This Privacy Policy explains what personal data Covelant collects through the website www.covelant.com, the Covelant mobile app and the Covelant camera service, how we use it, who we share it with, and the rights you have under the GDPR and equivalent laws.

Covelant is operated by Covelant GmbH, Donaustraße 44, 12043 Berlin, Germany. If you have any questions about this Privacy Policy or how your data is handled, please contact us at info@covelant.com.

Last updated: October 2026.

1. Data We Collect on This Website

Visiting the website

This website is hosted by Framer. When you open a page, technical data such as your IP address, browser and device type, the page requested, the referring page and the time of the request is processed in order to deliver the website and keep it secure.

Website analytics

We use Framer’s built-in analytics to count page views and basic interactions in aggregated form. This website does not set cookies and does not store data in your browser for analytics or advertising purposes.

Contact form

If you send us a request through the contact form, we collect the information you enter: your name, your email address, your club name, the type of request (quote or demo) and your message. We use it only to answer your request and to prepare an offer if you ask for one.

Newsletter

If you subscribe to our newsletter, we collect your name and email address and use them to send you news about Covelant. You can unsubscribe at any time by contacting us at info@covelant.com.

Third-party content on this website

• Fonts are loaded from Google Fonts. Your browser connects to Google’s servers to fetch them, which transmits your IP address to Google.

• Some interface components load program code from third-party content delivery networks (for example esm.sh) and may contact their provider’s servers when a page loads.

• Instagram posts shown on this website are only loaded from Instagram (Meta Platforms) when you interact with them.

• Links to the Apple App Store, Google Play, LinkedIn and Instagram take you to services run by those companies. Their own privacy policies apply once you leave this website.

2. Data We Collect in the Covelant App

Account information

• First name and last name, provided when you complete your profile.

• Email address, obtained from Google when you sign in.

• Profile photo (avatar), if you choose to upload one. Avatars are stored in Firebase Storage.

• Profile attributes you choose to provide, such as preferred role (player or coach), dominant hand, height, age, and preferred language.

Match and performance data

• Match metadata you provide or generate in the app (match names, dates, set scores, tags, notes, player assignments, saved collections).

• Performance analytics derived from your match footage by Covelant’s AI (player positions, stroke detection, ball tracking, ball and player speed, rally statistics, automatically generated highlights).

• Aggregated player statistics (wins, losses, total matches, average match duration) stored on your account.

Identifiers

• An internal Covelant user ID assigned to your account.

• A Firebase Authentication user ID, used to sign you in and verify your identity.

• If you opt in to push notifications, a per-device push token issued by Apple or Google, which is registered with the Expo Push Notification Service so that we can route notifications to your device.

Diagnostics

• Crash reports, error logs, and performance traces collected by Sentry. These can include the technical context of an error (device model, OS version, app version, screen the user was on) and, where available, the identifier of the affected user so that we can investigate issues.

Usage analytics

• A defined set of in-app events describing how you use the app, for example opening a promotional campaign, tapping through to a linked Instagram profile, or sharing a match or highlight. Each event is recorded with your Covelant user ID and basic technical context (app version, device type, operating system).

• Responses you submit to in-app surveys and feedback messages you send us from the app, including any free text you write. These are recorded with your Covelant user ID.

• Automatic capture is disabled: only the specific events defined in our code are sent, never your keystrokes or recordings of your screen, and the contents of forms are sent only when you explicitly submit them. Usage analytics are processed by PostHog (see Section 5).

Camera discovery data (location)

The Covelant app connects you to Covelant cameras at your club based on your location. With your permission, the app reads your device’s location while you use the Cameras screen and sends those coordinates to the Covelant backend solely to determine whether you are at a club with Covelant cameras and to authorise the connection. Your coordinates are used only for this check. They are not stored, not used to track your movements, and never accessed in the background.

Bluetooth

The app requests Bluetooth access, which is used only to set up a Covelant camera’s Wi-Fi connection, a task performed by club administrators. This Bluetooth communication stays between the phone and the camera; no Bluetooth data is sent to Covelant’s servers.

Video footage

Match videos are recorded by Covelant cameras installed at your club. The mobile app does not upload video from your phone; the camera streams the footage directly to Covelant’s video infrastructure (Mux) and storage (Firebase). For more detail on the recording session itself and your responsibilities as the session initiator, please see the recording consent shown in the app before each recording session and our Terms of Service.

3. How We Use Your Data

Covelant uses your data to:

• Deliver this website, answer your enquiries and send the newsletter you subscribed to.

• Authenticate you and operate your account.

• Provide the core features of the app: match recording, performance analytics, highlights, clips, statistics, and sharing.

• Connect the app to Covelant cameras at your club and operate those cameras during a session.

• Deliver push notifications you have opted in to receive.

• Detect, diagnose, and fix bugs, and monitor the reliability and performance of the website, the app and our backend services.

• Understand how features are used, measure engagement, gauge the effectiveness of our promotional campaigns, and review survey responses and feedback you submit, so that we can improve the product.

• Train, validate, and improve Covelant’s AI and machine learning models, as described in the recording consent and the Terms of Service.

• Comply with our legal obligations.

Covelant does not sell your personal data and does not use it for third-party advertising. We do not share your data with data brokers or with advertising networks.

4. Legal Bases for Processing (GDPR)

We rely on the following legal bases under the GDPR:

• Performance of a contract, or steps taken at your request before entering into one: to provide the Covelant service you signed up for (account, matches, analytics, sharing) and to answer quote and demo requests.

• Consent: for the newsletter, for use of your game footage to train AI models, for push notifications, and for any optional features you turn on.

