Privacy Policy

Covrr LLC (“Covrr,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Covrr platform, website, and mobile application (collectively, the “Service”). By using the Service, you agree to the practices described in this Privacy Policy.

This Privacy Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Information We Collect

Plain EnglishWe collect your email, how you use the app, and your device info. We never see your credit card number — Stripe handles that entirely.

1.1 Information You Give Us

• Email Address — Required to create your account, log in, and receive service communications and alerts.
• Name — Collected at registration and used to personalize your experience and for customer support via Intercom.
• Password — Stored in hashed form. We never store or transmit your password in plain text.
• User Preferences & Settings — Bet types, sport preferences, notification settings, and any custom model configurations you create.

1.2 Payment Information

All payment processing is handled by Stripe, Inc., a third-party payment processor. When you enter your payment details, that information is transmitted directly and securely to Stripe. Covrr never receives, stores, or processes your credit card number, CVV, or full bank account details. We receive only a limited set of non-sensitive payment metadata from Stripe, including:

• Subscription status (active, cancelled, paused)
• Last four digits of the card on file (for display purposes only)
• Card type and expiration date
• Billing country

1.3 Usage Data

We use PostHog, an analytics platform, to collect anonymized data about how you interact with the Service. This includes:

• Pages and features visited within the app
• Clicks, navigation flows, and session duration
• Feature adoption and engagement patterns
• Error and crash events

PostHog data is anonymized and used only to understand how users interact with the product so we can improve it. We do not use PostHog to build individual behavioral profiles for advertising purposes.

1.4 Device and Technical Information

When you access the Service via our mobile application or website, we automatically collect certain technical information, including:

• Device type, operating system, and version
• Browser type and version (for web access)
• IP address (used for security and fraud prevention; not sold or shared with advertisers)
• Unique device identifiers
• Mobile carrier and network type
• App version and installation data

1.5 Information We Do Not Collect

We do not collect or request:

• Social Security numbers or government-issued ID numbers
• Precise real-time geolocation data
• Biometric data
• Data from your contacts, microphone, or camera
• Any personal data sent to Anthropic for AI features — only anonymized game data is transmitted (see Section 3.4)

Instagram comments and messages

If you comment on a Covrr Instagram post with our free-trial keyword, we receive your comment, Instagram username and an Instagram-scoped ID from Meta, check whether you follow @covrr.app, and send you direct messages with your trial code. We keep a record of the comment and whether a code was sent so we only message you once. We use this only to deliver the trial code you asked for. To have it deleted, see our data deletion instructions.

2. How We Use Your Information

Plain EnglishWe use your data to run the service, send you alerts you’ve asked for, improve the product, and process your payments. We don’t use it to build ad profiles or sell to third parties.

2.1 Provide and Operate the Service

We use your information to create and maintain your account, deliver the features and functionality you access, authenticate your identity, and ensure the security and integrity of the Service.

2.2 Process Payments

We share limited billing information with Stripe to process your subscription payments and manage billing-related communications such as payment failures and renewal confirmations.

2.3 Model Alerts and Service Notifications

With your consent, we will send you alerts and notifications related to the Service, including model outputs, pick notifications, and time-sensitive betting data. You may manage your notification preferences at any time in Account Settings. These communications are triggered by your explicit opt-in at signup or within the app.

2.4 Marketing Emails

We will only send you marketing or promotional emails if you have explicitly opted in to receive them. You may opt out at any time by clicking the unsubscribe link in any marketing email or by updating your preferences in Account Settings. Opting out of marketing emails does not affect transactional or service-related communications.

2.5 Product Improvement

We analyze anonymized usage data collected via PostHog to understand how users interact with the Service, identify areas for improvement, develop new features, and fix bugs. This analysis is conducted at an aggregate or anonymized level and does not involve reviewing individual personal data.

2.6 Customer Support

We use your name and email address within Intercom, our customer support platform, to respond to your support requests, troubleshoot issues, and communicate about your account.

2.7 Legal Compliance and Safety

We may use or disclose your information where required to comply with applicable law, respond to legal process, enforce our Terms of Service, or protect the rights, property, or safety of Covrr, our users, or others.

3. How We Share Your Information

Plain EnglishWe share data only with the vendors that help us run the product. We never sell your personal data. The table below shows every vendor, what they receive, and why.

Covrr does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share your information only as described below.

3.1 Stripe — Payment Processing

Your payment information is transmitted directly to and processed entirely by Stripe. Covrr never receives your full card number or CVV. Stripe is a PCI-DSS Level 1 certified payment processor. Your use of Stripe’s services is also subject to Stripe’s Privacy Policy.

