Privacy Policy

Last updated: 26 August 2026

This is the current version of the Kova AI Privacy Policy, and it describes how we handle your information today. If you have a question about your data, or you want to make a request about it, email us at supportkovaai@gmail.com and a person will answer you.

Kova AI holds information about your body and your training, which is about as personal as data gets. This policy explains exactly what we collect, why we have it, who else touches it, and how you can get rid of it. We have tried to write it in plain English rather than legal padding.

1. The short version

• We collect what you tell us during onboarding, what you log while you train, and a small amount of technical data needed to run the app.
• Your body scan video never leaves your phone. We do not receive it, we do not store it, and nobody at Kova AI can watch it. To write your scan feedback, three still images from that scan are sent to our AI provider for that one request. They are never saved to your account or kept on our servers, and the request is made with response storage switched off, see section 4.
• We treat your health and fitness data as sensitive data, and we process it on the basis of your explicit consent.
• We do not sell your personal information and we never have. There are no advertising trackers in the app.
• Your data is stored in the European Union, and our database is configured so that each user can only read their own rows.
• You can permanently delete your account and everything attached to it from inside the app, in Settings, Delete Account.

This summary is here for orientation. The sections below are the actual policy.

2. Who we are

Ben Ari Shoshan, trading as Kova AI, of Arthur Ruppin 20, Rehovot, Israel, is the controller of the personal information described in this policy. In this policy "Kova AI", "we", "us" and "our" mean that business.

This policy covers the Kova AI app for iOS, the Android app when it launches, our website at getkovaai.com, and support conversations you have with us.

For anything privacy related, write to supportkovaai@gmail.com.

3. What we collect

Account information

• Sign in with Apple. We receive the user identifier Apple gives us and the email address Apple passes on. If you choose Apple's Hide My Email option, we only ever see the private relay address, never your real one. We receive your name only if you choose to share it.
• Sign in with Google. We receive your Google account identifier and the basic profile information Google shares with us, such as your email address and name.
• We never receive or store your Apple or Google password. Authentication happens with them, not with us.

What you tell us during onboarding

• gender
• date of birth
• height
• current weight and goal weight
• your fitness goal
• your training experience
• how many workouts a week you want to do
• the equipment you have available
• self reported health considerations, including issues with your back, knees, arms and shoulders, and anything else you type into the free text field

What is created as you use the app

• Workout sessions: the workout name, when you started, how long it took, which exercises you did, and the weight and reps for every set.
• Weigh-ins that you record over time.
• Personal records calculated from the sets you have logged.
• Custom workouts and custom exercise names that you create.
• App preferences: your notification toggles, your theme choice, and which prompts you have dismissed.
• Body scan records: the date of each scan and the text feedback generated for you. Never the video itself, and never the still images taken from it, see section 4.

Subscription information

When you subscribe through the App Store, or through Google Play in the future, we are told whether your subscription is active, which plan it is, and when it renews or expires. We never receive your card number, bank details or billing address. The stores handle all of that.

Support messages and bug reports

If you send an in-app bug report we receive what you wrote and any details you chose to include. That report reaches our inbox through FormSubmit. If you email us or use the contact form on the website, we receive your name, email address and message.

Technical information

When your app talks to our servers, our systems process ordinary technical data such as IP address, timestamps, request information and error logs. We use it to keep the Service running, to debug problems and to protect against abuse.

What we do not collect

• We do not collect your precise location.
• We do not use advertising identifiers or advertising trackers, and we do not build advertising profiles about you.
• We use your camera only when you record a body scan, and that recording stays on your device.

4. Your body scan

The three still images

Scan feedback works by comparing this month's scan against the one before it. To do that, your phone takes three still images from the clip, early, middle and late in the turn, and saves them next to the video on your device.

When feedback is generated, those stills are sent for that single request to the AI provider that writes the feedback, Google, listed in section 8. They are not saved to your account, they are not kept on our servers, and we make the request with response storage switched off. What comes back is text, and that text is the only part that is stored.

The video itself is never sent, to us or to anyone else.

Because these images show your body, we treat them as health data under section 5. We ask for your explicit consent in the app before feedback is generated for the first time. If you decline, body scans still work and stay on your phone, you simply get no AI feedback, and you can change your mind later in the app.

5. Health data is sensitive data

Most of what you tell Kova AI is health information: your weight, your body measurements and targets, your training history, and above all the health considerations you enter about your back, knees, shoulders or anything else.

Under the GDPR this is special category data, specifically data concerning health. Under several US state laws it counts as sensitive personal information or as consumer health data. We treat it that way.

