Cove Wallet Privacy Policy

Effective date: October 27, 2026, Published at https://covewallet.net/privacy Applies to: the Cove Wallet app for Android (cove.technology.wallet) and iOS, and the Cove services the app connects to.

Cove Wallet is a self-custody wallet made by Cove Technology LLC ("Cove", "we", "us"). Self-custody means your keys are created and kept on your own phone and Cove card. We can't see them, and we can't move, freeze or recover your money. This policy explains what information the app handles, what leaves your phone, who receives it, and the choices you have.

In short: we don't ask who you are, we don't collect your balances or who you pay, we don't sell data, and the app contains no third-party advertising or tracking software. The information we do receive is limited to what's needed to run the app, keep it working well, and protect you from known attacks.

1. Information that stays on your phone

The app keeps the following only on your device, encrypted by the phone's secure hardware (Secure Enclave on iPhone, Android Keystore) and your Cove PIN. It is never sent to Cove:

• your private keys and recovery keys;
• your Cove PIN, card PIN and the result of Face ID, Touch ID or your screen lock (we never receive biometric data: your phone checks it);
• your contacts (the addresses you save and their names);
• your settings, your personal block list entries, and the receipts you choose to keep.

Recovery keys are shown once so you can write them down. There is no backup to our servers. If you lose your phone, you recover with your written-down key or your Cove card, not through us.

2. Information we do not collect

We do not collect:

• your name, email address, phone number or postal address (unless you contact us yourself, see section 9);
• your account balances, transaction history, or the addresses you pay or save as contacts;
• your private keys, recovery keys or PINs;
• your location, your contacts list, your photos or files;
• advertising identifiers or any cross-app tracking. The app contains no advertising, analytics or tracking software from third parties.

3. Information that leaves your phone, and why

3.1 Blockchain networks (to show balances and send payments)

To show your balances and send your transactions, the app connects to servers that run the XRP Ledger, a public blockchain. These servers receive the public addresses the app asks about, the signed transactions you choose to send, and, as with any internet connection, your device's IP address.

• By default these servers are operated by third parties: XRPL Cluster (xrplcluster.com) and Ripple (s1.ripple.com, s2.ripple.com), whose own privacy practices apply to what they receive. Cove also operates its own XRP Ledger servers. When the app uses them, the requests pass through Cove's gateway, which uses your IP address only in memory to limit abuse (see "IP addresses" below) and doesn't record which addresses were asked about.
• Everything recorded on the XRP Ledger, including addresses, balances and transactions, is public by design and can be seen by anyone. Cove can't change or remove it.
• Cove's fee. Swaps, trades and pool deposits and withdrawals pay Cove a 0.5% fee. It's an ordinary payment on the XRP Ledger to Cove's own account, naming the trade it's for, so, like anyone, we can see which address paid and how much. We don't link that address to you, and we don't use it for anything except accounting for what we received.

3.2 Cove services

The app connects to Cove's servers for the following. Requests carry no account or name, and none carries a device identifier except notifications and the security check-in, which use a random install id the app makes up (not your phone's own identifiers).

IP addresses: our servers use the IP address a request comes from only in memory, to deliver the response and limit abuse (rate limiting). We do not store IP addresses and keep no access logs of who requested what. The one exception is an attack: we may block the network addresses an attack comes from, and keep that block list for as long as the block lasts.

3.3 Services you choose to open

• QR scanning on Android uses Google's ML Kit, which reads the code on your phone; the camera image never leaves it. ML Kit may send Google anonymous usage and performance information (for example the device model and how long a scan took), under Google's terms. On iPhone, scanning uses Apple's on-device Vision framework.
• Developer mode (an advanced setting, off by default) can connect to the XRP Ledger's test networks and their faucets, and to servers you choose yourself.
• Collectible (NFT) previews: collectibles are an optional, advanced feature. If you tap "Load preview", the app fetches the collectible's description and image from the address its creator chose, which sees your IP address. Collectibles stored on IPFS or Arweave are fetched through the public gateways ipfs.io (run by the IPFS project) and arweave.net, under their operators' terms. The app tells you this first.
• Links in notices or elsewhere open in your browser, under that website's own policy.
• Buying a Cove card happens on our website, not in the app, and may use BTCPay Server for payment. Ordering a card needs a delivery name and address, which the website's own privacy notice covers.

4. Cove Shield: protection against known attacks

Cove Shield works like fraud and loss prevention for your wallet. Cove maintains a block list of addresses known to be used in attacks, such as addresses that received stolen funds, scam destinations and drained wallets. We may add addresses to it from security research, public reports and reports we receive.

• The list is delivered to your phone, signed by Cove so it can't be altered on the way. The check happens on your phone: before you save a contact or send a transaction, the app refuses addresses on the list.
• We do not learn which addresses you pay or save. Cove Shield doesn't send your contacts or transactions to us.
• The list contains public blockchain addresses, not information about people. You can remove an entry for yourself, or add your own, in the app.

5. Permissions the app asks for

6. How long we keep information

• Performance statistics are kept in aggregate for as long as they help us improve the app, and contain nothing that identifies you.
• Crash reports are kept for up to 90 days.
• Install registrations (notifications and the security check-in, with the last security warnings reported) are deleted automatically after 90 days without use, or at once when you turn notifications off or ask us.
• Market data requests, Shield updates and notices are answered and not recorded against you.

7. Sharing and selling

• We do not sell or rent your information, and we don't share it with advertisers or data brokers.
• We use infrastructure providers to run our servers (Google Cloud, in the United States). They process data only on our behalf. Notifications use no third-party push service: the app fetches them from our own servers. If iPhones later receive them through Apple Push Notification service (the only way iOS can wake an app), this policy will say so.
• We may disclose information if the law requires it. Because we hold so little, there is usually little or nothing to disclose. We have no access to your keys or funds.
• If Cove Technology LLC is involved in a merger or acquisition, this policy continues to apply to information we hold.

8. Security

Your keys are protected by your phone's secure hardware, your Cove PIN, and for savings, your Cove card. Information sent to our servers is encrypted in transit (TLS). We collect as little as we can, so there is as little as possible to protect. No system is perfectly secure, so keep your recovery keys offline and private.

9. Your choices and rights

• You can use the wallet without giving us any personal information.
• You can turn crash reports on, and notifications (with the security check-in) off, in Settings at any time.
• Deleting your data: uninstalling the app removes everything it stored on your phone. An install registration is deleted when you turn notifications off, after 90 days unused, or on request.
• Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have rights to access, correct, delete or object to the processing of your personal information, and to complain to your data protection authority. Because the data we receive isn't linked to your identity, we may be unable to find information about you. Contact us and we'll help where we can.
• Legal bases (EU/UK): we process the limited information described here to provide the app (contract), and for our legitimate interests in keeping it reliable, reaching users with notices about Cove, and protecting users from attacks and compromised devices (notifications and the security check-in; you can object at any time by turning notifications off in Settings). Crash reports rely on your consent, which you can withdraw in Settings.
• We don't "sell" or "share" personal information as defined by California law.

To make a request or ask a question, email support@covewallet.net.

10. Children

Cove Wallet is not intended for anyone under 18, and we don't knowingly collect information from children.

11. International users

Our servers are located in the United States. If you use the app from elsewhere, the limited information described above is transferred there.

12. Changes to this policy

If we change this policy, we'll update the effective date above and, for significant changes, tell you in the app's notices before the change takes effect.

13. Contact

Cove Technology LLC 1309 Coffeen Avenue STE 18939, Sheridan, WY 82801, United States Email: support@covewallet.net, Phone: +1 307-381-6233 Website: https://covewallet.net/privacy