Privacy Policy

Section 01 - Introduction

Kove Finance (“Kove,” “we,” “us,” or “our”) is operated by Keane Financials LLC, a limited liability company incorporated in Washington State. This Privacy Policy describes how we collect, use, share, store, and protect your information when you use Kove. This policy covers: the Kove application on the web (kovefinance.app); the Kove mobile app; Kove’s AI features; the optional connector that lets outside AI apps access your Kove data (see Section 07); and the kovefinance.com marketing website. By creating an account or otherwise using our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services. We will notify registered users of any material changes to this policy via email at least 14 days before they take effect.

Section 02 - Information We Collect

2.1 Kove Application (web and mobile)

• Account information: your first and last name, personal email address, and notification preferences when you sign up
• Personal information: your date of birth, state of residence, and employment or student status as provided in your profile. If you are a student, we also collect your university name and university-issued email address. Phone number is collected optionally if you choose to provide it. Date of birth is treated as sensitive personal information and is used only to operate the Services
• Financial data: bank account information, transaction history, balances, investment holdings, and liabilities retrieved through Plaid when you connect your accounts, plus any accounts, transactions, budgets, goals, and plans you enter or change yourself
• Uploaded documents: bank statements you manually upload for transaction parsing. These files are processed to extract transaction data and are not retained after processing is complete
• Security and sign-in data: one-time verification codes sent to your email or phone, the phone number you use for SMS verification if you choose it, and trusted-device records (a random device token and its expiry date) so you are not asked to verify on every sign-in
• Mobile device data: if you allow notifications, a push notification token for your device and your notification preferences. If you turn on the app lock, Face ID, Touch ID, or your device passcode is checked by your device itself; Kove never receives your biometric data, and the app lock setting is stored only on your device
• Usage data: how you use the app, including pages and screens viewed and features used, collected through PostHog and linked to your Kove account ID (see Section 06)
• Diagnostic data: error reports, crash reports, and performance measurements collected through Sentry (see Section 06)
• Usage and cost records: counts of the requests your account makes, the database operations they cause, and AI usage, by feature (see Section 06)
• AI data: messages you send to Kove’s AI features, the responses, summaries of past conversations, and changes you ask Kove AI to make (see Section 07)
• External app data: if you connect an outside AI app to Kove, a record of that connection and a log of every change the app makes to your data (see Section 07)
• Support requests: messages you send through the in-app Contact Us form and any files you attach. These are stored with your support request until you delete your account. Please do not send sensitive documents (such as account numbers, tax documents, or Social Security numbers)
• Cancellation feedback: if you give a reason when canceling your subscription, that reason, any comments, and your subscription status at the time

2.2 kovefinance.com Website

• Contact and waitlist data: name and email address submitted on kovefinance.com. This data is used solely to send you product updates and access notifications. It is never sold
• Contact form attachments: files you attach to a contact form on kovefinance.com are processed transiently and forwarded via email to our support team; they are not stored in our database
• Site analytics: Vercel Insights collects anonymized data including country, device type (desktop or mobile), browser, operating system, and page load performance. No IP addresses are collected or stored. This data is used solely to monitor and improve website performance
• Advertising measurement: the Meta Pixel collects pages visited on kovefinance.com and device and browser information (see Section 06.5)

Section 03 - How We Use Your Information

• To provide, operate, and improve the Kove application
• To sync and display your connected financial accounts and transactions
• To parse uploaded bank statements and import transaction data into your account
• To generate personalized spending insights, budgets, and financial summaries
• To personalize your experience based on your profile, including state of residence, employment or student status, and institution
• To send product updates, billing communications, service notifications, and push notifications you have allowed
• To verify student status for institution-specific features
• To verify your identity at sign-in and before sensitive actions, and to keep your account secure
• To produce anonymized, aggregated financial reports, which may include state of residence and employment or student status as reporting dimensions (see Section 4)
• To operate and improve Kove’s AI features, including compliance monitoring and quality refinement
• To operate the external app connector at your direction and keep a record of the changes connected apps make
• To find and fix errors and performance problems
• To understand what each feature costs to run, so we can price plans and set usage limits
• To detect, prevent, and investigate fraud and misuse, and to moderate content submitted to or generated by the Services
• To administer access-code-based access, including issuance, expiration, and associated data retention
• To respond to support requests
• To comply with applicable laws and our obligations to third-party service providers

We process your data on the basis of your consent (provided at signup) and contractual necessity (to deliver the services you requested).

