1. Introduction
This Cookie Policy explains how Cove ("Company", "we", "us", or "our") uses cookies and similar technologies on our website at joincove.io and our application at app.joincove.io (the "Service"). This policy should be read alongside our Privacy Policy.
2. What Are Cookies
Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners.
Similar technologies include local storage, session storage, and pixel tags, which function in comparable ways.
3. Cookies We Use
We use cookies and similar storage of three kinds: strictly necessary and preference cookies, which are always active; statistics cookies, which are set only if you consent to them — PostHog (Section 3.2) and Google Analytics (Section 3.3); and marketing cookies, which are set only if you consent to them — Google's advertising for Cove (Section 3.4) — on our website and in our application alike. Separately, our application's servers send PostHog a few records that involve no cookie or other storage on your device (Section 3.5).
Consent on our website and in our application is collected through our own cookie banner. It asks about two categories — "Statistics", the cookies described in Sections 3.2 and 3.3, and "Marketing", the cookies described in Section 3.4 — each switched off until you switch it on, with "Reject all", "Accept all" and "Save my choice" offered side by side. One answer covers both: it is kept in the cove_consent cookie on the domain our website and our application share (for example joincove.io), so you are not asked twice. You can change or withdraw your choice at any time — see Section 5.
Each time you answer the banner, we keep a record of that answer: the random consent ID stored in the cove_consent cookie, whether you accepted or rejected each category, the version of the banner, the site you answered on, its language and the time. The record holds no IP address and nothing else about your device. It is kept in our database for three years, so that we can show that consent was given (Art. 7(1) GDPR). Legal basis: our legal obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR).
3.1 Strictly Necessary and Preference Cookies
These cookies and local-storage entries keep the Service working or remember a choice you made. They cannot be disabled without affecting core functionality. No consent is required for strictly necessary cookies under the EU ePrivacy Directive.
On our website (joincove.io):
| Cookie Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| cove_country | Cove | Remembers your country, so the site describes what the Service offers there. Set on your first visit from the country your IP address points to (Vercel geolocation), or when you choose a country in the footer | HTTP | 1 year |
| theme | Cove (next-themes) | Remembers whether you chose the light or the dark theme | Local storage | Until you clear it |
| cove_consent | Cove | Stores your answers to the cookie banner (statistics and marketing cookies, each accepted or rejected), when you gave them and a random consent ID, so we can honour them on our website and in our application and show that they were given | HTTP | 1 year |
| cove_signed_in | Cove | Tells our website that you are signed in to our application, so its menu bar shows your account instead of the sign-in buttons. It holds nothing about you, only the value 1; your name, email address and photo are read from the application while you browse and are not stored. Set by our application on the domain the two share | HTTP (SameSite=Lax) | 400 days, removed when you sign out |
In our application (app.joincove.io):
| Cookie Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| sb-*-auth-token | Supabase | Keeps you signed in: holds the access and refresh tokens of your session | HTTP (SameSite=Lax) | 400 days |
| sb-*-auth-token-code-verifier | Supabase | One-time code that completes a sign-in with Google or Apple; removed once the sign-in completes | HTTP (SameSite=Lax) | Until the sign-in completes |
| cove_active_workspace_id | Cove | Remembers which company (workspace) you are working in | HTTP (SameSite=Lax) | 1 year |
| cove_mfa_verified | Cove | Signed proof that you have just completed two-factor authentication with an email code; required before the device can be trusted | HTTP (HttpOnly, Secure, SameSite=Lax) | 10 minutes |
| cove_mfa_trusted | Cove | Signed trusted-device token for two-factor authentication. Allows you to skip the second factor on a device you chose to trust | HTTP (HttpOnly, Secure, SameSite=Lax) | 24 hours, or 90 days if you choose to remember the device |
| NEXT_LOCALE | Cove (next-intl) | Remembers the language of the application | HTTP (SameSite=Lax) | 1 year |
| sidebar_state | Cove | Remembers whether the sidebar is expanded or collapsed | HTTP | 7 days |
| theme | Cove (next-themes) | Remembers whether you chose the light or the dark theme | Local storage | Until you clear it |
| cove_consent | Cove | The same cookie as on our website: one answer to the cookie banner covers both | HTTP (SameSite=Lax) | 1 year |
| cove_signed_in | Cove | The same cookie as on our website: set once you open the application signed in, so our website can show your account | HTTP (SameSite=Lax) | 400 days, removed when you sign out |
The application also keeps interface preferences and drafts, such as table views, the order of dashboard cards and the width of the sidebar, in your browser's local storage on your device.
