Privacy policy

CovaLea is operated by Nested Dot Designs, LLC, a Colorado limited liability company ("CovaLea", "we", "us"). This page explains what the CovaLea mobile app and the covalea.com website collect, how we use it, who we share it with, and the choices you have.

What CovaLea is

CovaLea is a real‑time conversation coaching tool for parents and caregivers. It records audio from your device's microphone, turns it into text, and uses AI to suggest coaching responses in the moment and to summarize sessions.

Information we collect

CovaLea is local‑first: most of your content is created and kept on your device, and synced to our servers when you sign in and enable sync.

• Account, your email address, a securely hashed password, and — if you use Google Sign‑In — your Google account identifier and email.
• Audio, short audio captured while a session is running. See "How we handle audio" — we do not keep it.
• Transcripts, text produced from your audio, including timestamps, speaker labels, and edits you make.
• Coaching & Ask AI content, the transcript context you send for coaching, the AI's responses, and questions and answers you save.
• Memories & follow‑ups, notes, reminders, and facts you save, including reminders you schedule to your device calendar.
• Family context, the people you add (such as your children's names, ages, and notes) to personalize coaching. This can include information about your children.
• Speaker voice profiles, numeric "voice fingerprints" used to recognize who is speaking across sessions. These are numbers, not stored audio.
• Reports, summaries you generate for people you choose to share with, and a record of when they were sent, viewed, or annotated.
• Consent records, your typed signature, the date, the affirmations you agreed to, and the IP address and device/browser information at signing.
• Waitlist, if you join on covalea.com: your email address and any preferences you provide.
• Diagnostics & usage, AI usage counts and, on some devices, basic performance/device information, plus operational server logs.

How we handle audio

We treat audio as disposable input, not part of your record. When a session needs server transcription, audio is uploaded to our cloud storage, processed, and then deleted — typically within minutes, and in all cases within 7 days. There is no setting that makes us keep your audio longer. Summaries and reports never include raw audio or word‑for‑word transcripts.

Where your information is stored

When you sync, your information is stored on Microsoft Azure infrastructure in the United States: audio in Azure Blob Storage (kept only transiently, as above) and other data in a private Azure database. Information is encrypted in transit and secrets are held in a managed key vault. If you use the app without an account, your content stays on your device.

Third parties we use

To provide AI and delivery features we send certain data to the providers below. We may add, remove, or change providers as the product evolves; this list is kept current.

• Microsoft Azure OpenAI, generates coaching responses and the embeddings used for memory and search; receives the transcript and family context you submit. See privacy.microsoft.com.
• Microsoft Azure AI Speech and our own Azure‑hosted transcriber, convert session audio into text. Our own transcriber runs inside our Azure environment; audio for it is not sent to an outside company.
• Google, powers Google Sign‑In (if used) and on‑device speech recognition through your device's operating system. See policies.google.com/privacy.
• Resend, delivers our emails, including password resets and reports you send to recipients.
• Expo, delivers push notifications to your device.
• Hugging Face, hosts the open‑source speech models we download to run on our own servers; receives download requests, not your data.
• Buttondown, manages waitlist sign‑ups on covalea.com.

Each provider processes data under its own terms. We do not sell your personal information, and we do not use it for advertising.

How we share information

• People you link, if you connect another caregiver's account, you can grant them access to specific things — sessions and transcripts, memories, saved voice profiles, family context, Ask AI history, and follow‑ups. You choose what to share, and sharing stays within your linked family.
• Report recipients, you can send summaries to people you choose (for example a therapist or teacher) by email and a private link. A report contains synthesized summaries and names — not raw audio or verbatim transcripts — and, only if you opt in, a note about the parent's frame of mind. Recipients can view past reports, add notes, and send documents back to you.
• Legal reasons, we may disclose information if required by law or to protect rights and safety.

We do not sell your personal information.

How long we keep it

• Audio: deleted within minutes of processing, never kept beyond 7 days.
• Report PDFs: removed from storage shortly after delivery (about a day).
• Everything else (transcripts, memories, profiles, reports, settings): until you delete the item or your account. Backups are retained for a limited period, then rotated out.

Your rights

• Access & export, request a copy of your account data in the app, or email hello@nesteddotdesigns.com.
• Correct, edit transcripts, speaker labels, memories, and family context directly in the app.
• Delete, in the app, Settings → Account → Delete my account and all data. This permanently removes your server data, including consent records.
• Withdraw consent, deleting your account also withdraws the parental consent recorded against it.

Children

CovaLea is made for parents, guardians, and caregivers — not for children to use themselves. Because the audio you record may include your children's voices, and because you may save information about your children, U.S. law (COPPA) requires a parent or legal guardian to review and sign a consent form before recording. You are responsible for confirming you have the legal authority to record and process the voices you capture, and you can delete your children's information at any time.

Security

Passwords are stored only as salted hashes, secrets are held in a managed key vault, databases run on a private network, and data is encrypted in transit. No system is perfectly secure, but we work to protect your information.

Contact

hello@nesteddotdesigns.com

CovaLea is a project of Nested Dot Designs.