Privacy Policy

Cova is operated by Oshylabs Ltd, a company registered in England and Wales (company number 16883720), registered office at 100 St Pier Court, 549 Green Street, London E13 9GU. We are the data controller for the information described here, and we are registered with the UK Information Commissioner's Office (ICO registration C1892619). For anything privacy related, contact us at arnold.oshenye@oshylabs.eu.

When you join the waitlist, we collect:

• Your email address.
• The gym you train at, if you choose to enter it (this field is optional).
• How you heard about us, if you choose to tell us (optional).
• A source tag from the link or QR code you used (for example whether a specific trainer or gym referred you), so we know which channel a sign-up came from.
• The date and time you signed up.

On the waitlist we do not collect payment details, and we do not use tracking cookies.

If you create an account and use the Cova app, we also collect the information you give us to run your coaching, which can include:

• Account details: your email address and, if you set one, your name or display name. If you sign in with Google, we receive the basic profile information Google shares to confirm who you are.
• Training and body data you enter: your goal (such as bulk or cut), bodyweight, training days, experience level, calorie target, and your daily check ins and logs (for example recovery, sleep, soreness, sessions, and progress).
• Coaching data: the plans and adjustments Cova generates for you, and any notes a coach you have connected adds to your plan.
• Basic technical data needed to keep you signed in securely and to keep the service running.

Some of this is information about your fitness and wellbeing. We treat it with care and use it only to run Cova for you.

On the waitlist we use your email to contact you about early access to Cova and to tell you when it launches, and we use the gym name, how you heard about us, and the source tag to understand which channels are working during this early validation phase.

In the app we use your account and training data to give you recovery aware coaching, to generate and adjust your plan, to let a coach you have connected support you, to take payment for your subscription, and to keep the service secure and working.

For the waitlist, we process your data on the basis of your consent, which you give by submitting the form. You can withdraw that consent at any time by asking us to remove you (see below).

For the app, we process your account and training data to perform our contract with you, that is to provide the service you signed up for. We rely on our legitimate interest to keep the service secure and to prevent abuse, and on consent where the law requires it. We use your data to take payment because it is necessary to provide the paid service.

On the public site and waitlist we do not use tracking or analytics cookies. When you sign in to the app, we use a small number of strictly necessary cookies to keep you securely logged in. These are required for the app to work and are not used to track you across other sites.

Your data is stored in a managed Postgres database hosted by Supabase in the European Union (Frankfurt, Germany). Access is restricted and protected by row level security, so an account can only see its own data, and a coach can only see the data of clients who have invited them.

We keep waitlist details until Cova launches and you have had the chance to take up early access, or until you ask us to remove you, whichever comes first. We keep app account and training data for as long as your account is active. If you close your account or ask us to delete it, we remove your personal data within a reasonable period, except anything we must keep for legal or accounting reasons (such as records of payments).

We do not sell your data. We share it only with the service providers that run Cova on our behalf, who act under contract and only to provide their service:

• Supabase, for database storage and authentication.
• Vercel, for hosting the website and app.
• Google, if you choose to sign in with your Google account.
• Our payment providers (for example Stripe, and the Apple App Store or Google Play for in app purchases), to process your subscription. We do not store your full card details.
• A coach you choose to connect, who can see your training data and add plan notes for as long as you keep that connection.

Under UK and EU data protection law you have the right to access your data, correct it, have it deleted, restrict or object to its use, withdraw consent, and request a copy of it. To exercise any of these, email arnold.oshenye@oshylabs.eu and we will respond within one month. You also have the right to complain to the ICO at ico.org.uk, or to your local data protection authority if you are in the EU.

Cova is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us their data, contact us and we will remove it.

If we change how we handle your data, we will update this page and the date at the top.