Kovalink privacy notice

Last updated: 3 November 2026

Kovalink does not keep a history of the sites you visit. Encrypted page contents, passwords, and messages are never read. Your data is never sold.

What stays on your device

Your access credentials and sign-in session are kept in the Keychain. The app also keeps a random installation identifier, your settings, and a connection log on your device. The connection log stays on the device unless you share it.

What the service keeps

• Account: your email address, the sign-in methods you used (for Google, Apple or Whop, the account identifier that service gives Kovalink), and when the account was created.
• Referrals: your referral code, the account whose code you added, and the referral rewards your account earned and used. Deleting a friend's account removes its link to yours; the reward you already earned stays.
• Device sessions: each signed-in device has a session, valid for 30 days. It holds the device name, the platform (iOS or macOS), the app's random installation identifier, when the device was last seen, and the country it last connected from. The country is looked up from the IP address; the service does not store the IP address itself.
• Devices on the account: the installation identifier and device name of each device set up on the account.
• Access records: one for each invitation, subscription, Whop membership, Kova membership or Data Pack. Each holds the type, status and dates, the email address the access belongs to, the installation identifiers of the devices using it, and purchase identifiers (Apple transaction identifiers; the Whop membership identifier and access key). Access records are not deleted when access ends, and they stay after the account is deleted.
• Usage: total data (upload plus download) for each account for the current and the previous month, and for each access the time (to the minute) it last moved data.
• Data Pack: the purchase identifier (Apple or Whop), the period, data added and data used. These records are kept until 90 days after the pack's period ends.
• Crash reports: after a crash, the app sends Kovalink a report on the next launch. It holds the app and system version, device model, processor type, crash time, crash details (call stack), and the installation identifier. It holds no account, email, server or browsing data. When the store of reports reaches a fixed size, the oldest reports are deleted.
• eSIM orders (only if you order an eSIM): package, price, status, the supplier's order reference and the eSIM's ICCID. No email address and no card details.
• Support notes: an administrator can write a short note on an account for support.
• Admin log: which administrator changed which access, and when.
• Emailed sign-in codes: a code expires after 10 minutes, and the request is deleted within about an hour after that. Only a hash of the code is stored, never the code itself.

Server logs

• Network logs: every server writes a network log with the time, the destination name or address and port, and the access identifier. It does not contain your IP address. Server network logs, which can show the addresses a connection reaches, are deleted automatically within about two days.
• Error logs: server error logs can contain IP addresses. They are deleted on the same schedule, within about two days.
• System logs: system logs of the server software can contain account or access identifiers and IP addresses. They are limited by size rather than by a time period.

Visit history: staff accounts only

The service does not keep a history of the sites you visit. There is one exception, for the operator's own staff who use free invitation accounts: the administrator can turn on a history of visited sites for that staff account. It is kept for 30 days, then deleted automatically. It can never be turned on for a paid subscription; if a staff account starts paying, recording stops.

For each day, this history holds connection times and counts, data volume, and the destination domain names or IP addresses and ports. It never holds page contents, passwords or messages. Only the operator's administrators can see it.

Before 21 October 2026, the service kept a visit history with these fields for all accounts. Those older records are deleted automatically by 20 November 2026.

Who receives your data

• Resend (email delivery): your email address and the sign-in code or invitation, and the operator's own alert emails.
• Google, Apple, Whop: if you sign in with one of them, it confirms your account identifier and email address to Kovalink.
• Apple: App Store purchases are paid to Apple. The service checks subscription and Data Pack status with Apple (transaction identifiers) at activation and about every 5 minutes.
• Whop: purchases made on Whop. The service checks the membership or access key with Whop at activation and about every 5 minutes. If you sign in with Whop, the sign-in uses your Whop user identifier.
• KovaView (the operator's other service): the service asks KovaView whether an account's email address belongs to a Kova member. It does this for Kova members and for signed-in accounts that have no other access.
• Discord: the operator's alerts and a daily summary, with shortened (8-character) account or access identifiers and usage counts. No email addresses.
• eSIM Access and eSIM Go: only if you order an eSIM, the package ordered. No email address.
• Cloudflare: the app's default DNS resolvers are Cloudflare's. Lookups that travel through the tunnel reach Cloudflare from the server's address, not yours; in Global mode that is every lookup. Traffic to some AI services leaves through Cloudflare's WARP network.
• AliDNS and DNSPod: in Smart mode (the default), the names of mainland-China sites and of Apple's services are looked up at AliDNS and DNSPod, public resolvers in mainland China, directly from your device's own network, so those lookups reach them from your address. Global mode sends no lookups to them.
• Hosting companies: the servers in Toronto (Canada) and Los Angeles (United States) are rented from hosting companies. They run the machines that store the data described under "What the service keeps" and "Server logs".
• Payments: Kovalink never sees or stores payment card details; Apple or Whop handle payment.

The operator's administrators can see the data the service keeps, through an admin page that requires an emailed sign-in code. Nobody else can.

How long things are kept

• Signed-in device sessions: 30 days
• Emailed sign-in code requests: about an hour after expiry
• Server network and error logs: about 2 days
• Staff visit history: 30 days
• Visit history from before 21 October 2026: deleted by 20 November 2026
• Monthly usage totals: current and previous month
• Data Pack records: until 90 days after the pack period ends
• Access records, device records: not deleted
• Crash reports: until replaced by newer reports (fixed size)
• System logs of the server software: limited by size

What Kovalink does not collect or do

• Encrypted traffic is not decrypted: there is no TLS interception.
• No ads, and no third-party analytics or advertising SDKs in the app.
• Data is never sold.
• The app does not access your contacts, photos or advertising identifier. No precise location: only the country, looked up from the IP address.

Deleting your account and your requests

You can delete your account in the app. Deleting it removes your email address and sign-in methods from the account, signs out every device, and removes your subscription link and any eSIM installation details.

Some records stay: access records (with the email address the access belonged to, the purchase identifiers and installation identifiers), device records, usage counters (until they age out, after about two months), crash reports, eSIM order records and the admin log. Data Pack purchases are held without your email address until their period ends.

For questions or requests about your data, contact support: https://kovalink.app/support

Contact

Questions or requests: https://kovalink.app/support