3.2 Supabase — Database Hosting

Your account data, preferences, and usage records are stored on Supabase, a database hosting provider operating in the United States. Supabase infrastructure is hosted on AWS US regions. Your data does not leave the United States in connection with Supabase hosting.

3.3 Vercel — Application Hosting

Covrr’s web application is hosted on Vercel’s infrastructure. Vercel receives standard web request metadata including IP addresses for the purpose of serving requests and providing DDoS protection.

3.4 Anthropic — AI Features

Certain AI-powered features of the Service, including Expert Picks, are generated using Anthropic’s Claude API. When your requests trigger an AI feature, Covrr transmits only anonymized game data and statistical inputs to Anthropic’s API. We do not transmit your name, email address, account identifiers, or any other personal data to Anthropic. Anthropic’s API usage policies apply to data transmitted via the API.

3.5 SportsDataIO — Data Enrichment

We use SportsDataIO to enrich the sports data displayed within the Service. No personal user data is shared with SportsDataIO.

3.6 Resend — Email Delivery

Transactional and marketing emails are delivered via Resend. Resend receives your email address and the content of emails sent on our behalf in order to deliver them.

3.7 Intercom — Customer Support

We use Intercom to provide in-app and email-based customer support. Intercom receives your name and email address to enable our support team to communicate with you. Intercom may also collect in-app interaction data to help contextualize support conversations.

3.8 PostHog — Product Analytics

PostHog receives anonymized event data about how users interact with the Service. We have configured PostHog to avoid collecting personally identifiable information in event data. PostHog data is used solely for product improvement purposes.

3.9 Legal Disclosures

We may disclose your information to government authorities, law enforcement, or other third parties if required by applicable law, court order, or legal process, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of Covrr, our users, or others.

3.10 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy involving Covrr LLC, your personal information may be transferred to the acquiring entity as part of that transaction. We will provide notice of any such transfer and any material changes to how your data is handled.

4. Your Rights and Choices

Plain EnglishYou can access, export, or delete your data anytime. We’ll complete deletions within 30 days. You can opt out of marketing emails with one click.

4.1 Access Your Data

You have the right to request a summary of the personal data we hold about you. To submit an access request, email us at support@covrr.app with the subject line “Data Access Request.” We will respond within 30 days.

4.2 Delete Your Account and Data

You may delete your account at any time from Account Settings. Upon account deletion, we will permanently delete your personal data within 30 days, subject to the following exceptions:

• Data we are required to retain by applicable law or to fulfill legal obligations
• Anonymized, aggregated data that cannot be linked back to you
• Transaction records that Stripe is required to retain under financial regulations

Deletion is permanent and irreversible. We recommend exporting your models before deleting your account (see Section 4.4).

4.3 Opt Out of Marketing Emails

You may opt out of marketing and promotional emails at any time by:

• Clicking the “Unsubscribe” link at the bottom of any marketing email
• Updating your notification preferences in Account Settings at covrr.app/settings/notifications
• Emailing support@covrr.app with the subject line “Unsubscribe.”

Opting out of marketing emails will not affect transactional emails (such as billing receipts, password resets, and service notifications), which we send regardless of marketing preferences.

4.4 Export Your Models

You may request an export of any custom analytical models you have built within the Service in JSON format. To request an export, email support@covrr.app with the subject line “Model Export Request.” We will fulfill your request within 14 days.

4.5 Correct Your Information

You may update your name, email address, and other account information directly within Account Settings. If you need to correct information you cannot update yourself, contact us at support@covrr.app.

5. Data Retention

Plain EnglishWe keep your account data for 24 months after you cancel, then permanently delete everything. We keep it that long in case you want to come back.

We retain your personal data for as long as your account is active and for a period of twenty-four (24) months following the cancellation or termination of your subscription (the “Retention Period”). After the Retention Period expires, your personal data is permanently and irreversibly deleted from our systems and from Supabase-hosted databases.

During the Retention Period, your data is retained to:

• Allow you to reactivate your account and restore your preferences and models
• Fulfill legal and regulatory obligations
• Resolve outstanding disputes or enforce our agreements

Anonymized, aggregated data derived from your usage (such as aggregate feature engagement metrics) may be retained indefinitely as it cannot be linked back to you.

Payment records retained by Stripe are governed by Stripe’s own data retention policies and applicable financial regulations, which may require retention beyond the periods described above.

6. California Privacy Rights (CCPA / CPRA)

Plain EnglishIf you’re in California, you have additional rights under state law. We don’t sell your personal information. Ever.

This section applies to residents of California and supplements the rest of this Privacy Policy. It is provided pursuant to the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act of 2020 (“CPRA”).