Section 04 - Aggregated and Anonymous Reporting

Keane Financials LLC produces aggregated, anonymized reports on financial health, spending trends, and related topics. These reports contain no individually identifiable information: no names, account numbers, email addresses, or any data that could be traced back to a specific user. Reports may use state of residence and employment or student status as anonymized reporting dimensions (for example, spending patterns by state, or financial trends among student versus non-student users). 4.1 Who Is Included All Kove users are included in aggregated reporting by default. You may opt out at any time by contacting support@kovefinance.com (see Section 4.5). 4.2 Report Types and Distribution

• General public reports: produced using aggregated data from all applicable users. Published publicly on kovefinance.com and accessible to all users and visitors at no cost
• Government and non-profit agency reports: produced on a contract basis. Keane Financials LLC charges for the time required to build the report, not for the underlying data. After a brief publication delay (typically one to four weeks depending on the report contract), these reports are published publicly and accessible to all
• University-specific reports: produced exclusively using data from students actively enrolled at that institution who use Kove through a university partnership program. These reports are only produced if the university provides Kove access to its students at no cost. Universities may pay for the analyst time required to build the report, for the underlying aggregated data and time, or for time only, depending on the institution’s budget constraints. University reports are shared only with the contracting institution and are not published publicly

4.3 Student Data and University Partnerships If you are a student at a university that has a partnership with Kove and provides Kove access to you at no cost, your anonymized, aggregated data may be included in institution-specific reports shared with that university. The data shared is restricted to students of that institution only. If you are a student but your university does not provide Kove to you through a partnership program, your data will never be included in any university-specific report, regardless of your enrollment status. Partner universities are contractually prohibited from attempting to re-identify individual users or re-sharing report data with third parties. 4.4 Anonymity Thresholds No report is generated for a given institution unless a minimum number of users from that institution are enrolled in Kove. The threshold is the lower of 8% of the institution’s enrolled student population or 500 users. This threshold exists to protect individual users from re-identification and scales with institution size. 4.5 Opting Out of Aggregated Reporting You may opt out of aggregated reporting at any time by emailing support@kovefinance.com with the subject line “Reporting Opt-Out.” Opt-outs are processed within 45 days of receipt. We’re a small, independently operated team, and processing requests thoughtfully takes time. We appreciate your patience. Your opt-out is prospective: data already included in published reports cannot be retroactively removed, as those reports use only aggregated, non-identifiable information. Opting out has no effect on your access to Kove or any features.

Section 05 - Plaid and Financial Data

Kove uses Plaid Technologies, Inc. to securely connect your bank and financial accounts. By connecting an account, you also agree to Plaid’s Privacy Policy (available at plaid.com/legal).

• Plaid access tokens are stored server-side only via Firebase Cloud Functions and are never exposed to the client, the browser, or any connected outside app
• Financial data retrieved through Plaid is used solely to power in-app features for your benefit, and to send to an outside AI app only if you connect one (see Section 07)
• We do not sell or license your financial data, and we share it with third parties only as described in this policy
• Plaid access tokens are revoked immediately upon account or data deletion

Section 06 - Analytics, Diagnostics, and Tracking

6.1 Product Analytics (PostHog) Kove uses PostHog in the web and mobile app to understand how the product is used: pages and screens viewed, features used, session length, and general device, browser, and country information. PostHog events are linked to your Kove account ID, a random identifier, along with a few coarse account properties (such as whether you are a student). PostHog does not receive your name, email address, or financial data. Session replay and broad automatic click capture are turned off. Product analytics are on by default, and you can turn them off at any time in Settings. That setting stops PostHog analytics; it does not affect the diagnostic, security, and cost records described below, which Kove needs to run the service. Kove also uses Firebase Analytics on the web to record a small number of events about connecting a bank through Plaid (for example, whether a connection finished or failed). 6.2 Diagnostics (Sentry) Kove uses Sentry to receive error reports, crash reports, and performance measurements from the web and mobile app, so we can find and fix problems. Reports are configured to exclude default personal information, and are scrubbed of sensitive values before they are sent. 6.3 Usage and Cost Records For every request your account makes, Kove records counts of the database operations it causes and any AI usage, grouped by feature, platform, and (for outside AI apps) the app’s name. These records are kept per account per month so we can see what each feature costs to run, set fair usage limits, and price our plans. They contain counts only, not the content of your data. They are kept until you delete your account. Daily totals across all users, which contain no account identifiers, are kept longer. 6.4 Vercel Insights (kovefinance.com Website) The kovefinance.com website uses Vercel Insights to collect anonymized site performance data. Vercel Insights does not collect IP addresses. Data collected includes: visitor country, device type, browser, operating system, and page load speeds. This data is used solely to monitor and improve website performance and is not linked to your Kove account or personal identity. 6.5 Meta Pixel (kovefinance.com Website Only) We use the Meta Pixel on the kovefinance.com marketing website to measure the performance of our own advertising and understand how visitors arrive at the site. When you visit kovefinance.com, the Meta Pixel sends Meta Platforms, Inc. the pages you visit on that site and information about your device and browser. Meta is the only company that receives this website data for advertising purposes. The Meta Pixel does not run in the Kove app (kovefinance.app or the mobile app). Meta never receives your Kove account information, financial data, or anything you do inside the app. You can limit the Meta Pixel by blocking third-party cookies in your browser or adjusting your ad settings with Meta. 6.6 Abuse Protection Kove may use Firebase App Check, which on the web uses Google reCAPTCHA, to confirm that requests come from the genuine Kove app. reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.

