1. Who we are
Kovi (the “Service”) includes the Kovi app, heykovi.com, and related Kovi services. It is operated by Spronta Ltd, registered in England and Wales under company number 16278102, with its registered office at 128 City Road, London, EC1V 2NX, England. Spronta Ltd is the controller of the personal data described here. Our ICO registration number is ZC017195.
For privacy questions or requests, contact support@spronta.com and mention Kovi.
2. Information we use
- Account information: your email address, account identifier, authentication and session records, and, if you choose Sign in with Apple, the identifier and any name or email Apple supplies. Apple may supply a private relay email address.
- Meal planning information: meals, recipes, ingredients, food logs, nutrition estimates, meal plans, grocery lists, pantry items, preferences, ratings, and cooking history you create or save.
- Profile information: the goals, body measurements, dietary requirements, allergies, routines, and other details you choose to provide. Some of this can reveal health information.
- AI interactions: your messages, relevant conversation history, and the app context used to answer your request, such as your plan, food preferences, nutrition targets, and remaining daily macros.
- Optional connections: information described in section 4, only when you enable the relevant connection and permissions.
- Support and technical information: communications you send us, IP addresses and request metadata processed by our infrastructure, and security, error, and usage-limit records needed to operate the service.
You do not need to tell Kovi that you have ADHD to use it. Please avoid including other people’s personal information or unnecessary sensitive details in chat or support messages.
3. On your device, in the cloud, and with AI
Kovi stores app information on your device. Local storage does not mean that everything stays on your device: signing in and using sync sends your profile, custom meals, meal plans, grocery list, and selected preferences to our cloud service. Local food logs and chat history can also contribute to context sent when you use online AI.
Online AI requests are processed through Cloudflare and, depending on the service configuration, OpenRouter and the model provider selected through it. The current planner uses the Kimi model family from Moonshot AI. A legacy or separately configured direct chat route can use Groq. The information sent can include your message, conversation context, and the relevant meal, profile, nutrition, and connected-service context needed to respond.
AI generates suggestions and estimates; it does not make decisions with legal or similarly significant effects about you. We do not sell your personal data or use health information for advertising. We do not use your content to train our own general-purpose AI models. Provider handling and retention depend on the service and contractual configuration; contact us for details of the processors used for your request.
Recipe imports send the recipe URL to our service so it can retrieve and extract the recipe. Recipe images or source links may contact the original publisher when opened. Do not import private links containing credentials or information you do not want shared.
4. Optional permissions and connections
Apple Health. With your permission, Kovi can read steps, active energy, body mass, sleep, and workout information to help with food planning. It uses summaries rather than needing your full Health history. Depending on the app feature and request, relevant Health summaries, including workout context, can be included in online planner context. Health access is optional. You can revoke it in Apple Health or iOS Settings and disconnect it in Kovi. Revoking access stops future reads; it does not by itself erase information already processed.
Apple Calendar. With permission, Kovi reads nearby events, their times, and availability to fit meals around your schedule. The device can read event titles; the compact planner context omits titles and uses timing and availability. Calendar access can be revoked in iOS Settings.
Oura. If you connect Oura, Kovi requests the daily scope to read readiness, sleep, and activity summaries for an on-device cooking-effort cue. The connection stores encrypted OAuth credentials in our Cloudflare database. Daily summaries are fetched transiently and held in app memory, not stored in that database or sent to the AI planner. Disconnecting removes the stored connection credentials and clears the in-app summary. You can also revoke access in Oura.
Voice and notifications. Voice input uses the speech-recognition services available on your device, subject to microphone and speech permissions; audio may be processed by the operating-system provider. Recognised text is handled like text you enter. Optional meal reminders use notification permission. You can turn these permissions off in device settings.
Connections to AI tools. If you deliberately connect an external assistant using Kovi’s connection link, that assistant can access the Kovi information exposed by the connection, such as grocery information. Treat connection links as secrets. The external service handles received information under its own privacy policy. Disable the connection to stop future access.
5. Why we process information
- Contract: to provide requested account, planning, sync, and AI features.
- Legitimate interests: to secure and maintain the service, prevent abuse, troubleshoot problems, and respond to support enquiries, balanced against your rights.
- Consent: for optional permissions and any processing that requires consent. Where information is special-category health data, we rely on explicit consent for that processing in addition to an appropriate UK GDPR Article 6 basis.
- Legal obligation: where we must keep records or respond to a binding legal request.
You can withdraw consent at any time by turning off the relevant feature or contacting us. This does not affect the lawfulness of processing before withdrawal. A feature may not work without information it needs; optional connections are not required for basic meal planning.
7. Storage, retention, and deletion
Information saved locally remains until you remove it, clear the app’s storage, or uninstall the app, subject to your device’s backup settings. Exported backups remain wherever you choose to save them.
Cloud account and synced content are retained while needed to provide your account. When you request account deletion, we verify the request and arrange deletion of the associated account and content, normally within 30 days. We may retain limited records where required by law or necessary for legal claims or security. Any exception will be explained where permitted.
Support correspondence is normally kept for up to two years after resolution, following Spronta’s support retention policy. Operational and AI-provider records may have different retention periods; contact us for the periods applicable to your request. Oura summaries are transient as described above; stored Oura credentials remain until disconnection or deletion.
Signing out, uninstalling, or disconnecting a permission does not automatically delete your cloud account. See account and data deletion for the support route. Deleting your Kovi account does not delete your Apple or Oura account or their original records.
8. Your rights
Depending on applicable law, you can ask to access, correct, erase, restrict, or receive a portable copy of your data; object to processing based on legitimate interests; and withdraw consent. Contact support@spronta.com. We may need proportionate information to verify your identity. We normally respond within one month. If a lawful extension is needed for a complex request, we will tell you.
You can also complain to the UK Information Commissioner’s Office, or the data-protection authority where you live. You do not need to contact us first.
9. Website cookies and storage
This marketing website does not set analytics, advertising, or attribution cookies and does not load third-party marketing pixels. The interactive meal example runs in your browser without saving your choices or sending them to us. Fonts and brand assets are served with the website.
Our hosting provider still processes routine technical information to deliver and secure the website. Following an external link takes you to a service with its own privacy and cookie practices. The app uses local storage and secure credential storage to provide its functions; those are separate from website cookies.
10. Security and age
We use measures such as encrypted connections, access controls, secure device credential storage, and encrypted Oura credentials to protect data. No system is completely secure. Report security concerns to support@spronta.com.
Kovi is intended for adults aged 18 and over. We do not knowingly offer accounts to children. If you believe a child has provided personal information, contact us so we can investigate and arrange removal.
11. Updates and contact
We may update this policy as Kovi changes. For material changes, we will provide appropriate notice through the service or by email, normally at least 14 days before they take effect unless an urgent legal or security reason requires otherwise. Where a new use needs consent, we will ask for it.
Privacy contact: support@spronta.com. Postal address: Spronta Ltd, 128 City Road, London, EC1V 2NX, England.