kove privacy policy
Draft. Effective date to be set at launch, after review by counsel.
This page explains what data the kove app touches, where it goes, and what you can do about it. It is written to be read, not skimmed past. A separate Consumer Health Data Privacy Policy, covering health data in more depth as Washington law requires, will be published here once it clears legal review. The Terms of Use are the agreement between you and kove.
Who we are
kove is made by Leo Athletics LLC, doing business as kove. The app scans a supplement label or barcode and returns an evidence-graded quality score. It is a general wellness product. It does not diagnose, treat, or prevent any disease, and it is not a substitute for professional medical advice.
What we collect
Scanning needs an account
Scanning requires signing in with Apple. Your settings stay on your phone. Your scan history is kept in your account, so it is still there after a reinstall or on a new phone; signing out removes it, and your profile photo, from the phone you sign out of, and signing back in brings the history back. kove's servers also keep a record of every scan, linked to your account: the product, the score, and when you scanned it. That is how coverage improves for the next person, and you can export it at any time, and deleting your account removes it. Your saved stack is held in your account, so it is still there when you sign back in. Here is everything that leaves your phone when you scan:
- What the scan needs travels in flight, and is never stored. The label photo, the label's text, and the product's name, brand, and barcode go through kove's servers to the AI services that read the label and write the summary; our servers may also fetch public brand and retailer pages to fill in missing product details, and your phone may fetch a brand's own product page directly, as described below. None of it carries your identity. It is not saved on our servers, and kove does not keep the photo on your phone either. The AI service that reads it processes it under API terms that do not permit training on it; it is not used for anything but answering your scan. The camera captures the full frame, so a photo can incidentally include your hand or the room behind the bottle. Point the camera at the label.
- Public sources are asked about the product. The app sends the barcode, or the brand and product name, to the NIH Dietary Supplement Label Database. When a web read of the barcode names the maker's own product page, the app also fetches that page, its product data and one label image from the maker's website. These requests go straight from your phone, so those services see your device's IP address, the same way any website you visit does. The requests to the maker's website carry only the page address, which names the product the way any product page's address does, and a fixed app identifier, never your name, your account or the barcode.
- The product joins a shared cache. The parsed product, its name, brand, ingredients, and score, is saved so the next person who scans the same bottle gets an instant result. The cache stores the product, not the person. Nothing in it points back to you.
- Safety checks leave a minimal trace. If a scan trips one of our safety checks, we record that the check fired: the type of check, which safety layer caught it, how many signals tripped it, and a timestamp. Not the product, not the photo, not anything you typed, and no link to you.
With an account
Signing in uses Sign in with Apple. We receive the name and email you approve. The email can be Apple's private relay address if you choose to hide your real one, and the name is stored with your account so the app can greet you by it. An account adds these records on kove's servers:
- Your saved stack. The products you keep, with any dosage, schedule, or notes you add.
- Your scan history. The products you scanned or opened, with the score and details you were shown and when. It is what the app's history screen shows, kept in your account so it survives a reinstall and follows you to a new phone. Deleting a scan in the app removes it here too.
- Scan events. Which products your account scanned, when, the score shown, and whether you corrected or abandoned the result. When we could not read a label well enough to score it, the part we did read and why we stopped. We use this to find and correct wrong or weak scan results.
- A profile photo, if you choose one. It is stored in a private space only your account can reach, and you can remove or replace it at any time.
Our backend also keeps rate-limit counters, keyed to an account id or IP address, to keep the service healthy. They are operational housekeeping, not a profile of you.
With a premium subscription
Payment runs through Apple, and RevenueCat validates the receipt. kove receives receipt data and an app-generated user id. We never see your card number, and we could not store it if we wanted to.
