Privacy · Current beta
Your data in Cove.
Cove keeps a local mailbox on your Mac and connects to the services you enable.
Mail and credentials on your Mac
Real-account mail is stored in an encrypted local database. Credentials and mailbox encryption keys are stored in macOS Keychain. Cloud sync is off by default. If you enable the private cloud pilot, a limited recent-mail copy is sent to Cove’s servers as described below.
Optional cloud sync · private pilot
Approved pilot accounts can explicitly enable cloud sync in Settings. One Mac uploads up to 1,000 downloaded emails from the last 30 days, including sender and recipient headers, subject, message bodies, Gmail labels and Jev results. Large message bodies are shortened. Attachments, unsent drafts, Spam, Trash, Google refresh tokens and writing-provider credentials are excluded. Sync runs while Cove is open. This release does not provide a mobile app or server-side Gmail retrieval while your Mac is closed.
When cloud sync is enabled, snooze times and cancellations are also sent to Cove. Reminder records contain your account identity, Gmail message and thread IDs, the reminder date and sync revisions. They are stored as queryable metadata in PlanetScale so a future notification service can find due reminders. They are separate from the recent-mail mirror: reminders for older emails can sync without uploading those emails’ contents. Pending changes stay in the encrypted local database until synced. Mobile push notifications are not available yet.
The API runs on Google Cloud Run. Cove stores message IDs, dates, labels, encrypted headers and encrypted Jev results in PlanetScale Postgres, and encrypted recent bodies in private Google Cloud Storage. Account encryption keys are protected by Google Cloud KMS. This is server-readable encryption, not end-to-end encryption. Google ID tokens authenticate requests; the backend verifies them and does not store them. Cloud infrastructure processes connection information such as IP addresses.
While sync is active, the mirror follows the Mac’s recent downloaded-mail selection. Bodies become unavailable 30 days after the email’s date; encrypted objects are cleaned up by a 30-day object lifecycle. Pausing sync keeps existing cloud headers, labels, results and reminders. Reminder records, including cancellations and past dates, remain until you remove the cloud copy; the pilot stores up to 5,000 reminder records. “Remove cloud copy” stops sync and removes live database records and their account key. Remaining encrypted objects expire by lifecycle; database backups follow PlanetScale’s backup retention. Removing local data or disconnecting Gmail does not remove the cloud copy. Remove the cloud copy first when you want both removed.
About you sync between your devices
About you (your name, role, company, projects, notes and sign-off, in your own words) can sync between Cove on your Mac, iPhone and iPad. It is off by default; turn it on in each device’s About you. It does not need, or turn on, the recent-mail cloud sync above, and no email content is sent. The text is encrypted with its own key, protected by Google Cloud KMS, and stored in PlanetScale with your Google account identity, a revision and the time of the last edit. This is server-readable encryption, not end-to-end encryption. “Remove the copy on Cove’s server” deletes it from the database and turns sync off on that device; your devices keep their own copies, and database backups follow PlanetScale’s backup retention.
Cove connects to Google to read and manage your Gmail, and to access Calendar when you enable it. Actions you take in Cove, such as sending, archiving, moving a message to Trash, or responding to an invitation, are sent to Google.
Your organization’s Google client
Google Workspace organizations can register Cove in their own Google Cloud project as an internal app and add a work account with that Client ID and secret. Sign-in then uses the organization’s client: the organization controls and can revoke access, and Cove’s Google project isn’t involved. The client is stored with that account’s sign-in in macOS Keychain.
Jev and your writing provider
When you enable Jev organization, Cove sends email content and enabled preferences to TypeSafe for processing. Custom agents send your classification instructions, matching email content and, when enabled, readable attachment text to TypeSafe. Tests send only the selected example or email and do not change Gmail. Active agents can apply the Gmail labels you configure during sync while Cove is open. Uncertain decisions stay in the agent’s Activity on your Mac without adding a Gmail label. When an enabled rule requests a reply, Cove also sends that rule’s reply instructions, your writing preferences, the triggering email and readable attachment text to your writing provider. Reply suggestions remain on this Mac until you review and send them yourself. For AI writing and answers you request, Cove sends your instructions, draft, and relevant email or calendar context to your selected provider. When you ask about an email that has PDF or text attachments, the readable text of up to five of them is included. These services have their own data policies and usage limits. AI processing is not entirely on your Mac. Optional ChatGPT and Claude subscription connections run the official Codex or Claude Code CLI installed on your Mac. Those tools handle their own sign-in and send your requested context to the respective provider; Cove does not copy their subscription tokens. Your provider’s plan limits and data policies apply.
Choose and manage these connections in Cove’s Settings and Integrations. Review generated content before applying or sending it.
Images and weather
Loading external email images contacts the image hosts and can reveal that a message was opened. Cove provides reading controls for external images. Optional weather uses your location with macOS permission, or a city you choose. Forecast requests send rounded coordinates to MET Norway.
App updates
Cove checks for signed updates daily while running. You can turn automatic checks off in Settings or check manually from the Cove menu. Update checks and downloads contact covemail.xyz through Cloudflare, which receives your IP address and request information such as the app version. Mail content, account credentials, and system profiling data are not sent with update checks. Cove asks before installing and restarting.
Removing local data
Disconnecting an account keeps its local cache. Use “Remove local data and disconnect” in Settings to erase its local data. You can also revoke Cove’s Google access from your Google account. Removing local data does not delete mail from Gmail.
This website
This site and its downloads are hosted by Cloudflare. Requests pass through Cloudflare’s infrastructure, which processes connection information such as your IP address. This site does not include advertising scripts, analytics scripts, or a mailing-list form.
Questions
Contact [email protected] with questions about Cove or your data.