3.2 PostHog on Our Website and in Our Application (Consent Required)
These cookies help us understand how our website and our application are found and used — which pages are visited, which features are used, and where people run into problems — so that we can improve them. They are set only if you accept the "Statistics" category in the cookie banner. If you decline, they are not set, and PostHog collects nothing in your browser.
| Cookie Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| ph_*_posthog | PostHog | Analytics identifier and session state. Used to recognise a returning visit and to link the pages of a single visit together | HTTP and local storage | 1 year |
| __ph_opt_in_out_* | PostHog | Records whether you have opted in to or out of analytics capture | HTTP and local storage | 1 year |
If you accept this category, we collect:
- Product analytics: pages viewed, clicks and other interface interactions, the site that referred you, and your browser, operating system, device type and approximate location
- Session replay: a reconstruction of your visit — pages, cursor movement, clicks and scrolling — used to diagnose usability problems. Text you type into form fields is masked, and the account the menu bar shows while you are signed in to our application is left out
- Console and performance data: browser error messages and page loading timings, captured alongside session replay so that we can reproduce faults
- Web vitals and heatmaps: aggregate page performance measurements and click-density maps
In the application, PostHog receives less, because the application shows information about other people — your clients, suppliers and employees. Session replay masks all text and blocks all images on the screen: it shows the layout and where you point and click, not what is written there. A click is recorded without the text or attributes of the element clicked; a link keeps only its cleaned address. Browser console messages are not recorded. Page addresses are reduced as they are for Google Analytics (Section 3.3), the page title sent is the generic route, and addresses of requests recorded with a replay lose their query. Once you sign in, these analytics are linked to your user ID and email address.
Your IP address is anonymised before it is stored, and it is used only to derive an approximate location (country/region level). Analytics data is processed on PostHog's EU infrastructure and is retained for 12 months; session replays are retained for 30 days.
Legal basis: your consent (Art. 6(1)(a) GDPR and the EU ePrivacy Directive). Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
3.3 Google Analytics on Our Website and in Our Application (Consent Required)
We use Google Analytics 4, run through Google Tag Manager, to measure how Cove is found and used — which pages are visited, where visitors come from, and how a visit to our website leads to an account in our application. It runs only if you accept the "Statistics" category in the cookie banner.
We use Google Consent Mode v2 in its basic form. Google Tag Manager's script is requested from Google (googletagmanager.com) at the top of each page, so that your answer applies from the first moment the page loads — except when you have rejected both categories, in which case it is not loaded at all. Like the download of any file, that request carries your IP address and your browser's details; the script sets no cookie, stores nothing on your device and, until you accept a category, runs no Google tag and sends Google nothing about your visit — not even your consent state. Legal basis for that request: our legitimate interest in applying your choice to Google's tags as soon as each page opens (Art. 6(1)(f) GDPR). Your answer is passed to Google as four consent signals: "Statistics" as analytics_storage, "Marketing" as ad_storage, ad_user_data and ad_personalization; everything you have not accepted stays denied.
| Cookie Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| _ga | Analytics identifier: a randomly generated number that distinguishes one browser from another | HTTP | 2 years | |
| _ga_* | Keeps the state of the current visit (session) | HTTP | 2 years | |
| cove_conversion | Cove | Carries the fact that you have just created an account — by signing in with Google or Apple, or by accepting an invitation — to the next page of the application, which reports it to Google Analytics and deletes the cookie. Set only if you have accepted this category | HTTP | 10 minutes |
| cove:purchases-reported | Cove | Remembers which completed checkouts this browser has already reported, so that one purchase is never counted twice | Local storage | Until cleared (the last 20 checkouts) |
These cookies are set on our own domain (for example .joincove.io), so the same identifier is used on our website and in our application.