Where your data goes
These are the outside services that receive data as part of running the app. Three more flows exist behind the scenes: our servers fetch public brand and retailer pages to fill in missing product details (product names and barcodes only); your phone fetches a maker's own product page and label image directly when a web read names it (your device's IP address and a fixed app identifier, nothing else); and our internal operations tools receive product-level notes about scan quality, product names and scores, never your identity.
| Service | Why kove uses it | What it sees |
|---|---|---|
| Supabase | Runs kove's backend: database, sign-in, file storage. Hosted in the United States. | Everything described above that lives on kove's servers. |
| OpenAI | Reads label photos, structures label text, resolves barcodes, finds product images, and writes some score summaries. It also runs web searches for missing product details. | The label photo in flight, plus label text (including any warnings printed on it), product names, brands, barcodes, serving sizes, ingredients with doses, and, when it writes a summary, the score being summarized. Requests come from kove's servers, so OpenAI never sees your identity or your device. |
| Anthropic | Writes the plain-language summary of a score. | Product data only: names, ingredients, doses, scores. Never any user data. |
| NIH Dietary Supplement Label Database | Looks up the official label record for a scanned product. | The barcode or product name, and your device's IP address, because the app asks it directly. |
| Brand websites | When a web read of a barcode names the maker's own product page, your phone fetches that page, its product data and one label image. | The brand and its content delivery network see your device's IP address, a fixed app identifier and the page address. No name, barcode or account detail is sent. |
| RevenueCat | Confirms subscription receipts. | Receipt data and an app user id. Never your card number. |
| Apple | Handles sign-in and payment. | What you share with Apple is governed by Apple's own privacy policy. |
We do not sell your data, and we do not share it with advertisers or data brokers. Every service above is a processor acting on kove's instructions, under terms that forbid using your data for anything else. We do not share your data with anyone for cross-context behavioral advertising, and we have never done so.
What we never collect
- Your location. The app never asks for it.
- Your contacts. Never requested.
- Apple Health data. kove does not connect to HealthKit today. If that ever changes, this policy changes first, before the feature does.
- Analytics or advertising trackers. There is no analytics SDK and no ads SDK in the app. No pixels, no ad identifiers, no third-party trackers of any kind.
- The photo, after the scan. The camera frame is never stored by kove, anywhere: not on your phone, not on our servers. It exists only for the moment the scan is being read.
Your rights
Both of these live in the app, under Profile:
- Export my data. Builds a file of what kove's servers hold about your account: your email, saved stack, scan history, scan events, your privacy choices, any health records the app has stored for you (empty for most accounts today), and the audit entries tied to your account. It does not include your profile photo, which you can view or replace in Profile. You choose where the file goes from the iOS share sheet. The file also notes what stays only on your phone and so is not included.
- Delete my account. Removes your account and the records tied to it from kove's servers. Two exceptions, both stated here rather than discovered later. First, anonymized safety records are kept, with the link to your account replaced by a placeholder, so we can show our safety checks fire when they should; they no longer identify you. Second, if you set a profile photo while signed in, that image is not yet removed automatically and there is no in-app control to delete it. Email privacy@heykove.com and we will remove it by hand. We are closing this gap, and this page will say so when it is closed.
You can also email privacy@heykove.com for either, or with any question about this policy. We respond within 30 days.
Your choices
Privacy Controls in Profile lists each purpose kove can use your account data for, as a switch you can turn off at any time. Turning one off stops that use going forward; it does not erase data already processed, which the deletion right above does.
If you live in California, Colorado, Connecticut, Virginia, or another state with a privacy law, the rights above are yours by statute as well as by our policy: to know what we hold, to get a copy, to correct it, to delete it, and to opt out of sale, sharing, or profiling. We do none of the last three. We will not treat you differently for using these rights. You can appeal a decision we make on a request by writing to appeals@heykove.com, and if we still decline, to your state's Attorney General.
Do Not Track and Global Privacy Control. kove has no tracking to turn off, so these signals change nothing; there is nothing to opt out of.
Children
kove is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child under 13 has given us data, email privacy@heykove.com and we will delete it.
Changes
We will update this page when our practices change. Material changes will be announced in the app before they take effect. The current version always lives at heykove.com/privacy.
Contact
Leo Athletics LLC, doing business as kove.
419 Sweetbriar St, Plano, IL 60545, United States
- Privacy questions and requests: privacy@heykove.com
- Everything else: support@heykove.com