Privacy policy

CovePet is made by MSDC Ltd. (“MSDC”). MSDC is responsible for the personal information in this policy.

This policy covers the CovePet iPhone app, the covepet.com website, vet-summary links, and the email CovePet sends. The Terms of service explain the rest of the agreement between you and MSDC Ltd.

CovePet stores information you choose to provide so it can organize your pet’s care history. This can include:

• Account details such as your name, email, and phone. The household owner’s name and phone, when saved, are printed on every vet summary the household shares.
• Pet profiles, baseline health context, and vet contact details.
• Symptoms, behavior changes, medications, diet changes, and vet notes.
• Photos, videos, and documents you attach to a health record.
• Vet summary links and the sharing choices connected to them.
• Household invitations, caregiver membership, and who added or changed shared records.
• An email address you leave on the site to hear when CovePet ships.

CovePet keeps the sign-in providers linked to your account, and the subscription provider, plan status, renewal status, and limited billing identifiers used to verify access and prevent an App Store purchase from being linked to the wrong CovePet account.

To deliver and protect CovePet, the hosting provider handles technical information such as your IP address and browser type with each request. CovePet does not use it to build a profile of you.

When something fails in the app, the site, or the service, an error report is sent to Sentry. It says what failed, and can include the app version, operating-system version, browser, and device model. CovePet removes account, pet, and health information, IP addresses, and device identifiers before a report is sent.

CovePet uses this information to authenticate your account, save and display your records, prepare vet summaries, provide support, find and fix errors, and protect access to the service.

When you type a note in the iPhone app, your iPhone reads it to suggest records, with CovePet’s own reader. The note is not sent to CovePet or to any AI service for this step. Only what you review and save is sent to CovePet and stored with your account. That includes the note the records came from.

CovePet sends email about your account, such as sign-in codes. Product updates go only to addresses that asked for them, and every update email carries an unsubscribe link.

Where the law asks for a legal basis, CovePet uses this information to provide the service you asked for, for MSDC’s legitimate interest in keeping the service secure and working, with your consent for product update email, and to meet legal obligations such as billing records.

CovePet uses essential session cookies to keep you signed in and protect account access. If essential cookies are disabled, signed-in parts of CovePet may not work correctly.

The covepet.com website counts page views with Cloudflare Web Analytics. The count sets no cookies and does not build a profile of you. CovePet does not use advertising cookies. The iPhone app runs no analytics.

These providers process information only as needed to operate the service:

• CovePet runs on Cloudflare Workers. Account and pet records are stored in Cloudflare D1. Attached photos, videos, and documents, and shared vet summary PDFs, are stored in Cloudflare R2.
• Better Auth manages account sign-in and session records.
• Resend delivers CovePet email. An address on the product-updates list is stored in Cloudflare D1 and held by Resend.
• Superwall manages subscription status and the iPhone purchase flow, and Apple processes subscriptions bought in the iPhone app.
• Sentry receives the error reports described in 2.3.

If you choose Sign in with Apple, Apple confirms your identity and may provide either your email or an Apple private relay address. If you choose Google, Google confirms your identity and provides your basic profile and verified email. CovePet does not request access to Gmail, Drive, Calendar, contacts, or other Google data.

CovePet does not receive your full card number or App Store payment credentials. CovePet checks current subscription status and stores normalized billing identifiers needed to provide access, process renewals or revocations, prevent duplicate account links, and support billing recovery.

When you search for your pet’s clinic in the iPhone app, the search goes from your iPhone to Apple Maps, not through CovePet, and CovePet does not ask for your location. If you pick a clinic, CovePet keeps its name, phone number, and Apple Maps place ID so it can open the clinic in Maps later.

When you create a shared vet summary, anyone with its link can open that summary until the link expires or is switched off. You can review active links and revoke access at any time. Revoking a link stops future access through that URL. CovePet records when a link was last opened and shows it to your household.

A household owner can invite caregivers, who can view every current and future pet in the household. Free includes one read-only caregiver. On CovePet Pro, caregivers can add health notes, update pet details, and prepare vet summaries. CovePet records who makes shared changes. The owner can remove a member, and a member can leave at any time.

CovePet may disclose information when the law requires it, or to protect the safety and integrity of the service.

If MSDC Ltd. is part of a merger, acquisition, or sale of assets, your information may move to the new owner, who must keep handling it under this policy. CovePet will post a notice before that happens.

CovePet does not sell your personal information, and does not share it for advertising.

CovePet keeps your active account information so it can provide the service. Deleting your account removes your active profile, pet records, attached photos, videos, and documents, shared vet summaries, and sign-in records from CovePet’s active systems.

If an App Store subscription has been linked to the deleted account, CovePet retains only a keyed, non-readable digest of the account token for 400 days. This prevents the same subscription from being silently attached to another account and supports a verified recovery request through one complete annual renewal cycle. CovePet does not store signed Superwall webhook bodies. Normalized billing status, non-readable identifiers, and audit records may be retained as needed for payment integrity, fraud prevention, legal obligations, and support.

Information travels over encrypted connections and is stored by Cloudflare, which encrypts it at rest. Access is limited to what is needed to run and support the service. No system is perfectly secure. CovePet will tell you if a breach affects your information, as the law requires.

The household owner can download a data export. Anyone can update their account, revoke links they made, or delete their account.

Depending on where you live, you can ask CovePet to:

• Confirm whether CovePet holds your information, and give you a copy.
• Correct information that is wrong or incomplete.
• Delete your information.
• Give you your information in a portable format.
• Stop or limit a use you object to.
• Withdraw a consent you gave, such as product update email.

Email hello@covepet.com. CovePet may need to confirm your identity first, and answers within 30 days.

If you are not satisfied with the answer, you can complain to your privacy regulator. In Canada, that is the Office of the Privacy Commissioner of Canada. In the European Economic Area or the United Kingdom, it is the data protection authority where you live or work.

Under the California Consumer Privacy Act, you can ask to know what personal information CovePet collects, uses, and discloses, and to correct or delete it. CovePet does not sell or share personal information for cross-context behavioral advertising, and does not use sensitive personal information beyond what is needed to provide the service. CovePet will not treat you differently for using these rights.

Email hello@covepet.com. CovePet may need to confirm your identity first. An authorized agent can ask for you with written permission. CovePet answers within 45 days, and will say if more time is needed, up to 90 days in total.

CovePet’s providers run in many countries, so your information may be stored or processed outside the country where you live, including in Canada and the United States. Privacy laws there may differ from yours. Those providers protect information under contract.

CovePet is not directed to children under 16, and does not knowingly collect their personal information. If CovePet learns that a child under 16 has given personal information, CovePet will delete it.

This policy may change as CovePet and its privacy practices change. The latest revision date is at the top of this page. If a change materially affects how CovePet uses your information, CovePet will tell you in the app or by email before it takes effect.

For privacy questions, requests, or concerns about how CovePet handles information, email hello@covepet.com.