Privacy Policy

Section 01 - Introduction

Kove Finance (“Kove,” “we,” “us,” or “our”) is operated by Keane Financials LLC, a limited liability company incorporated in Washington State. This Privacy Policy describes how we collect, use, store, and protect your information when you use the Kove application or visit kovefinance.com. This policy applies to both the Kove web application and the kovefinance.com marketing website. By creating an account or otherwise using our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services. We will notify registered users of any material changes to this policy via email at least 14 days before they take effect.

Section 02 - Information We Collect

2.1 Kove Application (kovefinance.com/app)

• Account information: your first and last name, personal email address, and notification preferences when you sign up
• Personal information: your date of birth, state of residence, and employment or student status as provided in your profile. If you are a student, we also collect your university name and university-issued email address. Phone number is collected optionally if you choose to provide it. Date of birth is treated as sensitive personal information and is used only to operate the Services
• Financial data: bank account information, transaction history, balances, investment holdings, and liabilities retrieved through Plaid when you connect your accounts
• Uploaded documents: bank statements you manually upload for transaction parsing. These files are processed to extract transaction data and are not retained after processing is complete
• Usage data: how you interact with the app, collected through Firebase Analytics and PostHog. This includes session duration, feature usage, and general navigation patterns. Analytics tracking is configured to avoid personally identifiable financial information
• AI chatbot interactions: messages you submit to the Kove AI chatbot, the responses generated, and financial context relevant to your query (such as information from your connected accounts, transactions, budgets, and goals) that Kove automatically includes so the chatbot can generate a relevant response. To provide continuity across sessions, a brief summary of each conversation is generated and referenced in future chats; older summaries are automatically replaced as new ones are created. Full logs of your messages and the chatbot’s responses — including instances where a response was blocked by our content filtering — are retained by Kove for administrative purposes, including compliance monitoring and quality refinement, until you delete your account or request deletion. Authorized Kove personnel may access these logs for these purposes. Your chat data is not used by Anthropic to train its models

2.2 kovefinance.com Website

• Contact and waitlist data: name and email address submitted on kovefinance.com. This data is used solely to send you product updates and access notifications. It is never sold or shared with third parties
• Contact form attachments: files you attach to a contact form submission are processed transiently and forwarded via email to our support team; they are not stored in our database. Please do not send sensitive documents — such as account numbers, tax documents, or Social Security numbers — through the contact form
• Site analytics: Vercel Insights collects anonymized data including country, device type (desktop or mobile), browser, operating system, and page load performance. No IP addresses are collected or stored. This data is used solely to monitor and improve website performance

Section 03 - How We Use Your Information

• To provide, operate, and improve the Kove application
• To sync and display your connected financial accounts and transactions
• To parse uploaded bank statements and import transaction data into your account
• To generate personalized spending insights, budgets, and financial summaries
• To personalize your experience based on your profile, including state of residence, employment or student status, and institution
• To send product updates, billing communications, and service notifications
• To verify student status for institution-specific features
• To produce anonymized, aggregated financial reports, which may include state of residence and employment or student status as reporting dimensions (see Section 4)
• To operate and improve the AI chatbot feature, including compliance monitoring and quality refinement
• To detect, prevent, and investigate fraud, and to moderate content submitted to or generated by the Services
• To administer access-code-based access, including issuance, expiration, and associated data retention
• To comply with applicable laws and our obligations to third-party service providers

We process your data on the basis of your consent (provided at signup) and contractual necessity (to deliver the services you requested).

Section 04 - Aggregated and Anonymous Reporting

Keane Financials LLC produces aggregated, anonymized reports on financial health, spending trends, and related topics. These reports contain no individually identifiable information — no names, account numbers, email addresses, or any data that could be traced back to a specific user. Reports may use state of residence and employment or student status as anonymized reporting dimensions (for example, spending patterns by state, or financial trends among student versus non-student users). 4.1 Who Is Included All Kove users are included in aggregated reporting by default. You may opt out at any time by contacting support@kovefinance.com (see Section 4.5). 4.2 Report Types and Distribution

• General public reports: produced using aggregated data from all applicable users. Published publicly on kovefinance.com and accessible to all users and visitors at no cost
• Government and non-profit agency reports: produced on a contract basis. Keane Financials LLC charges for the time required to build the report, not for the underlying data. After a brief publication delay (typically one to four weeks depending on the report contract), these reports are published publicly and accessible to all
• University-specific reports: produced exclusively using data from students actively enrolled at that institution who use Kove through a university partnership program. These reports are only produced if the university provides Kove access to its students at no cost. Universities may pay for the analyst time required to build the report, for the underlying aggregated data and time, or for time only, depending on the institution’s budget constraints. University reports are shared only with the contracting institution and are not published publicly