Section 07 - AI Features and External AI Apps

7.1 Kove AI Kove AI (the chatbot and AI tools such as the budget builder) runs on Anthropic’s Claude models by default. When you use it, Kove sends Anthropic your message and the financial context relevant to it, such as information from your accounts, transactions, budgets, and goals. To provide continuity, a brief summary of each conversation is generated and referenced in future chats; older summaries are automatically replaced as new ones are created. Anthropic does not use this data to train its models. Kove AI can suggest changes to your data, such as a budget update. A suggested change is only made if you confirm it, and Kove keeps a record of changes you apply this way. Full logs of your messages and Kove AI’s responses (including responses blocked by our content filtering) are retained for compliance monitoring and quality refinement until you delete your account or request deletion. Authorized Kove personnel may access these logs for these purposes. 7.2 Using Your Own AI Provider Key If you choose to connect your own API key from a supported AI provider (currently Anthropic, OpenAI, or DeepSeek), your Kove AI messages and the financial context sent with them go to that provider under your own account and its terms, not Kove’s. Whether that provider stores your data or uses it for training depends on its terms and your settings with it. DeepSeek may process data outside the United States, including in China. Kove stores your key encrypted and uses it only to send your requests. 7.3 External AI Apps (MCP) Kove offers an optional connector, based on the Model Context Protocol (MCP), that lets an outside AI app access your Kove data at your direction. The apps currently supported are Claude (Anthropic) and ChatGPT (OpenAI). Nothing is shared with any outside app unless you do all of the following: turn on external app access in Settings, verify your identity, and approve a specific app on a Kove consent screen that lists what it will be able to do.

• What a connected app can read: your accounts and balances, transactions, budgets, savings goals, investments, net worth, retirement plan, recurring charges, spending analysis, and debt payoff projections. Connected apps never receive your password, verification codes, or Plaid access tokens
• What a connected app can change, if you grant change access: your monthly and long-term budgets (including custom categories), savings goals and contributions, transaction categories and review status, credit card limits, APRs, and minimum payments, recurring charges Kove has detected, and your retirement plan assumptions. It cannot move money, connect or disconnect a bank, or change your account or billing settings. It makes changes without asking you each time
• Change log: Kove records every change a connected app makes, including the values before and after the change. You can review these changes in Settings, and authorized Kove personnel can view them for support and security. The log is kept until you delete your account, including after you disconnect the app
• Who receives your data: data a connected app reads is sent to the company that operates it (Anthropic for Claude, OpenAI for ChatGPT) and is handled under your agreement with that company. Kove does not control how that company stores or uses it
• Reports to Kove: if you agree when a connected app offers, the app can send Kove’s team a description of something you asked for that Kove could not do. This is stored as a support request and emailed to our team
• Disconnecting: you can disconnect an app, or turn off external app access entirely, at any time in Settings, and access stops immediately. Disconnecting cannot retrieve or delete data the app already received; to remove that data, use the outside company’s own controls
• Suspension: Kove may suspend external app access for an account in cases of misuse, as described in our Terms of Service

Section 08 - Data Sharing

We do not sell your personal or financial data. We share data only with the following service providers as necessary to operate Kove, and with others only as described below:

