Privacy policy
What we collect, why we collect it, and how to make us delete it. Short, because we deliberately collect very little.
The short version. This website sets no cookies of its own and runs no advertising or analytics scripts. The contact and campus forms send what you type to our inbox and nowhere else. The newsletter keeps your address, once you confirm it, until you unsubscribe. The product stores infrastructure metadata, never your application data.
1. Who we are
Coverops Private Limited operates coverops.dev and the CoverOps product. For questions about this policy or to exercise any right described below, contact office@coverops.dev.
2. What this website collects
Very little. The site is a set of static pages. It does not set analytics or advertising cookies, does not embed third-party trackers, and does not build a profile of you, and it sets no cookies of its own.
Our hosting provider records standard server logs (IP address, timestamp, requested path, and user agent) for security and reliability. These are retained briefly and are not used to identify individuals.
Cookies
None of our own. The GPU idle meter counts only while the page is open and starts again at zero on your next visit, so nothing needs storing and there is no banner to answer. Our host may set short-lived, strictly necessary security cookies to block abusive traffic.
Contact and newsletter forms
The contact form and the campus application form send only what you type into them when you press Send. Our server turns it into an email to office@coverops.dev, copied to a founder's inbox (sent through Resend, our email delivery provider, and received in Google Workspace and Gmail), and does not keep a separate copy.
The newsletter form sends only your email address. We keep it in our database with the date you asked and the date you confirmed, and email you once to confirm; you are on the list only after you click that link. Every build note carries a one-click unsubscribe link, and unsubscribing takes you off the list at once. The list is kept in our database and nowhere else.
Cloudflare Turnstile checks that each form is sent by a person, not a script. It runs only on pages with a form and sets no cookie of ours.
Once a message reaches us, we hold the message the way any business holds email it has been sent: to reply to you, and to keep a record of the conversation.
3. What the product collects
If you use CoverOps to manage infrastructure, we process:
- Account data: the names, work email addresses, and roles of people on your team who use the product.
- Infrastructure metadata: resource identifiers, configuration, plan output, policy results, and change history for the environments you connect.
- Operational telemetry: metrics, logs, and traces you explicitly route to CoverOps for monitoring.
- Usage data: which features are used and when, so we know what to improve.
We do not read your application data, your database contents, or the payloads in your object storage. The access role is not permitted to, as described in the security overview.
4. Why we process it
- To provide the service you asked for: performance of our contract with you
- To keep the service secure and investigate incidents: our legitimate interests
- To reply to you when you contact us: our legitimate interests
- To send product updates you opted into: your consent, withdrawable at any time
5. Who else sees it
We do not sell your data, and we do not share it for advertising. We use a small number of sub-processors to run the business (cloud hosting, email delivery, and error monitoring), each bound by contract to protect it.
The current sub-processor list is available on request, and we will give notice before adding one that processes customer data. Ask us at office@coverops.dev and we will send the current list.
6. How long we keep it
- Account data: while your account is active, then up to 90 days
- Infrastructure metadata: while the environment is connected, then up to 90 days
- Operational telemetry: for the retention window you configure
- Email correspondence: as long as needed for the business relationship
- Newsletter address: until you unsubscribe; an address never confirmed is deleted after 30 days
After termination we delete or anonymise what we hold. Your own infrastructure and repositories are untouched by this, because they were never ours.
7. Your rights
Depending on where you live you may have the right to access the personal data we hold about you, correct it, delete it, object to processing, restrict it, or receive a portable copy.
To exercise any of these, email office@coverops.dev. We will respond within one month. You will never need to pay, and we will not make it deliberately difficult. If you want your data gone, say so plainly and we will action it.
If you are unhappy with how we handled your request, you may complain to your local data protection authority.
8. How it is protected
Data is encrypted in transit and at rest. Access within our team is limited to the people who need it, and access to customer cloud accounts uses short-lived credentials rather than stored keys. More detail on the security page.
9. Changes to this policy
When this policy changes materially we will update the date at the top and, for account holders, tell you by email. We will not quietly broaden what we collect.
10. Contact
Anything at all about privacy: office@coverops.dev, or via the contact form.
Who processes data for us
As of 18 October 2026, these companies process personal or account data on our behalf:
| Who | What data | Where | Why |
|---|---|---|---|
| Amazon Web Services | Everything the product stores: accounts, cloud metadata, findings, invoices, backups | Hyderabad, India (ap-south-2) | Hosting the console and its database |
| Cloudflare | Requests to coverops.dev and platform.coverops.dev; the human check on forms | Global network | Website hosting, the network tunnel to our servers, bot protection |
| Resend | Email address and the content of emails we send you | United States | Sign-up codes, invoices and notifications by email |
| Cashfree Payments | Name, email, phone and the payment for an invoice | India | Taking card and UPI payments |
The product stores metadata about your cloud resources (identifiers, sizes, regions, tags, utilisation and cost) and never your application data, database contents or files. A change to this list is announced by email to organisation owners before it takes effect.
Versions
- 19 October 2026: the newsletter keeps confirmed addresses until you unsubscribe; forms are checked by Cloudflare Turnstile.
- 18 October 2026: subprocessors listed; the website no longer sets any cookie of its own; the consent banner and the co_consent and co_meter cookies are gone.
- 12 October 2026: first published version.
Each version is dated above; the current one is the date at the top of this page.