use them.
• In Account → Privacy & security you can change your password (your current one is needed) or sign out of every device at once. Both end every other session, and a password change is confirmed by email.
• Deleting your account asks for your password again, or a fresh Google sign-in, so a borrowed or stolen session can't do it.

• Everything is served over HTTPS.
• Pages are sent with a Content Security Policy that lets scripts load from, and talk to, only Kova and the few services listed in the privacy policy, plus headers that stop Kova from being framed by other sites and stop browsers from guessing file types.
• AI provider keys you add are encrypted and bound to your account, so a copy is useless anywhere else.
• Requests to AI providers go over their encrypted APIs.

Card payments are handled entirely by Stripe. Kova never sees or stores your card number; it only keeps a reference to your Stripe customer and the state of your plan.

Sign-up, sign-in, chat, uploads and password emails are rate-limited, and each plan has usage limits. That keeps one account (or one script) from slowing Kova down for everyone else, or flooding someone's inbox.

Someone signing up with your email address can't keep the account: confirming it needs your own sign-in or a new password set from your inbox, and doing that removes anything they set up to keep working for them.

You can delete a lecture, a course or a chat at any time. Deleting your account erases it and everything in it. See the privacy policy for the details, including how long logs are kept.

If you think you've found a security issue, please email Kova support with the steps to reproduce it before sharing it publicly, and please don't access anyone else's data while testing.