• We process it on the basis of your explicit consent. Under the GDPR our legal basis is Article 9(2)(a). We ask you to expressly agree in the app to the processing of your health data before it is used to personalize the Service. Entering data is not treated as consent by itself, and body scan feedback has its own separate consent step before your first feedback is generated, as described in section 4.
• Providing health information is voluntary. You are never under any legal obligation to give it to us, and you can skip it. The only consequence of not providing it is that the personalized parts of the Service, your plan, the AI Coach and body scan feedback, cannot be provided, because they cannot work without it.
• We use it only to run the features you asked for: building and adapting your plan, tracking your progress and producing your body scan feedback.
• We never sell it, and never share it for advertising. We do not use it to make or support decisions about your insurance, employment, credit or anything similar, and we do not give it to data brokers.
• You can withdraw your consent at any time by deleting your account in the app, or by emailing us. Withdrawing consent does not affect processing that already happened before you withdrew it, and it does mean we can no longer provide the personalized parts of the Service, because they cannot work without this data.

6. Why we use it, and legal bases

If you are in the EU, the EEA or the UK, the GDPR requires us to have a legal basis for each thing we do with your data. Here is the full list.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time. See section 12.

We do not use your personal information for advertising, and we do not sell it. See section 8 for the complete list of who receives data.

7. Guest accounts

When you start the onboarding quiz, before you have signed in, the app creates a guest account so your answers are saved as you go. That account holds a random identifier rather than your name or email address.

Guest accounts are pseudonymous, not anonymous. The record is not stored under your name, but it is linked to a random identifier, to the ordinary technical data described in section 3, and to the device it was created on. If you later sign in, it is linked to your Apple or Google identity. Data like this is still personal data, and we treat it that way, with the same protections as the rest of your data.

When you sign in with Apple or Google, the guest account is linked to that identity, and everything you entered carries over. That is why you do not have to answer the quiz twice.

If you never sign in, the record stays in our database attached only to that random identifier. Guest accounts that are never linked to a sign in are deleted, together with everything they contain, no later than 60 days after they were last used.

Deleting the app removes your access to a guest account. If you would like it removed from our side sooner than the 60-day limit, email us at supportkovaai@gmail.com and we will work with you to identify and delete it.

8. Who we share data with

We do not sell your personal information, and we never have. We do not share it for cross-context behavioral advertising, and there are no advertising SDKs in the app.

We use a small number of service providers, which act as our processors and may only use your data to provide their service to us.

We may also disclose information:

• to professional advisers such as lawyers and accountants, under confidentiality obligations, when we genuinely need their help;
• when the law requires it, for example a valid court order or a lawful request from an authority. We check that requests are valid, we resist ones that are overbroad, and where we are allowed to tell you we will;
• to protect people, where we reasonably believe disclosure is necessary to prevent fraud, abuse, or a risk to someone's safety, or to establish or defend legal claims;
• in a business transfer, such as a merger, acquisition or sale of assets. Your data would move to the buyer under this policy, and we would tell you before it became subject to a different one.

If we add a new provider that processes your personal data, we will update the table above at or before the time the change takes effect.

9. Where your data is stored

Your Kova AI data is stored on Supabase infrastructure in the European Union, in the eu-west-3 region, which is Paris, France.

We are based in Israel, so our team may access data from there in order to run and support the Service. Israel is recognized by the European Commission as providing an adequate level of protection for personal data, which allows personal data to be transferred from the EEA to Israel. Where an additional safeguard is needed for a particular transfer, we use the European Commission's Standard Contractual Clauses.

If you use the app outside the EU, for example in the United States or Israel, your data is transferred to the EU when you use the app, because that is where it lives.

Apple, Google, including the Gemini API that writes your coach replies and your scan feedback, RevenueCat and FormSubmit may process data outside the EU. Where they do, they rely on their own transfer mechanisms, such as Standard Contractual Clauses or an adequacy decision.

You can ask us for more information about our transfer safeguards at supportkovaai@gmail.com.

10. How long we keep it

• Your account and training data: kept while your account exists, so that your history and progress are there when you open the app. Both are deleted when you delete your account.
• After you delete your account: your account row and every row linked to it are removed from our live database, through database cascade. See section 14.
• Backups: our hosting provider keeps encrypted backups on a rolling basis, so a deleted record can survive in a backup for a limited period until that backup is overwritten. Backups are not used to bring deleted accounts back into the live service.
• Support emails and bug reports: kept for as long as we need to deal with the issue and for a reasonable period afterwards, so we can spot repeat problems.
• Records we must keep by law, such as records related to purchases and tax, are kept for the period the law requires, even after you delete your account. Most purchase records sit with Apple or Google rather than with us.
• Guest accounts never linked to a sign in: deleted no later than 60 days after they were last used, see section 7.
• Body scan videos: we never have them, so there is nothing for us to retain. They live on your phone until you delete them.