If you accept this category, Google Analytics receives the pages you view, the page or site that referred you and the campaign parameters of the link you arrived by; your browser, operating system, device type, screen size and language; an approximate location (country, region, city) derived from your IP address, which Google Analytics does not log or store; and events such as scrolling and the time spent on a page. It also receives a few events about steps you complete: starting to fill in the sign-up form, creating an account (and whether with e-mail, Google or Apple), confirming your e-mail address, sending our contact form (only the topic you chose), and starting and completing a checkout (the plan, its billing period, the price, tax and currency, and our payment provider's order number). These events never contain your name, e-mail address, phone number, message, password, payment details or any code or token. Once you are signed in to our application, Google Analytics also receives your user ID — the random identifier of your Cove account, never your name or e-mail address — on our website and in the application alike, so that your visits from different devices are counted as one person's; once you sign out, it is no longer sent. In the application, page addresses are reduced before they are sent: record identifiers are replaced by a placeholder, only the open tab or view is kept from the address, and the page title sent is the generic route (for example "/clients/[id]") rather than the title on screen — so the names of your clients, employees and documents never reach Google. Google Analytics is never loaded on pages whose address itself grants access (payment pages, shared links, invitations, password reset) or on print and PDF pages.
Google Analytics' advertising features — Google signals and the link to our Google Ads account — apply to your visits only if you also accept the "Marketing" category (Section 3.4). With "Statistics" alone your visits are measured, but the advertising signals are denied and Google signals and ads personalisation are switched off for you, so the data is not used for advertising. Google Analytics data is retained for 14 months.
Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as our processor. Data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Legal basis: your consent (Art. 6(1)(a) GDPR and the EU ePrivacy Directive). Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
3.4 Marketing: Google's Advertising for Cove (Consent Required)
We advertise Cove with Google Ads, and our Google Analytics property is linked to our Google Ads account. If you accept the "Marketing" category in the cookie banner, we tell Google — through the ad_storage, ad_user_data and ad_personalization signals of Google Consent Mode — that the data of your visits to our website and our application may be used for Cove's advertising:
- Measuring our ads: which of our Google Ads campaigns lead to visits, sign-ups and purchases. The events listed in Section 3.3 are shared with our Google Ads account as conversions
- Matching our forms to our ads: when you fill in a form on our website — the contact form or the partner program application — Google's advertising tag reads the email address you type into it (and a phone number or postal address, if it recognises one) as soon as you start filling the form in, before you send it, and sends Google a one-way hash (SHA-256) of it, made in your browser; the address itself is not sent. Google compares the hash with the details of its own users to tell whether your visit or enquiry came from one of our ads (Google calls this enhanced conversions). This happens only on our website: in our application, Google's advertising tag is not loaded
- Remarketing: your browser may be included in audiences for Cove's own ads on Google and on websites that show Google ads
- Google signals: if you are signed in to a Google account for which you have allowed ads personalisation, Google may associate your visits with that account, to measure our ads across your devices and to personalise the ads it shows you
| Cookie Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| _gcl_au | Links your visits to our ads, so that a sign-up or purchase can be attributed to the ad that led to it | HTTP | 90 days | |
| _gcl_aw, _gcl_gb, _gcl_* | Stores the identifier of the Google ad click you arrived from, when you arrive from one | HTTP | 90 days |
These cookies are set on our own domain (for example .joincove.io). For remarketing and Google signals, Google also uses its own cookies on its own domains (such as google.com and doubleclick.net), under its own policies (policies.google.com/technologies/partner-sites). Your user ID and the cleaned page addresses described in Section 3.3 are the same with this category; apart from the hashed contact details from our forms described above, nothing else about you is added. In our application, whose pages name your clients and employees, Google's advertising tag is not loaded at all: there, the data of your visits reaches Google Ads only through Google Analytics, with the cleaned page addresses and titles described in Section 3.3.
For conversion measurement and remarketing, Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms; Google Ireland Limited is responsible for users in the EEA. If you decline this category, or withdraw it, the advertising signals stay denied, Google does not use your visits for advertising, and the Google advertising cookies on our domain are deleted.
