KovaKovaPrivacy Policy
Kova runs on a gateway you choose — local, self-hosted, or wherever you point it. We do not run a central cloud that aggregates your conversations, we do not show ads, and the desktop builds do not include analytics or crash-reporting SDKs. Where a feature needs data, it's because you turned that feature on.
This policy covers the Kova desktop app, CLI, the Kova gateway, and the kova-agent.com website. It does not cover the privacy practices of any AI model provider, messaging platform, or third-party service you choose to connect to through Kova — those are governed by their own policies.
Kova runs on a gateway you configure. The gateway is the only system that sees your conversations, files, and commands by default. It can be local, on your tailnet, self-hosted on a $5 VPS, or operated by someone you trust.
When you connect a messaging channel (Telegram, Discord, Slack, etc.) or an AI provider (OpenAI, Anthropic, Google, etc.), Kova exchanges the minimum data needed to deliver the message and produce a reply. The receiving service handles that data under its own terms and privacy policy.
The desktop app stores connection secrets (gateway tokens, channel tokens, provider keys) in platform-encrypted storage. On macOS that is the Keychain; on Windows, credential manager; on Linux, the secret service. Settings, memories, and skill artifacts are stored in app-private directories.
Temporary files may be written to the app cache while a feature runs (for example media output, update packages, or debug artifacts) and are removed when no longer needed.
Kova only requests operating-system permissions it needs and only when the related feature is enabled. Examples: microphone and speech recognition for voice mode; camera for snapshots; location for location-aware tasks; notification access on macOS to read or surface notifications; accessibility on macOS for input automation. Revoke any permission in system settings at any time.
The kova-agent.com website does not run third-party analytics scripts and does not set tracking cookies. The site is static and is served by a CDN. Standard CDN access logs (request path, status, IP) are retained for a short period for abuse protection and capacity planning.
The desktop app checks for gateway and skill updates over an HTTPS endpoint you can configure or disable. Update checks send the current app version, the platform, and the gateway version. They do not send message content or your data.
Kova is not directed at children. You must meet the minimum age of digital consent in your country to use it.
We may update this policy. If we do, the effective date above changes and the diff is published alongside the source. For privacy or security questions, email [email protected].