11. How we protect it

• Row Level Security. Our database enforces per-user rules at the database level, so each account can only read and write its own rows. Your data is not visible to other users of the app.
• Encryption in transit. All traffic between the app and our servers is encrypted with HTTPS and TLS.
• Encryption at rest. Data stored on our hosting provider's infrastructure is encrypted at rest.
• No passwords to steal. Sign in happens through Apple or Google. We never see, receive or store a password of yours.
• Limited access. Access to production data is restricted to the people who need it to operate and support the Service.
• Your body scan video is not on our servers at all, so no breach of our systems can expose it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data and is likely to create a risk to you, we will notify you and the relevant regulator as the law requires, which under the GDPR means notifying the supervisory authority without undue delay and generally within 72 hours of becoming aware of it.

12. Your privacy rights

Rights everyone has with us

Wherever you live, and whether or not your local law requires it, you can ask us to:

• Access. Tell you what personal information we hold about you and give you a copy.
• Rectify. Correct information that is wrong or out of date. Most of it you can edit yourself in the app.
• Erase. Delete your account and the data attached to it. You can do this yourself in the app, in Settings, Delete Account.
• Port. Give you a copy of the data you provided in a structured, commonly used, machine readable format, or send it to another provider where that is technically feasible.
• Object or restrict. Object to processing based on our legitimate interests, or ask us to restrict processing while a dispute about it is resolved.
• Withdraw consent. Withdraw the explicit consent for health data processing described in section 5.
• Complain. Raise it with a regulator, without going through us first.

How to exercise them

Most things are fastest in the app. You can edit your profile details directly, change your notification settings, and delete your account under Settings.

For anything else, email supportkovaai@gmail.com, ideally from the email address on your account, and tell us what you want. We may need to verify your identity before we act, which protects you as much as us.

We reply within 30 days. If a request is complex we may need longer, and we will tell you why within that first 30 days. Under the GDPR we may extend by up to two further months for complex requests.

Exercising your rights is free. We may charge a reasonable fee, or decline, only if a request is manifestly unfounded or excessive, and we will explain if that ever happens.

If you are in the EU, the EEA or the UK

The rights above are your rights under Articles 15 to 22 of the GDPR, and under the UK GDPR if you are in the United Kingdom.

You have the right to lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner's Office.

You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not make decisions like that. The AI Coach and the plan generator produce training suggestions, which you are free to ignore, and they do not affect your legal rights or anything comparable.

If you are in Israel

Under the Israeli Privacy Protection Law, 5741-1981, and its regulations, you have the right to review information held about you in a database, and to request that it be corrected, completed, clarified or deleted if it is incorrect, incomplete, unclear or out of date.

That law also requires us to tell you, when we ask you for personal information, that you are under no legal obligation to provide it and that providing it depends on your own wish and consent. That is the case here: everything you give Kova AI is voluntary. If you choose not to provide something, the only consequence is that the features that depend on it will not work, as described in section 5. The information you provide is held by the controller named in section 2, is used for the purposes listed in section 6, and is shared only as described in section 8.

Send requests to supportkovaai@gmail.com. If we refuse a correction request, we will tell you why, and that law gives you the right to appeal to a court. You can also contact the Israeli Privacy Protection Authority.

If you are in the United States

Depending on your state, you may have rights under the California Consumer Privacy Act as amended by the CPRA, or under similar laws in states such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana. Those rights include the right to know, access, correct, delete and port your personal information. Use the same contact details above.

• We do not sell your personal information and we have not sold or shared it for cross-context behavioral advertising or targeted advertising in the past 12 months, or at any point. There is no sale to opt out of. You are still welcome to tell us your preference, and we will record it.
• Sensitive personal information. Your health and fitness data is used only to provide the features you asked for, which is a permitted business purpose. We do not use or disclose it to infer characteristics about you, and we do not use it for advertising, so the right to limit its use has nothing to restrict here.
• Consumer health data. In states with specific consumer health data laws, such as Washington and Nevada, we collect your health data with your consent, use it only to provide the app to you, and do not sell it. Because we do not sell consumer health data, no separate sale authorization is needed. Our full Consumer Health Data Privacy Policy for those states is in section 13.
• No discrimination. We will not deny you service, charge you a different price, or give you a lower quality experience because you exercised a privacy right.
• Authorized agents. You can use an authorized agent to submit a request. We may ask for proof that you gave them permission, and we may ask you to confirm it directly.
• Appeals. If we decline your request and your state gives you an appeal right, reply to our decision email and we will reconsider within the time your state's law allows.
• California Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

13. Consumer Health Data Privacy Policy (Washington and Nevada)

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act and Nevada's consumer health data law, SB 370. It applies to you if you live in Washington or Nevada, or if your consumer health data is collected while you are there. For everyone else it is still an accurate description of how we handle health data.

