Terms & Privacy

Last updated: 23 July 2026 · Effective date: 23 July 2026

Privacy Policy

The short version. Cova never sees your bank login or your email inbox. You forward the specific bank-alert emails you choose to a private address that only you know, and we read only those. We don't sell your data, we don't use it for advertising, and you can export or delete everything at any time.

Cova is a personal spending tracker built for Singapore, operated by an individual based in Singapore ("Cova", "we", "us") and contactable at [email protected]. This policy explains what personal data we collect, why, who we share it with, and your rights under Singapore's Personal Data Protection Act 2012 (PDPA).

1. What we collect, and why

Your account — your email address, your password (stored only as a secure hash, never in plain text), and any app passcode you set.
Your transactions — the date, amount, currency, merchant, category, account/wallet and notes for spending you add yourself or that we capture for you.
Bank-alert emails you forward — when you forward a bank alert to your unique Cova address, we read its contents to create the matching transaction. We keep the email's subject line (up to about 200 characters) in your in-app capture log so you can see what was processed. If an email fails to parse, we also keep its body so you can add the transaction by hand and so we can improve our reading of that bank's format. Bodies of emails that parse successfully are not retained.
Voice, receipt and typed entries — audio, images or text you submit so we can turn them into a transaction.
Waitlist — if you join the waitlist, your email address.
Payments — card payments are handled by our payment processor, Stripe; we never see or store your full card number.
Basic technical data — minimal setup/usage events (for example, where onboarding stalls) and standard security logs, used to keep the service working.

What we never collect: your internet-banking username or password, and access to your email inbox. Cova only ever receives the individual emails you choose to forward.

2. How we use your data

To run Cova: to capture, categorise and display your spending, to support you when you ask, and to improve how accurately we read bank alerts. We do not use your financial data for advertising, and we do not sell or rent it to anyone.

3. AI processing

To read the emails you forward and the text or voice you enter, we send that content to our AI provider, Anthropic, for the sole purpose of extracting the transaction details (date, merchant, amount, currency, direction). This content is used only to return that result to you and is not used to train AI models. Because automated reading can make mistakes, anything captured by AI is flagged for your review rather than trusted silently.

4. Who we share it with (our processors)

We use a small number of trusted providers who process data only to deliver their part of the service, never for their own purposes:

Supabase — secure database hosting for your account and transactions.
Cloudflare — routing the emails you forward, and hosting this website.
Anthropic — reading forwarded emails and voice/typed entries into transactions.
Stripe — processing subscription payments.

We never sell your data, and we don't share it with banks, insurers, advertisers or data brokers.

5. Where your data is stored

Your data is hosted on Supabase infrastructure in the Asia-Pacific (Mumbai) region, protected in transit and at rest as described under "Security" below.

6. How long we keep it

We keep your data for as long as your account is active. If you delete your account, or ask us to at [email protected], we remove your personal data within 30 days — except where we're required by law to keep certain records (for example, payment and tax records).

7. Security

Your data is encrypted in transit. Access is protected by row-level security so that you can only ever reach your own records, and you can add an app passcode. No online service can promise perfect security — but because Cova never holds your bank credentials or a way into your inbox, the amount of sensitive information exposed by any incident is far smaller than with tools that log into your bank for you.

8. Your rights under the PDPA

You may ask to access or correct the personal data we hold about you, withdraw your consent, and request deletion. You can export your own data from inside the app at any time (CSV, Excel or PDF). To make a request, or to reach the person responsible for data protection at Cova, email [email protected].

9. Children

Cova is not intended for anyone under 18, and we don't knowingly collect data from minors.

10. Changes to this policy

If we change this policy we'll post the new version here and update the "Last updated" date. Significant changes will be communicated in the app or by email.

Terms of Service

These terms are the agreement between you and Cova for use of the app and website. By creating an account or using Cova, you agree to them.

1. Who can use Cova

You must be at least 18 years old and able to enter into a binding agreement. Cova is designed for people managing personal finances in Singapore.

2. What Cova is — and isn't

Cova is a tool to record and categorise your own spending. Cova is not a bank, does not move or hold your money, and is not a financial adviser. Nothing in the app is financial, investment, tax or legal advice, and you remain responsible for your own financial decisions.

3. Accuracy — please verify

Cova captures transactions automatically from the emails you forward and sometimes reads them using AI. This can make mistakes: a transaction may be missed, duplicated, or read with the wrong amount, date or category. Always check important figures against your bank's own records and don't rely on Cova as your only financial record. Where we're unsure, we flag an entry for your review.

4. Your account

Keep your password and passcode secure. You're responsible for activity that happens under your account. Tell us promptly at [email protected] if you think someone else has accessed it.

5. Acceptable use

Forward only emails from your own accounts, and use Cova only for lawful, personal purposes. Don't attempt to disrupt, attack, reverse-engineer or gain unauthorised access to the service or to other users' data.

6. Subscription and billing

Cova is a paid subscription: S$45 per year or S$5 per month, with a 14-day free trial.
Unless you cancel during the trial, your subscription begins and the plan you chose is charged when the trial ends.
Subscriptions renew automatically for the same period until you cancel. You can cancel any time, and you'll keep access until the end of the period you've paid for.
We don't generally refund a period already paid for, except where the law requires it.
Prices may change; we'll give you notice before a change affects you.
Payments are handled securely by Stripe.

7. Your data and cancellation

Your data is yours. You can export it at any time, and cancelling stops future billing. Deleting your account removes your data as described in the Privacy Policy above.

8. Availability

We work to keep Cova running reliably, but the service is provided "as is" and we can't guarantee it will always be available or error-free.

9. Limitation of liability

To the fullest extent permitted by law, Cova is not liable for indirect or consequential losses, or for financial decisions you make based on information in the app.

10. Governing law

These terms are governed by the laws of Singapore, and the courts of Singapore have jurisdiction over any dispute.

11. Contact

Questions about these terms or your account: [email protected].