• Google (Firebase and Google Cloud): hosting, sign-in (including sending SMS verification codes), database, cloud functions, file storage for support attachments, push notification delivery (Firebase Cloud Messaging), Firebase Analytics, and App Check with reCAPTCHA
• Apple: delivery of push notifications to iOS devices
• Plaid Technologies: bank account connectivity and financial data retrieval
• Stripe: payment processing. Your email address, plan and subscription details, and an internal user identifier are shared with Stripe to process payments. Stripe handles all payment card data directly. We never receive or store your card number
• PostHog: product analytics, linked to your Kove account ID as described in Section 6.1
• Sentry (Functional Software, Inc.): error, crash, and performance reports as described in Section 6.2
• Resend: transactional and notification email delivery. Your email address and relevant message content (such as your name or budget figures included in an alert) are shared with Resend to deliver account, billing, and security emails
• Anthropic PBC: Kove AI messages, responses, and the financial context described in Section 7.1. Anthropic does not use this data to train its models. Data is processed in accordance with Anthropic’s Data Processing Addendum. Anthropic’s privacy policy is available at anthropic.com/privacy
• AI providers you choose: if you use your own API key (Section 7.2) or connect an outside AI app (Section 7.3), the data described there goes to that provider under its own terms
• Vercel: website hosting and anonymized site analytics (kovefinance.com only)
• Meta Platforms, Inc.: kovefinance.com website activity through the Meta Pixel, as described in Section 6.5. Meta does not receive data from the Kove app or your account
• Partner universities (aggregated only): anonymized, non-identifiable reports as described in Section 4, only where a partnership agreement is in place

We may also disclose information if required by law or legal process, to protect the rights, property, or safety of Kove, our users, or others, or as part of a merger, acquisition, or sale of our business, in which case this policy would continue to apply to your information. Kove is operated in the United States, and your information is stored and processed in the United States, except where a provider you choose processes it elsewhere (Section 7.2). If you follow links from our site or application to third-party services, those services operate under their own privacy policies. We are not responsible for the data practices of third parties.

Section 09 - Data Retention and Deletion

You have full control over your data. From within the Kove application, you may choose:

• Delete Financial Data: revokes your Plaid connections and removes your financial and app data from our live systems, including accounts, transactions, budgets, goals, AI conversation history and settings, and outside app connections and their change logs. Your login, profile, subscription, and security settings are preserved
• Delete Account: cancels any active subscription, revokes your Plaid connections, and removes all data associated with your account from our live systems. This includes your profile, login credentials, financial data, AI conversation history, outside app connections and their change logs, support requests and attachments, cancellation feedback, and usage and cost records

9.1 Automatic retention limits while your account is active:

• Transactions older than 24 months are automatically deleted every month
• Uploaded bank statement files are not retained after processing and do not need to be separately deleted
• Everything else described in Section 02 is kept until you delete it, delete your account, or it is replaced (for example, older AI conversation summaries), except as described in Sections 9.3 and 9.4
• Waitlist and kovefinance.com contact data is deleted upon request: email support@kovefinance.com to be removed

9.2 After Deletion Deletions are removed from our live systems immediately. However, we maintain encrypted backups of our database for disaster recovery purposes, and deleted data may persist within those backup snapshots for up to 28 days before being permanently purged as backups age out of retention. Backups are not used for any operational purpose during this window. What we keep after you delete your account: a record that your account was deleted (your account ID and the date only), and our security log of actions Kove personnel took on your account, which references your account ID. Aggregated reports already published (Section 4) and daily usage totals that contain no account identifiers are not affected. What we cannot delete: data already sent to third parties under their own retention policies, including Plaid, Stripe (which keeps payment records as the law requires), Resend, PostHog, Sentry, Meta, your own AI provider (Section 7.2), and any outside AI app you connected (Section 7.3). 9.3 Access Code Data Lifecycle If you were granted access to Kove through an access code (see our Terms of Service) and that code expires or is revoked without conversion to a paid subscription, your Plaid connections are severed 3 days after expiration or revocation, and all data other than your login credentials (including financial data, transaction history, budgets, goals, and AI conversation history) is automatically and permanently deleted no later than 14 days after expiration or revocation. This timeline applies uniformly across all access code types. 9.4 Student Verification Lapses If your access comes from being a verified student and your verification lapses with no other paid or code-based access, your Plaid connections are disconnected and your Plaid-connected financial data is deleted 14 days after your access ends, unless you re-verify first. Data you entered yourself or imported from statements is kept, and you can keep using Kove’s free features. These deletion timelines do not apply to standard paid subscribers. If your paid subscription lapses or your account becomes inactive, your data is preserved until you delete it or delete your account.

Section 10 - Data Portability

You have the right to request a copy of the personal data we hold about you. To submit a data export request, contact us at support@kovefinance.com. We will respond within 30 days. In-app data export functionality is available for transaction and report data.