6.1 Categories of Personal Information Collected

In the preceding 12 months, Covrr has collected the following categories of personal information from California consumers:

• Identifiers — Name, email address, IP address, device identifiers
• Commercial Information — Subscription history and payment metadata
• Internet or Network Activity — Usage data collected via PostHog
• Device Information — Device type, OS, browser, app version

6.2 Your California Rights

As a California resident, you have the following rights:

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete — You may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Correct — You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing — We do not sell or share your personal information for cross-context behavioral advertising. No action is required.
• Right to Limit Use of Sensitive Personal Information — We do not collect sensitive personal information as defined under the CPRA.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your California privacy rights.

6.3 How to Submit a California Privacy Request

California residents may submit a privacy request by emailing privacy@covrr.com with the subject line “California Privacy Request.” We will respond within 45 days as required by the CCPA, with an option to extend by an additional 45 days where reasonably necessary.

6.4 Authorized Agent

You may designate an authorized agent to submit a privacy request on your behalf. Authorized agent requests must include written documentation of the agent’s authority and may require identity verification.

7. European Union and UK Privacy Rights (GDPR / UK GDPR)

Plain EnglishIf you’re in the EU or UK, GDPR gives you strong rights over your data. We’ve listed our legal basis for each type of processing below.

This section applies to individuals located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, and supplements the rest of this Privacy Policy. Covrr processes personal data in accordance with the General Data Protection Regulation (“GDPR”) and, where applicable, the UK GDPR.

7.1 Data Controller

Covrr LLC is the data controller for personal data processed through the Service. For GDPR inquiries, contact: privacy@covrr.com.

7.2 Legal Bases for Processing

We rely on the following legal bases under Article 6 GDPR to process your personal data:

Contract Performance (Article 6(1)(b)) — Processing your account data, usage data, and payment metadata is necessary to perform the contract we have with you under our Terms of Service — specifically, to provide you with access to the Service.

Legitimate Interests (Article 6(1)(f)) — We process device information, technical logs, and anonymized analytics under our legitimate interests in operating a secure and improving service. We have assessed that this processing does not override your interests or fundamental rights.

Consent (Article 6(1)(a)) — We send model alerts and marketing emails only on the basis of your freely given, specific, and informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

Legal Obligation (Article 6(1)(c)) — We may process and retain certain data where required to comply with applicable legal obligations, such as tax, financial reporting, or law enforcement requirements.

7.3 Your GDPR Rights

EEA and UK residents have the following rights under the GDPR:

• Right of Access (Article 15) — Request a copy of the personal data we hold about you.
• Right to Rectification (Article 16) — Request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17) — Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Right to Restriction (Article 18) — Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability (Article 20) — Receive your data in a structured, machine-readable format. Model exports are available in JSON on request (see Section 4.4).
• Right to Object (Article 21) — Object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent — Withdraw consent for consent-based processing at any time without penalty.

7.4 International Data Transfers

Covrr is based in the United States. If you are located in the EEA or UK, your personal data will be transferred to and processed in the United States. We rely on the following transfer mechanisms to ensure adequate protection:

• Standard Contractual Clauses (SCCs) with applicable vendors where required
• The EU-U.S. Data Privacy Framework where applicable

7.5 How to Submit a GDPR Request

EEA and UK residents may submit a privacy rights request by emailing privacy@covrr.com with the subject line “GDPR Request.” We will respond within 30 days as required by the GDPR.

7.6 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data in accordance with applicable law. In the EU, you may find your local authority at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner’s Office (ico.org.uk).

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. Specifically:

• Session cookies to maintain your logged-in state
• Analytics cookies via PostHog to collect anonymized usage data (see Section 1.3)
• Preference cookies to remember your settings and configurations

We do not use cookies for cross-site advertising or behavioral tracking. You may configure your browser to reject cookies, though doing so may affect the functionality of the Service.

9. Children’s Privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected personal information from a minor, we will take prompt steps to delete that information. If you believe we have collected data from a minor, please contact us at privacy@covrr.com.

10. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction. These measures include:

• Encrypted data transmission via TLS/HTTPS
• Hashed password storage
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security reviews of our infrastructure and vendor relationships

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Notify you via email to the address associated with your account at least 30 days before the changes take effect
• Update the “Effective Date” at the top of this policy
• Post a notice within the Service

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should stop using the Service and delete your account before the effective date.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or the way we handle your personal data, please contact us:

• Email: support@covrr.app
• Website: covrr.app/privacy
• Mail: Covrr LLC, 2204 Wood Rose Dr., Medina, OH 44256

We aim to respond to all privacy-related inquiries within 5 business days.