LEGAL

Privacy Policy

Effective date: October 27, 2026

Coval is built so that your follower data stays on your phone. This policy currently covers the released iOS app and this website (getcoval.com). Android is not yet released and must complete a separate privacy audit before launch. In short: we do not collect your follower lists, usernames, follow timestamps, passwords, or any account credentials.

Data processed on your device

When you import an official data export (a ZIP file you download from your social account), Coval reads only the files it needs to understand your connections. This includes follower and following lists, usernames, and follow timestamps.

• This data is processed only on your device. It is never sent to a Coval server — there is no Coval server for it.
• Snapshots are stored in a SQLCipher-encrypted local database inside the app’s private storage on your device, and are excluded from device backups.
• Coval copies the ZIP you select into its own protected temporary import area. That app-owned copy is deleted as soon as the import finishes or fails; your original selected file is not deleted.

No passwords, no account access

Coval never asks for your social account password, never shows a social login screen, and does not use scraping or unofficial APIs. It only works with the export file you choose to import.

App analytics and website analytics

The iOS app does not currently transmit analytics. Its analytics component is memory-only and is not connected to Aptabase or another network service. If app analytics is activated later, we will first review the App Store privacy label based on the actual payload (including whether Product Interaction data is Not Linked to You); we will not continue to claim “Data Not Collected” if transmission makes that inaccurate.

This website may send site events such as “page viewed” through Aptabase. Website analytics is separate from the app and cannot access an export or the app database.

• These events never contain usernames, follower lists, timestamps from your export, or any content from your data.
• No cookies, advertising identifiers, or cross-app tracking are used.
• Events may include general technical details such as app version, operating system, and device language.

Purchases

Subscriptions and one-time purchases are handled by the Apple App Store or Google Play. We do not receive your payment details. The app only checks with the store whether a purchase is active.

Backups you create

If you choose to export an encrypted Coval backup file, it is saved where you decide (for example, iCloud Drive, Google Drive, Dropbox, or local Files). Coval does not upload it anywhere by itself. Files stored with those providers are subject to their own privacy policies.

Share cards

Share cards you create show aggregate numbers only (counts and percentages). They never include another person’s username. Sharing is always started by you.

PDF reports and external links

A PDF report can include usernames and is created only when you request an export. Coval keeps its temporary sharing copy in protected, non-backed-up app storage and removes it after the share sheet is dismissed; a copy you save or send outside Coval remains under your control and is not removed by an in-app wipe.

If you choose to open a profile website from a report, iOS opens that external site at your request. The destination and your browser are governed by their own privacy policies.

Notifications

Optional reminders (for example, a weekly reminder to import a new export) are scheduled locally on your device.

This website

getcoval.com is a static informational site hosted on Cloudflare. Like any web host, Cloudflare may process technical data such as IP addresses to deliver the site and protect it from abuse. You cannot upload an export to this website, and it does not set advertising or tracking cookies.

Deleting your data

Because your data lives on your device, you are in control. You can erase Coval’s local database and encryption key, PIN and local settings, reminders, and app-owned temporary imports, reports, and backups from the app’s settings at any time, or by deleting the app. Copies you deliberately exported to Files or another provider are outside the app sandbox and are not removed. We hold no copy of your follower data that could be deleted on our side.

Children

Coval is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from children.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new effective date.

Contact

Questions about privacy? Email support@getcoval.com.