This policy explains what information Coavon collects when you use coavon.com and the Coavon apps (Flow, Scope, Docs, Drive, Chat, Notes, Calendar and Workplace), what we do with it, and the choices you have. We have tried to write it plainly. If anything is unclear, write to hello@coavon.com.
The short version: we collect what is needed to run your account and the apps. We do not sell your information, we do not show ads, and measurement tools on this website run only if you accept them.
1. What we collect
Account details. Your name, email address and password when you sign up. Passwords are stored in scrambled form; we cannot read them. If you add a profile photo, we store that too.
What you put into Coavon. The tasks, projects, client records, documents, notes, files and messages that you and your team create. This belongs to you; see section 3.
Organization and billing details. Your organization's name, who its members are and their roles, the plan you are on and your billing history. Payment card details are entered with our payment provider, Stripe, and never reach our servers.
Technical information. Like every website, our hosting records basic details of each request, such as IP address, browser type and the time, to keep the service working and secure.
Error reports. If one of the apps or this website hits an error, it tells us what went wrong: the error message, where in our code it happened, which page you were on and your browser type. It does not include your name, your email address, your organization or anything you typed.
Sign-in history. Each time your account is signed in to, we record the time, the browser and type of device, the internet address (IP address) and the approximate place that address suggests, such as the city and country. This is a security record: you can see your own in Workplace, and on plans that include it the owners of an organization you belong to, and admins they allow, can see its members' sign-ins.
What you send us. If you email us, we keep the message so we can reply.
2. How we use it
To provide the apps: signing you in, saving your work and showing it to the people you share it with.
To send the emails the service needs: confirming your address, password resets, invitations, the notifications you have switched on, and billing notices.
To take payment and manage your subscription.
To keep Coavon secure, find and fix problems, and prevent abuse.
To answer you when you contact us.
We do not sell your information. We do not use what you put into Coavon for advertising, and we do not use it to train AI models.
3. Your content belongs to you
What you and your team create in Coavon is yours. We store it and show it back to you and the people you have chosen; that is all. Our staff do not look at your content except when you ask us for help, when it is needed to fix a fault, or when the law requires it.
Within an organization, who can see what is decided by that organization's owners and admins through roles and sharing. Notes are private to the person who wrote them. Channels in Chat can be read by every member of the organization; group chats and direct messages can be read only by the people in them.
4. Who we share it with
We use a small number of other companies to run Coavon. Each receives only what it needs for its job:
Supabase. Stores the database and handles sign-in.
Google. If you choose "Continue with Google", Google confirms who you are and gives us your name, email address and profile picture. We use them only to create your account and sign you in. Signing in does not give us access to your Gmail, Drive, Calendar or contacts.
Vercel. Hosts the website and the apps.
Cloudflare. Stores the files you upload to Drive and attach to tasks.
Stripe. Takes payment and stores your payment details. Coavon never sees or stores full card numbers.
Resend. Sends email, such as invitations, notifications and billing notices.
Anthropic. Answers questions asked of the AI assistant in Flow. Only used when someone uses the assistant.
Google Drive. Only if you choose "Add from Google Drive" in an app: Google's own file chooser opens and you allow Coavon to see the files you pick there, and no others. We keep each file's name, kind and Google link. The file stays with Google, which decides who can open it. So that you are not asked to sign in to Google every time, we keep Google's access key for that one permission, stored encrypted; it reaches only files you have picked. You can end it in Workplace under Settings, Integrations, or in your Google account.
Google Calendar. Only if you connect Google Calendar in your settings: Coavon makes one calendar of its own in each Google account you connect, called "Coavon Flow", and keeps your dated tasks, and the events you make or are invited to in Coavon Calendar, in it as events. That permission covers that calendar only; with it we cannot see or change your other calendars or events. Separately, and only if you choose "Show" beside a Google account in Coavon Calendar, you give a second, read-only permission so your own Google Calendar events appear in Coavon Calendar: we read the events in that account's main calendar for the days you are looking at, show them only to you, and do not store them or change them. We keep your Google address, that calendar's reference and Google's access key, which is stored encrypted and used only for these features. Disconnecting removes the calendar and the key, and you can withdraw either permission at any time in your Google account. We use this Google data only to provide these features to you, do not share or sell it, do not let people read it, and do not use it for advertising or to train AI models. Coavon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google Fonts. Supplies the icons in Docs, which means your browser contacts Google when Docs loads. This website does not use it.
Google Analytics. Measures visits to this website and whether a trial starts, only if you accept cookies.
Meta. Measures whether our ads on Facebook and Instagram lead to visits, sign-ups and trials, only if you accept cookies.
Ahrefs. Counts visits to this website and where they came from, only if you accept cookies. It sets no cookies of its own.
Trybe. Runs our creator program. If you arrive by a link from a creator's video and accept cookies, it remembers which video sent you and receives the pages you then open on this website, so the creator can be credited. If you later pay for a plan, it is told the amount and the date.
