Cove Privacy Policy

Last updated: 5 July 2026

Effective for: Cove browser extension, published by Concise Cube Global Wellness Private Limited

This Privacy Policy explains how Cove by CatalystCare ("Cove," "we," "us") collects, uses, stores, and shares information when you install and use the Cove browser extension. Cove is operated by Concise Cube Global Wellness Private Limited, the legal entity behind the CatalystCare platform (catalystcare.in).

This policy applies specifically to the Cove browser extension. Our website privacy practices are covered separately at catalystcare.in/legal/privacy-policy.

1. What Cove Does

Cove's single purpose is to provide an in-browser wellness companion for individual users. It offers a private space to express feelings (Vent Box), short guided meditations, a focus/deep-work timer, mood check-ins, and one-tap access to book a session with a CatalystCare wellness practitioner. Every data practice described below exists to support one of these features -Cove does not collect data unrelated to them.

2. Information We Collect, and Why

Category	What we collect	Why we collect it
Account information	Name, email address, phone number	To create and secure your account, and to identify you across the extension and the CatalystCare platform
Vent Box entries	Text you type into the Vent Box, and the AI companion's responses to it	To generate a supportive, context-aware response and to let you revisit past entries for continuity
Mood check-in data	Self-reported mood/energy selections and their timestamps	To personalise nudges and show you your own mood patterns over time
Focus & meditation usage	Session start/end times, session type, completion status	To run the Pomodoro/focus timer and track your meditation streaks
Session booking details	Practitioner selected, appointment time, and the information you choose to share with that practitioner	To schedule and confirm your session
Payment information	Subscription tier and payment status (card/UPI details are collected directly by our payment processors, never by Cove)	To manage your subscription and access to paid features
Device & technical data	Browser type, extension version, error logs	To keep Cove secure, diagnose bugs, and maintain reliability

Cove does not collect your general web browsing history, the content of other websites you visit, or your search activity. Cove only accesses data you actively provide within the extension's own interface.

3. How We Use Your Information

To provide and operate the features listed above
To personalise your experience (e.g., mood trends, streaks)
To process payments and manage subscriptions
To connect you with a practitioner when you book a session
To maintain security, prevent abuse, and fix bugs
To comply with legal obligations

We do not use your data for personalised advertising, and we do not sell your data to advertisers, data brokers, or information resellers.

4. Who We Share Your Information With

We share information only where necessary to provide Cove's features, and never for advertising. The parties are:

a. AI processing of Vent Box entries

Vent Box conversations are processed primarily by our own self-hosted AI model (Ollama), running on our own infrastructure. If our self-hosted model is unavailable, the request automatically falls back to Google's Gemini API, meaning that specific entry is transmitted to Google for processing. Google acts as a data processor in this scenario and does not use this content for advertising or to train its own models on our traffic (per Google's API terms). We do not control how often the fallback triggers, so any Vent Box entry may, on occasion, be processed outside our own infrastructure via Gemini.

b. Payment processors

Razorpay and Instamojo process your subscription payments. We share the minimum information needed (name, email/phone, amount) to complete the transaction. We never see or store your full card, UPI, or bank details -these go directly to the processor.

c. Practitioners

When you book a session, the practitioner you select receives your name, contact details, and appointment time so they can conduct the session.

d. Infrastructure

Cove's backend runs on our own Docker-managed servers with a PostgreSQL database, hosted on Hostinger VPS infrastructure located in India. Because these servers are within India, no cross-border transfer occurs for data stored here. The one exception is the Gemini fallback described above (section 4a), where a Vent Box entry may be transmitted to Google's servers, which may be located outside India.

e. Legal and safety

We may disclose information if required by law, court order, or government request, or where necessary to protect the safety of a user or others (for example, credible indication of risk of harm).

f. Business transfers

If CatalystCare is involved in a merger, acquisition, or asset sale, user data may be transferred as part of that transaction, subject to this policy.

5. Data Storage, Security & Retention

Data is transmitted using industry-standard encryption (HTTPS/TLS) and stored on access-controlled servers.
We retain your account and usage data for as long as your account remains active.
If you delete your account, we delete or anonymise your personal data within 30 days, except where we're required to retain it for legal, tax, or dispute-resolution purposes.
Vent Box entries are retained only to support continuity of your own experience and are never shared with practitioners unless you choose to share them yourself.

6. Cookies & Tracking

The Cove browser extension does not use cookies, third-party analytics SDKs, or crash-reporting tools. (Our website, catalystcare.in, does use Google Tag Manager -this is covered in the separate website privacy policy, not here.)

7. Children's Data

Cove is not directed at children under 18. We do not knowingly collect data from anyone under 18. If we learn that we have inadvertently collected such data, we will delete it.

8. Your Rights

Consistent with India's Digital Personal Data Protection Act, 2023, you have the right to:

Access a summary of the personal data we hold about you
Correct or update inaccurate or outdated data
Erase your data (subject to legal retention requirements)
Withdraw consent at any time -this doesn't affect processing already carried out
Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
Raise a grievance regarding how we've handled your data

To exercise any of these rights, contact us at the details below. We aim to acknowledge requests promptly and resolve grievances within 90 days.

9. Changes to This Policy

If we introduce a new data practice -for example, a new AI provider, a new payment processor, or a new type of data collection -we will update this policy and, where the change is material, notify you within the extension before it takes effect.

10. Grievance Officer & Contact

For any questions, requests, or grievances regarding this policy or your data, contact:

Concise Cube Global Wellness Private Limited
Jurisdiction: Pune, Maharashtra, India
Email: techadmin@catalystcare.in