Legal basis: your consent (Art. 6(1)(a) GDPR and the EU ePrivacy Directive). Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
3.5 Records from Our Application's Servers (No Cookies)
Some records reach PostHog from our application's servers rather than from your browser, so they involve no cookie or other storage on your device: the application's technical logs; a few events about actions in the Service — signing in with Google, sending an invoice, completing an import, generating an HR document, extracting a document with AI, starting a checkout, and changes to your subscription reported by our payment provider; and the checks of which features still in development your account can see, for which your email address is used. They are linked to your user ID and email address and processed on PostHog's EU infrastructure.
Legal basis: our legitimate interest in operating, securing and improving the Service (Art. 6(1)(f) GDPR). You can object to this processing at any time under Art. 21 GDPR by contacting us (Section 9).
3.6 Cookies We Do Not Use
For transparency, we want to confirm that we do not use:
- Facebook Pixel, or any advertising cookies other than Google's described in Section 3.4
- Any remarketing or cross-site tracking other than Google's described in Section 3.4, which applies only with your consent
- Any cookies for behavioral profiling or targeted advertising other than those of Section 3.4
- Any social media cookies (like buttons, share widgets)
4. Third-Party Cookies
All of the cookies listed in Section 3 are set on our own domains (joincove.io and app.joincove.io). PostHog's analytics requests from your browser are routed through our own servers rather than sent directly to an external analytics domain. Google Tag Manager's script is requested directly from Google (googletagmanager.com), as described in Section 3.3; Google Analytics requests, once you have consented to them, go directly from your browser to Google (google-analytics.com), and with "Marketing" also to Google's advertising domains (such as google.com and doubleclick.net). The data those cookies collect is nevertheless processed on our behalf by the providers named above, which act as our processors under written agreements and are listed on our Sub-processors page — except Google's use for advertising under Section 3.4, for which Google is an independent controller.
When you sign in with Google or Apple, those services may set their own cookies on their domains during the sign-in process. Those cookies are governed by the respective third party's cookie policy:
- Google: policies.google.com/technologies/cookies
- Apple: www.apple.com/legal/privacy/en-ww/cookies/
5. Managing Cookies
5.1 Changing or Withdrawing Your Consent
You can change or withdraw your consent for statistics and marketing cookies, each on its own, at any time: on our website through the Cookie settings link in the footer, and in our application through Cookie settings in the account menu (or below the sign-in form). Each reopens the consent banner, and because our website and our application read the same answer, a change made in one applies in the other. Withdrawal takes effect immediately: it stops any further collection that depends on that consent, and the Google Analytics cookies (for "Statistics") or the Google advertising cookies on our domain (for "Marketing") are deleted. It is as easy to withdraw consent as it was to give it.
5.2 Browser Controls
Strictly necessary cookies cannot be disabled without breaking the Service: blocking them would prevent you from logging in or maintaining a session. Blocking statistics or marketing cookies has no effect on functionality.
You can also manage cookies through your browser settings:
- Chrome: Settings > Privacy and Security > Cookies
- Firefox: Settings > Privacy & Security > Cookies and Site Data
- Safari: Preferences > Privacy > Cookies and Website Data
- Edge: Settings > Privacy, Search and Services > Cookies
Please note that blocking strictly necessary cookies will prevent you from using the Service.
6. Do Not Track
Some browsers offer a "Do Not Track" (DNT) signal. We do not build behavioural profiles ourselves, and Google's advertising across websites (Section 3.4) applies only if you accept "Marketing". Statistics and marketing cookies, on our website and in our application, are set only after you give consent through the cookie banner, so that banner — not DNT — is the mechanism by which we take your choice into account. The records our application's servers send are described in Section 3.5.
7. Introducing New Cookies
If we introduce further non-essential cookies in the future, we will:
- Update this Cookie Policy before deploying them
- Request your consent before setting them, through the existing consent mechanism
- Keep granular, per-category control available
- Ensure "Reject all" is as accessible as "Accept all"
8. Changes to This Policy
We may update this Cookie Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. If we introduce further non-essential cookies, we will provide advance notice as described in Section 7.
9. Contact Us
If you have questions about our use of cookies, please contact us at:
- Email: support@covesoft.bg
- Support: support@covesoft.bg