4.3 Student Data and University Partnerships If you are a student at a university that has a partnership with Kove and provides Kove access to you at no cost, your anonymized, aggregated data may be included in institution-specific reports shared with that university. The data shared is restricted to students of that institution only. If you are a student but your university does not provide Kove to you through a partnership program, your data will never be included in any university-specific report, regardless of your enrollment status. Partner universities are contractually prohibited from attempting to re-identify individual users or re-sharing report data with third parties. 4.4 Anonymity Thresholds No report is generated for a given institution unless a minimum number of users from that institution are enrolled in Kove. The threshold is the lower of 8% of the institution’s enrolled student population or 500 users. This threshold exists to protect individual users from re-identification and scales with institution size. 4.5 Opting Out of Aggregated Reporting You may opt out of aggregated reporting at any time by emailing support@kovefinance.com with the subject line “Reporting Opt-Out.” Opt-outs are processed within 45 days of receipt. We’re a small, independently operated team, and processing requests thoughtfully takes time — we appreciate your patience. Your opt-out is prospective: data already included in published reports cannot be retroactively removed, as those reports use only aggregated, non-identifiable information. Opting out has no effect on your access to Kove or any features.

Section 05 - Plaid and Financial Data

Kove uses Plaid Technologies, Inc. to securely connect your bank and financial accounts. By connecting an account, you also agree to Plaid’s Privacy Policy (available at plaid.com/legal).

• Plaid access tokens are stored server-side only via Firebase Cloud Functions and are never exposed to the client or browser
• Financial data retrieved through Plaid is used solely to power in-app features for your benefit
• We do not sell, license, or share your financial data with any third party beyond what is necessary to operate the service
• Plaid access tokens are revoked immediately upon account or data deletion

Section 06 - Analytics and Tracking

6.1 Firebase Analytics and PostHog (Kove App) Kove uses Firebase Analytics and PostHog to understand how users interact with the application. These tools collect usage data including session duration, feature usage, page navigation, active users by country, and general device/browser information. PostHog is configured to capture page views and explicitly instrumented product events; broad autocapture and session replay are disabled by default unless Kove updates its configuration and related privacy disclosures. No personally identifiable financial information is intentionally included in analytics tracking. Firebase Analytics and PostHog may use cookies or similar technologies within the application. 6.2 Vercel Insights (kovefinance.com Website) The kovefinance.com website uses Vercel Insights to collect anonymized site performance data. Vercel Insights does not collect IP addresses. Data collected includes: visitor country, device type, browser, operating system, and page load speeds. This data is used solely to monitor and improve website performance and is not linked to your Kove account or personal identity. 6.3 Meta Pixel (kovefinance.com Website) We use the Meta Pixel on kovefinance.com to measure the performance of our own advertising campaigns and understand how visitors arrive at our site. The Meta Pixel collects information such as pages visited, general browsing behavior on our site, and device and browser information, and shares this with Meta Platforms, Inc. This data is used to measure ad performance and inform our marketing campaigns. The Meta Pixel is not used on the Kove application itself, and it does not have access to your Kove account, financial data, or in-app activity. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels within the Kove application. The Meta Pixel described above operates only on the kovefinance.com marketing website, separately from your Kove account and app activity.

Section 07 - Data Sharing

We do not sell your personal or financial data. We share data only with the following service providers as strictly necessary to operate Kove:

• Google Firebase: database, authentication, cloud functions, and hosting
• Plaid Technologies: bank account connectivity and financial data retrieval
• Stripe: payment processing. Your email address, plan and subscription details, and an internal user identifier are shared with Stripe to process payments. Stripe handles all payment card data directly — we never receive or store your card number
• PostHog: application usage analytics and product event tracking
• Vercel: website hosting and anonymized site analytics (kovefinance.com only)
• Meta Platforms, Inc.: website analytics and ad performance measurement for kovefinance.com marketing campaigns via the Meta Pixel, as described in Section 6.3. Meta does not receive data from the Kove application or your account
• Resend: transactional and notification email delivery. Your email address and relevant message content (such as your name or budget figures included in an alert) are shared with Resend to deliver account, billing, and security emails
• Anthropic PBC: your messages, generated responses, and the automatically included financial context described in Section 2.1 are processed by Anthropic’s API. Anthropic does not use this data to train its models. Data is processed in accordance with Anthropic’s Data Processing Addendum. Anthropic’s privacy policy is available at anthropic.com/privacy
• Partner universities (aggregated only): anonymized, non-identifiable reports as described in Section 4, only where a partnership agreement is in place

If you follow links from our site or application to third-party services, those services operate under their own privacy policies. We are not responsible for the data practices of third parties.