Section 11 - Security

• All data is transmitted over HTTPS using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 via Google Firebase
• Plaid access tokens are stored server-side only and never exposed to the client
• AI provider API keys you add are stored encrypted and are never sent back to the app
• All administrative systems are protected by phishing-resistant multi-factor authentication (passkeys)
• Firebase Security Rules restrict all database access to authenticated users only
• Outside AI apps connect through a standard authorization process (OAuth) that requires your approval, and only apps Kove has registered can connect
• Kove personnel with authorized administrative access may view account, financial, AI conversation, and outside app change data for support, compliance, content moderation, and fraud investigation purposes. This access is restricted at the database level, sensitive access is logged, and it does not extend to Plaid access tokens or other authentication secrets

In the event of a confirmed data breach, we will notify affected users within 72 hours in accordance with Washington State law (RCW 19.255.010).

Section 12 - Your Privacy Rights

12.1 How to Make a Request To exercise any right in this section, email support@kovefinance.com from the email address on your Kove account, and tell us which right you are exercising. To protect your data, we verify requests by confirming they come from that address, and we may ask for more information if we cannot. You may use an authorized agent; we will ask the agent for your written permission and may ask you to confirm your identity directly. We respond within 45 days, and will tell you if we need more time as the law allows. If we deny your request, you can appeal by replying with the subject line “Privacy Appeal”; we will respond to appeals within the time your state’s law requires. 12.2 California Residents (CCPA) If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: request deletion of your personal information (see Section 09)
• Right to Correct: request correction of inaccurate personal information we hold about you
• Right to Opt Out of Sale or Sharing: we do not sell personal information. We do not share personal information from the Kove app for advertising. The only advertising-related disclosure is the Meta Pixel on the kovefinance.com website, described in Section 6.5, which may be considered “sharing” under California law; you can limit it as described there or ask us for help at support@kovefinance.com. To the extent our university reporting arrangements could be construed as “sharing,” you may opt out by contacting support@kovefinance.com
• Right to Limit Use of Sensitive Personal Information: we collect date of birth and financial account information, which may be classified as sensitive personal information under CCPA. We use them only to operate the Services you request, and never include date of birth in aggregated reports or share it with third parties
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

Categories of personal information we have collected in the past 12 months, the sources, and who receives them:

• Identifiers (name, email address, phone number, account ID, device and push tokens): from you and your device; shared with the service providers in Section 08 that need them
• Customer records and financial information (bank accounts, transactions, balances, investments, liabilities, payment status): from you, Plaid, and Stripe; shared with Plaid, Stripe, Google, Anthropic, and any AI provider or outside app you choose
• Characteristics (date of birth, student or employment status): from you; used only to operate the Services and stored with Google as our host
• Internet and app activity (pages and screens viewed, features used, errors): from your use of Kove and kovefinance.com; shared with PostHog, Sentry, Google, Vercel, and, for kovefinance.com only, Meta
• Coarse location (state of residence, country): from you and your device; used in analytics and aggregated reports
• We do not create profiles or inferences about you for advertising. We use the information above for the purposes in Section 03 and keep it for the periods in Section 09

12.3 Other States If you are a resident of another state with a comprehensive consumer privacy law (including Virginia, Colorado, Connecticut, Texas, Oregon, Utah, or others), you may have similar rights to know, access, correct, delete, or port your personal information, and to appeal a decision about your request. Make requests as described in Section 12.1.

Section 13 - Children's Privacy

Kove is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a user under 18, we will delete it immediately. If you believe a minor has created an account, please contact us at support@kovefinance.com.

Section 14 - Changes to This Policy

We may update this Privacy Policy as Kove evolves. We will notify registered users of material changes via email at least 14 days before they take effect. The effective date at the top of this page will always reflect the most current version. Continued use of Kove after changes take effect constitutes acceptance of the updated policy.

Section 15 - Governing Law and Dispute Resolution

This Privacy Policy is governed by the laws of the State of Washington, without regard to its conflict of law provisions. Any dispute arising out of or relating to this Privacy Policy is subject to the binding arbitration agreement, class action waiver, and jury trial waiver set forth in Section 17 of our Terms of Service, which is incorporated into this Privacy Policy by reference. That section also describes how to opt out of arbitration within 30 days of first accepting our Terms.

Section 16 - Contact Us

If you have questions, concerns, or requests related to this Privacy Policy, please contact:

• Keane Financials LLC, Privacy
• Email: support@kovefinance.com
• Websites: kovefinance.com and kovefinance.app
• State of Incorporation: Washington State, United States