Privacy Policy

1. Introduction

Mito Systems Inc. (“Company,” “we,” “us,” or “our”) operates the Covey mobile application and website at getcovey.app (the “Platform”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform.

By using the Platform, you consent to the practices described in this Privacy Policy.

2. Information We Collect

Account Information: Name, email address, phone number, and password (stored as a secure hash, never in plaintext).

Identity Verification Data: Every Covey user — parents, educators, and Venue Operators — completes a Stripe Identity check before they can book, lead, or host trips. Government-issued photo ID and a live selfie are collected directly by Stripe Identity for KYC (Know Your Customer) verification. This data is processed and stored by Stripe under their privacy policy; Covey receives only the verification result (verified / requires retry / canceled), the date verified, and an opaque Stripe session ID. We never see or store copies of your ID or selfie.

Child Information: Parents provide child names, ages, grade levels, allergies, medical notes, emergency contact information, and approved pickup contacts. This information is used solely to facilitate safe activity participation and is only shared with booked educators for the duration of an activity.

Educator Documents: Vulnerable Sector Checks, professional credentials, and references. These documents are stored securely and accessible only to authorized administrators.

Payment Information: Payment details are collected and processed by Stripe. We do not store credit card numbers or bank account details on our servers.

Usage Data: We may collect information about how you interact with the Platform, including pages viewed, features used, and general location (city/region level, not precise GPS).

3. How We Use Your Information

We use your personal information to:

Create and manage your account; verify your identity and eligibility for your selected role(s); facilitate bookings and payments between parents, educators, and Venue Operators; communicate with you about bookings, verifications, and platform updates; ensure child safety during activities; improve and maintain the Platform; comply with legal obligations; and prevent fraud and enforce our Terms and Conditions.

4. How We Share Your Information

We share your personal information only in the following circumstances:

With Other Users: Educators see child names, ages, allergies, medical notes, and emergency contacts for booked activities. Parents see educator profiles, credentials, and ratings. Location details are visible to educators who submit proposals.

Service Providers: We use Stripe for payments and identity verification, Resend for transactional emails, Twilio for SMS verification, Cloudflare for hosting and security, and Neon for database hosting. These providers process data under their own privacy policies.

Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of our users, the public, or the Company.

We do not sell your personal information to third parties.

5. Children's Privacy

Covey is intended for adults (18+). Children do not create accounts or use the Platform directly. Any information about a child (name, age, grade, optional allergies and medical notes, and emergency contacts) is entered and managed by the child's parent or legal guardian, who consents to its collection and use for the sole purpose of arranging and safely running real-world field trips.

Consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable children's-privacy laws, we collect the minimum information necessary, obtain it only from a consenting parent or guardian, and never sell children's data or use it for advertising or marketing.

A parent or guardian may review, update, or delete their child's information at any time in the app, or remove it entirely by deleting their account (Profile → Delete Account). To request deletion of a child's information, a parent may also contact us at hello@getcovey.app.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including: encrypted data transmission (TLS/HTTPS), secure password hashing (PBKDF2-SHA256), signed URLs with short expiry for sensitive documents, role-based access controls, and rate limiting on authentication endpoints.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your account information for as long as your account is active. Verification documents are retained as required by applicable regulations. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law (e.g., financial transaction records).

8. Your Rights

Under applicable Canadian privacy law, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your personal information (subject to legal retention requirements); withdraw consent to data processing; and file a complaint with the applicable privacy commissioner.

To exercise any of these rights, contact us at hello@getcovey.app.

To delete your data: You can permanently delete your account and all associated data directly in the Covey app at any time — go to Profile → Delete Account (also reachable from Settings → Privacy & Safety). Deletion is immediate and signs you out. If you prefer, you can instead email hello@getcovey.app with the subject “Delete My Data” and the email on your account. We delete or anonymize your personal information within 30 days, except where retention is required by law.

What happens to past trips: When you delete your account, any trips you ran as an educator or hosted as a venue operator continue to exist for the parents and kids who booked them — but your name, photo, bio, and credentials are removed. Past trips display as “Former educator” or “Former venue” in those parents' booking history. Reviews you authored, and reviews other parents wrote about you, are kept (other educators and venues may still rely on them) but are attributed to “Deleted user”. Your name and contact details are not retained anywhere those past records appear.

9. Cookies and Tracking

The Covey website may use essential cookies for functionality (such as authentication). We do not use advertising cookies or third-party tracking pixels. The mobile app does not use cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or by email. The “Last updated” date at the top of this page indicates when this policy was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Mito Systems Inc.
Email: hello@getcovey.app
Web: mito.systems