Section 08 - Data Retention and Deletion

You have full control over your data. From within the Kove application, you may choose:

• Delete Financial Data: removes all Plaid connections, access tokens, and transaction data from our live systems while preserving your login and profile
• Delete Account: removes all data associated with your account, including your profile, login credentials, financial data, AI conversation history, and any exported records we hold, from our live systems

Deletions are removed from our live systems immediately. However, we maintain encrypted backups of our database for disaster recovery purposes, and deleted data may persist within those backup snapshots for up to 28 days before being permanently purged as backups age out of retention. Backups are not used for any operational purpose during this window. Uploaded bank statement files are not retained after processing and do not need to be separately deleted. Cancellation feedback: if you submit feedback when canceling your subscription, we retain your selected reason, any comments provided, and your subscription status at the time, for internal business analysis, until you delete your account or request deletion. Waitlist and contact data is deleted upon request — email support@kovefinance.com to be removed. 8.1 Access Code Data Lifecycle If you were granted access to Kove through an access code (see our Terms of Service) and that code expires or is revoked without conversion to a paid subscription, your Plaid connections are severed 3 days after expiration or revocation, and all data other than your login credentials — including financial data, transaction history, budgets, goals, and AI conversation history — is automatically and permanently deleted no later than 14 days after expiration or revocation. This timeline applies uniformly across all access code types. This deletion timeline does not apply to standard paid subscribers. If your paid subscription lapses or your account becomes inactive, your budget data is preserved; other data retention follows the practices described elsewhere in this Section.

Section 09 - Data Portability

You have the right to request a copy of the personal data we hold about you. To submit a data export request, contact us at support@kovefinance.com. We will respond within 30 days. In-app data export functionality is available for transaction and report data.

Section 10 - Security

• All data is transmitted over HTTPS using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 via Google Firebase
• Plaid access tokens are stored server-side only and never exposed to the client
• All administrative systems are protected by phishing-resistant multi-factor authentication (passkeys)
• Firebase Security Rules restrict all database access to authenticated users only
• Kove personnel with authorized administrative access may view account, financial, and AI conversation data for support, compliance, content moderation, and fraud investigation purposes. This access is restricted at the database level and does not extend to Plaid access tokens or other authentication secrets

In the event of a confirmed data breach, we will notify affected users within 72 hours in accordance with Washington State law (RCW 19.255.010).

Section 11 - California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: request deletion of your personal information (see Section 8)
• Right to Correct: request correction of inaccurate personal information we hold about you
• Right to Opt Out of Sale or Sharing: we do not sell personal information for monetary consideration. To the extent that our university reporting arrangements could be construed as “sharing” under CCPA, you may opt out by contacting support@kovefinance.com
• Right to Limit Use of Sensitive Personal Information: we collect date of birth, which may be classified as sensitive personal information under CCPA. Date of birth is used only to operate the Services and is never included in aggregated reports or shared with third parties
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

If you are a resident of another state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Texas, Oregon, Utah, or others — you may have similar rights to know, correct, or delete your personal information. To exercise any such right, contact us at support@kovefinance.com and we will respond in accordance with applicable law. To exercise your rights, contact us at support@kovefinance.com.

Section 12 - Children's Privacy

Kove is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a user under 18, we will delete it immediately. If you believe a minor has created an account, please contact us at support@kovefinance.com.

Section 13 - Changes to This Policy

We may update this Privacy Policy as Kove evolves. We will notify registered users of material changes via email at least 14 days before they take effect. The effective date at the top of this page will always reflect the most current version. Continued use of Kove after changes take effect constitutes acceptance of the updated policy.

Section 14 - Governing Law and Dispute Resolution

This Privacy Policy is governed by the laws of the State of Washington, without regard to its conflict of law provisions.

Any dispute arising out of or relating to this Privacy Policy is subject to the binding arbitration agreement, class action waiver, and jury trial waiver set forth in Section 17 of our Terms of Service, which is incorporated into this Privacy Policy by reference. That section also describes how to opt out of arbitration within 30 days of first accepting our Terms.

Section 15 - Contact Us

If you have questions, concerns, or requests related to this Privacy Policy, please contact:

• Keane Financials LLC — Privacy
• Email: support@kovefinance.com
• Website: kovefinance.com
• State of Incorporation: Washington State, United States