The consumer health data we collect

• Your gender, date of birth, height, current weight, goal weight and weigh-in history.
• Your fitness goal, training experience and self reported health considerations, including issues with your back, knees, arms and shoulders, and anything you type into the free text health field.
• Your workout history: sessions, exercises, sets, weights, reps and personal records.
• Your body scan dates and the text feedback generated for each scan. The scan video and the still images taken from it are handled as described in section 4: the video never leaves your phone, and the stills are sent to our AI provider for the single feedback request only and are not stored by us.

Where it comes from

We collect consumer health data from one source: you. You enter it during onboarding and while using the app, and the app derives records such as personal bests from what you log. We do not buy health data, and we do not collect it from other companies or from public sources.

Why we collect it, and how it is used

We collect and use consumer health data only to provide the services you asked for: building and adapting your workout plan, generating AI Coach replies, tracking your progress and records, and generating body scan feedback, plus the supporting activities described in section 6, such as keeping the Service secure. We do not use it for advertising, and we do not use it to make decisions about insurance, employment or credit.

Who can receive it

We share consumer health data only with the processors that run the Service for us: Supabase, which hosts our database, and Google, whose Gemini API generates your plan, coach replies and scan feedback, each as described in section 8. We have no affiliates. We do not sell consumer health data, and we do not share it for advertising. Because there is no sale, no sale authorization is required.

Your rights

If you live in Washington or Nevada you have the right to:

• confirm whether we collect, share or sell consumer health data about you, and access that data, including a list of the third parties with whom we have shared it;
• withdraw the consent described in section 5;
• have your consumer health data deleted. The fastest way is in the app, Settings, Delete Account, and section 14 describes what that removes and how to ask by email instead.

To exercise any of these rights, use the app or email supportkovaai@gmail.com. We will not discriminate against you for exercising them. If we decline a request, we will explain why, and you can appeal by replying to our decision email with the word "appeal". If your appeal is unsuccessful, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the Nevada Attorney General, without going through us.

14. Deleting your account

You can delete your account yourself, at any time, without asking us. Open the app, go to Settings, choose Delete Account, and confirm.

This permanently deletes your account, and every row linked to it is removed through database cascade, including:

• your onboarding profile, including your health considerations
• your workout sessions and every set you logged
• your weigh-ins and personal records
• your custom workouts and custom exercise names
• your app preferences
• your body scan records, meaning the dates and the text feedback

Deletion cannot be undone. There is no restore and no grace period. If you want a copy of your training history, ask us for it before you delete.

Deleting your account does not cancel your subscription. Subscriptions are billed by Apple or Google, so you must cancel in your Apple ID subscription settings or in Google Play, otherwise the store will keep charging you.

Your body scan videos are on your phone, not in your account, so deletion does not touch them. Delete them on your device, or delete the app.

If you cannot get into the app, or you have already uninstalled it, you do not need to reinstall anything: follow the steps on our account deletion page, or email supportkovaai@gmail.com from the address on your account and we will delete it for you.

15. Children's privacy

Kova AI is for adults. You must be at least 18 to use it, as described in our Terms of Service, and we do not knowingly collect personal information from anyone under 18. If we learn that we hold data for someone under 18, we delete the account and its data promptly.

We do not knowingly sell or share the personal information of minors, and as explained above we do not sell personal information at all.

Parents and guardians: if you believe your child has given us personal information, email supportkovaai@gmail.com and we will look into it and delete it.

16. Our website and cookies

Our website at getkovaai.com is a plain static site, and it is deliberately boring from a privacy point of view.

• No analytics. We do not run Google Analytics or any other analytics or tracking script on the site.
• No advertising or tracking cookies. We do not set them, which is why you do not see a cookie consent banner.
• Fonts. The site loads its typeface from Google Fonts, which means Google receives your IP address and basic browser information in order to serve those font files.
• Contact form. The form on our contact page is delivered by FormSubmit. When you send it, FormSubmit receives your name, email address and message, and forwards them to our inbox.
• Server logs. Our hosting provider keeps standard server logs, including IP addresses, to serve the site and protect it from abuse.

The website does not sell information and does not use it for advertising.

17. Changes to this policy

We may update this policy as the app changes or as the law changes.

When a change is material we will tell you in the app or on this page, and we will update the "Last updated" date at the top.

If a change affects how we use your health data, and the law requires it, we will ask for your consent again rather than assuming it.

Want a previous version? Email us and we will send it.

18. Contact us

For any privacy question or request:

• Ben Ari Shoshan, trading as Kova AI
• Arthur Ruppin 20, Rehovot, Israel
• Email: supportkovaai@gmail.com
• Website: getkovaai.com

If you are in the EEA or the UK and you are not happy with how we handled your request, you can complain to your local data protection authority. If you are in Israel, you can contact the Privacy Protection Authority.

See also our Terms of Service.