Privacy Policy

This policy explains what information Kovca collects when you use kovca.io, the developer dashboard, and the Kovca APIs, and how we use it.

Information we collect

Account information

• Your email address, the name you choose to add, and your workspace name.
• How you sign in (email and password, Google) and whether two-factor authentication is on. If you add a phone number for two-factor authentication, we keep it to send sign-in codes.
• Account timestamps, such as when you joined and last signed in.

API usage metadata

For each API request we record a request ID, the API and operation called, the status code, latency, the API key used (by ID and display prefix), and the time. We also record internal processing details used to run and improve the service.

Website analytics

If you accept analytics cookies, we use Google Analytics (through Firebase) to understand how our website and dashboard are used: pages viewed, sign-ups and sign-ins (and the method used), and device, browser, and approximate location information that Google derives from your connection. When you're signed in, we link these events to an internal account identifier, never your email address. If you decline, we don't load Google Analytics.

With that same consent we also record product milestones: creating an API key, the first successful API request and the first time that happens on a later day, playground requests (which API, and whether the request succeeded), and turning on a paid plan. Those are sent from our servers and tied to the Google Analytics client id stored on your account, plus the internal account id. They can include the sign-in method, the API's name, or the plan name. They don't include your email, your API keys, or the content of API requests or responses.

If you accept, we store on your account the page you first landed on, the referring site (host and path only), and the campaign parameters utm_source, utm_medium, and utm_campaign from that first page. Until you choose, that note stays in this browser tab only. If you decline, we delete it and we don't store the client id, so those server events aren't sent. You can change your mind later from “Cookie settings” in the footer; declining then removes the stored client id and first-touch details from your account.

What we don't collect

• We don't store the content of API requests or responses. They're processed in memory to produce a result.
• We don't store full API keys, only a one-way hash.
• We don't use advertising trackers, and we don't use Google Analytics data for advertising.

How we use information

• To provide the service: authenticate you, run API requests, enforce rate limits, and show your usage.
• To understand how the website and dashboard are used and improve them, if you accept analytics cookies.
• To secure the service and prevent abuse.
• To contact you about your account, security, or changes to the service.
• To bill for usage: count billable requests, send usage to our billing providers, and collect payment.

We don't sell your information.

Service providers

We use service providers to run Kovca: Google Cloud and Firebase for hosting, authentication, and our database (in the United States), Google Analytics for website analytics if you accept it, Stripe for payments and Metronome for usage invoicing if you turn on Pay As You Go (they receive your email, billing address, and request counts; card details go only to Stripe), and third-party AI services that process API request content to produce results. They process information only to provide their services to us.

Cookies

We use one essential cookie, __session, to keep you signed in to the dashboard. Your theme preference and your analytics cookie choice are stored in your browser. If you accept analytics cookies, Google Analytics sets _ga and _ga_* cookies, which last up to two years, and we keep the client id from _ga on your account so server-side usage events stay attached to that browser. Until you choose, the landing page and campaign parameters are kept in session storage for this tab only. We don't use advertising cookies. You can change your choice at any time from “Cookie settings” in the site footer.

Retention and deletion

We keep account information and usage metadata while your account is open. You can delete your account at any time from Settings, which permanently deletes your account, workspace, API keys, and usage history. If your workspace was billed, we keep its financial records (billable request metadata, invoices, and payment-provider references, without your name or email) for seven years to meet accounting and tax obligations, and then delete them. Usage already incurred is still invoiced.

Your choices

You can update your name and email in Settings, and request a copy or deletion of your information by emailing support@kovca.io.

Changes

We'll post changes to this policy here and update the date above. For material changes we'll notify you by email.

Contact

Questions about privacy: support@kovca.io.