PromoteKit. Runs our partner program. If you arrive by a partner's link and accept cookies, it remembers which partner sent you, and it is told your email address if you then create an account, so the partner can be credited if you become a customer.
Beyond these, we share information only if the law requires it, or to protect the rights and safety of Coavon and the people who use it, or if Coavon is sold or merged, in which case this policy would continue to apply to your information until you are told otherwise.
AI tools you connect. Coavon lets you connect your own AI tools to your workspace. If you do, that tool can read and change your work with the access you give it, and its own privacy terms apply to what it does.
5. Cookies
Coavon's own cookies are these: one that keeps you signed in across the Coavon apps, one that remembers whether you chose the light or dark theme, and one that remembers your answer to the cookie notice. If you open one of our offer pages, a cookie also notes which offer you saw, for a week, so the right price is shown when you sign up. None of them follows you to other websites. The apps also remember settings, such as the last view you used, in your browser.
Measurement cookies, only with your OK. On this website we use Google Analytics, the Meta pixel and Ahrefs Web Analytics to see how people find Coavon and whether our advertising works. These are off until you accept them in the cookie notice. If you accept, Google and Meta set their own cookies and receive the pages you view on this website, the fact that you asked for a sign-up code, and technical details such as your IP address and browser. Inside the apps, three moments are reported if you accepted: when your new workspace is created, when you go to checkout after choosing a plan, and when a paid plan starts, so we can tell which ads lead to sign-ups and customers. Nothing else you do in the apps is reported. We never send them your name, your email address or anything you put into the apps. Meta may use this to show our ads to you or to people like you. Ahrefs sets no cookies and is told only which pages of this website were viewed, where the visit came from, and technical details such as your browser and country.
Creator links, only with your OK. Some creators make videos about Coavon and are paid when a viewer becomes a customer. If you accept cookies, a cookie from Trybe gives your browser a random number and Trybe receives the address you arrived by, the pages you open on this website and technical details such as your IP address and browser. It reaches Trybe through track.coavon.com, an address of ours that points to Trybe. If you arrived by a creator's link and later pay for a plan, Coavon tells Trybe the amount, the date and the payment's reference number, with that random number, so the creator can be paid. Trybe is not given your name or your email address.
Partner links, only with your OK. Some people recommend Coavon and are paid if someone they refer becomes a customer. If you arrive by one of their links and accept cookies, a cookie from PromoteKit remembers which partner sent you until it expires or you change your answer. Partners see that a referral signed up and what it earned them; they are not shown your name, your email address or anything you put into Coavon.
Our own count of visits, only with your OK. If you accept, Coavon also keeps its own record of visits to this website, in its own database and shared with nobody: the pages viewed and for how long, the website a visit came from, any campaign tag on the link, and the country, state or region and city, type of device and browser. It uses no cookie and does not keep your IP address. If a visit ends with a new account, the account is noted against that visit, so we can tell which pages and sources lead to trials. Visits are deleted after 400 days.
You can change your answer at any time: . If your browser sends the Global Privacy Control signal, we treat that as a no.
6. How long we keep it
We keep your information for as long as your account or organization exists.
When an organization or an account is deleted, its data is hidden straight away and kept for 30 days in case the deletion was a mistake. After that it is removed for good.
Earlier versions of documents and notes are kept for the length of time your plan includes.
Files and notes you put in the trash stay there until they are restored or permanently deleted.
Billing records are kept for as long as tax and accounting rules require.
7. Your choices and rights
See and correct. You can see and change your profile in Workplace, and your content in each app.
Export. You can download your files from Drive, download documents from Docs, and export records from Scope.
Delete. You can delete your account, and an owner can delete an organization, from settings in Workplace.
Notifications. You can choose which notification emails you receive in each app's settings.
Depending on where you live, the law may give you further rights, such as asking for a copy of your information, asking us to delete it or objecting to how it is used. To use any of these, write to hello@coavon.com and we will respond.
If your account belongs to an organization, such as your employer, that organization controls the content in it. For requests about that content, please speak to the organization's owner first.
8. Security
Information is encrypted on its way between your browser and Coavon. Access to an organization's data is limited to its members, and roles limit what each member can do; these rules are enforced by the system itself, not only by what the screens show. No service can promise perfect security, but if we learn of a breach affecting your information we will tell you.
9. Where your information is held
Coavon and the companies listed in section 4 operate in the United States and other countries, so your information may be stored and handled outside the country you live in.
10. Children
Coavon is a tool for work and is not meant for children. We do not knowingly collect information from children. If you believe a child has given us information, write to hello@coavon.com and we will remove it.
11. Changes to this policy
If we change this policy we will update the date at the top. If a change is significant, we will tell you by email or in the apps before it takes effect.
We use cookies to enhance your browsing experience, serve personalised ads or content, analyse our traffic and credit partners who refer you. By clicking "Accept All", you consent to our use of cookies. Privacy
