Privacy Policy

1. Introduction

Mito Systems Inc. (“Company,” “we,” “us,” or “our”) operates the Covey mobile application and website at getcovey.app (the “Platform”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform.

By using the Platform, you consent to the practices described in this Privacy Policy.

2. Information We Collect

Account Information: Name, email address, phone number, and password (stored as a secure hash, never in plaintext).

Identity Verification Data: Government-issued photo ID and selfie images are collected by Stripe Identity for KYC (Know Your Customer) verification. This data is processed and stored by Stripe under their privacy policy. We receive only the verification result (approved/rejected), not copies of your ID.

Child Information: Parents provide child names, ages, grade levels, allergies, medical notes, emergency contact information, and approved pickup contacts. This information is used solely to facilitate safe activity participation and is only shared with booked educators for the duration of an activity.

Educator Documents: Vulnerable Sector Checks, offence declarations, professional credentials, and references. These documents are stored securely and accessible only to authorized administrators.

Payment Information: Payment details are collected and processed by Stripe. We do not store credit card numbers or bank account details on our servers.

Usage Data: We may collect information about how you interact with the Platform, including pages viewed, features used, and general location (city/region level, not precise GPS).

3. How We Use Your Information

We use your personal information to:

Create and manage your account; verify your identity and eligibility for your selected role(s); facilitate bookings and payments between parents, educators, and location owners; communicate with you about bookings, verifications, and platform updates; ensure child safety during activities; improve and maintain the Platform; comply with legal obligations; and prevent fraud and enforce our Terms and Conditions.

4. How We Share Your Information

We share your personal information only in the following circumstances:

With Other Users: Educators see child names, ages, allergies, medical notes, and emergency contacts for booked activities. Parents see educator profiles, credentials, and ratings. Location details are visible to educators who submit proposals.

Service Providers: We use Stripe for payments and identity verification, Resend for transactional emails, Twilio for SMS verification, Cloudflare for hosting and security, and Neon for database hosting. These providers process data under their own privacy policies.

Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of our users, the public, or the Company.

We do not sell your personal information to third parties.

5. Children's Privacy

Covey collects limited information about children solely through their parents' accounts. Children do not create accounts or interact with the Platform directly. Child data (name, age, grade, allergies, medical notes, emergency contacts) is provided by parents and used exclusively for facilitating safe activity participation.

We do not collect children's data for advertising or marketing purposes. Parents may update or delete their children's information at any time through the app.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including: encrypted data transmission (TLS/HTTPS), secure password hashing (PBKDF2-SHA256), signed URLs with short expiry for sensitive documents, role-based access controls, and rate limiting on authentication endpoints.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your account information for as long as your account is active. Verification documents are retained as required by applicable regulations. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law (e.g., financial transaction records).

8. Your Rights

Under applicable Canadian privacy law, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your personal information (subject to legal retention requirements); withdraw consent to data processing; and file a complaint with the applicable privacy commissioner.

To exercise any of these rights, contact us at hello@getcovey.app.

9. Cookies and Tracking

The Covey website may use essential cookies for functionality (such as authentication). We do not use advertising cookies or third-party tracking pixels. The mobile app does not use cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or by email. The “Last updated” date at the top of this page indicates when this policy was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Mito Systems Inc.
Email: hello@getcovey.app
Web: mito.systems