Kova is intended for people aged 16 or older.
1. Controller and scope
Kova SpA, Chile, is the controller for the processing described here. This policy covers Kova and kovapp.org. Contact: odonoso@kovapp.org.
2. Local data, SwiftData and device backups
Journal entries, mood, assessments, plans and preferences are stored locally using SwiftData and system storage. Kova SpA does not receive that content. It may be included in a device or iCloud backup if the person enables Apple backup features; those copies are controlled by Apple and the person, not Kova SpA. Local data remains until it is deleted in the app or Kova is uninstalled.
3. Supabase, stories and optional presence
Supabase hosts editorial stories from people who authorized publication. For the aggregate live counter, Kova may send a random installation identifier about every 75 seconds while the app is open, but only when the person voluntarily enables this option. It is off by default, can be withdrawn in Settings, and the presence row is deleted on withdrawal or after no more than 24 hours without activity. It is not used for advertising or cross-app tracking.
4. Use of artificial intelligence
Kova may use artificial intelligence to create a general wellbeing reflection. The app sends only the language code to a secure proxy operated on Supabase; it does not send journal entries, mood, assessments, location or the presence identifier. The proxy retains a salted network-address hash for up to 25 hours to limit abuse and keeps the provider credential outside the app. If the service is unavailable, reviewed local content is shown. AI does not diagnose, treat or provide emergency support.
Story videos in privacy-enhanced mode
When a story video is opened, Kova uses YouTube privacy-enhanced mode through youtube-nocookie.com. YouTube may receive the IP address, device information and playback data under its own terms and privacy policy. Kova SpA does not use that data for advertising or create a viewer profile.
5. Subscriptions
Apple handles purchases, renewals, cancellations and refunds through StoreKit. Kova SpA does not receive full payment details. Subscription status is cached on the device.
6. Purposes and legal grounds
Processing supports requested features, consented stories, an aggregate activity count and subscription access. Specific, informed and revocable consent will be requested where required, particularly for sensitive data.
7. Rights and choices
Request access, correction, deletion, objection, blocking or portability for data controlled by Kova SpA at odonoso@kovapp.org. Optional processing may be refused and consent withdrawn without losing unrelated local tools.
8. Retention, security and providers
Presence identifiers are retained only as needed to produce the counter; stories remain while authorization and a lawful purpose exist. Kova SpA requires Apple, Supabase and every external artificial-intelligence or infrastructure provider to apply equivalent protection, restricted access and appropriate technical and organizational safeguards. No system is absolutely secure.
9. Sale, advertising and transfers
Kova SpA does not sell personal data or share mental-health information with advertisers. When a provider processes information outside Chile, Kova SpA requires contractual terms, security measures and a protection level compatible with applicable law; the transfer or provider is suspended if those safeguards cease to be sufficient.
10. Age and changes
Kova is for people aged 16 or older. Material changes will be announced and this policy updated before new analytics, advertising or processing is enabled.
Data protection in Chile
Kova SpA processes data under Chilean Law 19.628 currently in force and has adopted advance readiness measures for Law 21.719, which takes effect on December 1, 2026. We apply lawfulness, transparency, purpose limitation, proportionality, quality, accountability and security; data is limited to what is necessary and deleted or anonymized when its purpose ends. Access, correction, deletion, objection, blocking and portability may be requested free of charge where applicable through a simple identity-verification process at odonoso@kovapp.org. Kova does not subject people to solely automated decisions with legal or similarly significant effects. Incidents are documented and notified to the authority and affected people when required by law. Sensitive data requires express consent or another lawful basis; Kova is for people aged 16 or older.