• Legitimate interest: to deliver this website securely, to maintain the security, reliability and performance of the service (crash and performance monitoring, fraud prevention), and to understand usage of the website and the product and the effectiveness of our features and campaigns.

• Legal obligation: where applicable, to comply with laws such as tax, accounting, or data-protection rules.

5. Who We Share Data With (Sub-Processors)

Covelant works with a small set of trusted third-party service providers (“sub-processors”) who process personal data on our behalf. Each operates under a data processing agreement with appropriate safeguards.

Framer (Framer B.V., Netherlands)

Used to host this website, to provide its analytics and to process submissions of the contact and newsletter forms.

Firebase (Google LLC)

Used for user authentication (Firebase Authentication) and for file and data storage (Firebase Storage). Firebase Storage is hosted on European servers, keeping your data within the European Economic Area. Data processed through Firebase is subject to Google’s Privacy Policy.

Amazon Web Services (Frankfurt, Germany)

Our primary application backend is hosted on AWS in the Frankfurt region. API requests, the application database, and server-side processing happen within the EU. AWS also runs the serverless functions that generate highlight videos. Data processed through AWS is subject to AWS’s Privacy Notice.

Mux (United States)

Used to livestream camera footage during recording sessions and to deliver final video assets, highlights, and clips within the app. Mux is US-based but is GDPR compliant and operates under a data processing agreement with appropriate safeguards.

RunPod (European servers)

Used to run Covelant’s AI model inference and training workloads (shot detection, player tracking, court keypoints, highlight generation). Game footage submitted for AI processing remains within the European Economic Area.

Sentry (Functional Software, Inc., United States)

Used to capture crash reports, error logs, and performance traces from the app and backend. Sentry helps us detect and fix bugs and monitor reliability. We do not use Sentry for product analytics or advertising.

PostHog (PostHog, Inc.)

Used for product analytics: recording the defined in-app usage events, survey responses, and feedback messages described in Section 2 so we can understand how the app is used and improve it. We use PostHog’s EU Cloud, so this analytics data is stored within the European Economic Area. Automatic capture is disabled, and we do not use PostHog for advertising or sell analytics data.

Expo Push Notification Service (Exponent, United States)

Used to deliver push notifications to your device. Your device push token is registered with Expo so that notifications can be routed to you. Push notifications are opt-in and can be turned off at any time in the app or in your device settings.

Theta Edgecloud (planned)

Covelant plans to migrate AI inference workloads from RunPod to Theta Edgecloud, a distributed edge cloud platform. When this migration is enabled, this Privacy Policy will be updated with full data residency and privacy details, and users will be notified of any material changes before the transition takes place.

6. International Transfers

Covelant prioritises EU-based infrastructure across all core services. Firebase storage, AWS hosting, RunPod AI processing, and PostHog product analytics all operate within the European Economic Area. Where any processing occurs outside the EEA (Mux for video streaming, Sentry for diagnostics, Expo for push notifications), Covelant relies on standard contractual clauses and other appropriate safeguards as required by the GDPR.

7. Data Retention

We retain your personal data only for as long as needed to provide the service or as required by applicable law. In practice this means:

• Enquiries sent through the contact form are kept for as long as needed to handle your request and any follow-up, and are then deleted unless the law requires us to keep them.

• Newsletter data is kept until you unsubscribe.

• Account data is kept while your account is active.

• Match recordings and derived analytics are retained for as long as your account is active, or until you delete them through the app.

• Crash and performance data collected by Sentry is retained in line with Sentry’s default retention (typically 30 to 90 days).

• Usage analytics events collected by PostHog are retained for as long as needed to analyse product usage, and are then deleted or anonymised.

• Push tokens are kept while push notifications are enabled and your device remains active. Tokens are deleted when you sign out or turn notifications off.

8. Deleting Your Account and Your Data

You can permanently delete your Covelant account at any time in the app under Settings, Account Details, Delete Account. If you cannot access the app, you can also request deletion of your account and your data by writing to info@covelant.com from the email address linked to your account.

When you confirm deletion, Covelant deletes your profile, your saved matches and collections, your push tokens, your consent record, and your Firebase Authentication user. Your appearances as a player in matches that were shared with other users are anonymised (your name and user reference are removed) so that the shared match history remains coherent for the other participants. Aggregated and fully anonymised statistics may be retained. Diagnostic logs that include your user identifier are kept for the standard Sentry retention window (typically 30 to 90 days) and then automatically expire.

9. Your Rights

Under the GDPR and equivalent laws, you have the right to:

• Access the personal data Covelant holds about you.

• Correct inaccurate or incomplete data.

• Delete your recordings, your account, or other personal data.

• Restrict or object to certain types of processing.

• Withdraw consent for processing based on consent (including the newsletter, AI model training and push notifications) at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

• Receive a portable copy of your data.

• Lodge a complaint with a supervisory authority in your country of residence.

To exercise any of these rights, contact Covelant at info@covelant.com.

10. Security

Covelant uses HTTPS/TLS for all data in transit between the website, the app, our backend, and our sub-processors. Authentication is handled by Firebase. Access to production data is limited to authorised Covelant personnel and audited. Sub-processors operate under data processing agreements with appropriate technical and organisational measures.

11. Children

Covelant is not directed to children under 16. If you believe a child has provided personal data to us, please contact us at info@covelant.com and we will delete the data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the service, our sub-processors, or applicable law. When we make material changes we will notify you in the app or by email. The latest version is always available on this page and in the app.

13. Contact

For questions about this Privacy Policy or your data:

Covelant GmbH | Donaustraße 44, 12043 Berlin, Germany | info@covelant.com

You may also contact your club management for any local data protection inquiries related to the use of Covelant at your club’s facilities.