This policy is published by Cover Redact LLC. In this policy, "we", "us", and "our" mean Cover Redact LLC, the company that makes Cover, and "the app" means the Cover software running on your Mac. The short version: the app processes your documents on your device, and their PII contents are not transmitted to us. This page covers what the current version of the app and this website actually do.
Your documents
Two different things happen with a document, and this policy keeps them separate.
First, the app. Cover's redaction engine opens and processes your document on your Mac, the same way any local application processes a file you give it. That processing happens on your device, under your control, and works with no network connection.
Second, us. The current version of Cover does not transmit your documents or their PII contents to us or to any third party. We do not receive them, and we do not collect, store, sell, or share the PII inside them: the names, numbers, addresses, and other identifying details that Cover is built to find.
There is no setting, no program, and no opt-in in Cover that shares document data with us. The contents of your documents are not collected.
The app today
Everything the current version of Cover does to a document happens on your device. The redaction engine runs locally as a bundled part of the app. Your documents, and every value redacted out of them, stay on your Mac.
The current version has no accounts and no sign-in. It does send one small set of events: a random identifier for the installed copy of Cover, and five moments about getting set up and buying a license. That is described in full below, under "Install and purchase events", and you can switch it off in Settings. It carries nothing from your documents.
If Cover crashes, it sends us a crash report so we can find and fix the bug. It contains the app version, the macOS version, your Mac’s model and processor type, and the code path that failed. It does not contain your documents, their contents, your file names, or anything you typed. You can turn crash reports off in Settings.
What the app talks to the network for
The current version of the app contacts the network for three things. None of them carries document data.
Update checks. The app contacts download.coverredact.com to ask whether a newer version exists, and, if you choose to install it, to download that update. You can turn automatic checks off in Settings.
Crash reports. If the app crashes, it sends an anonymous technical report to crash.coverredact.com describing where the code failed, so we can fix it. It does not include your documents or anything from them, and you can turn it off in Settings.
Install and purchase events. On first launch Cover creates a random identifier for your installed copy of the app. It uses that identifier to report five events to api.coverredact.com: that Cover was installed, that a trial started, that the purchase screen was shown, that a plan on that screen was clicked, and that a license key was activated. This is tied to your individual install, and it is described here exactly rather than called anonymous: the identifier is persistent, and it is attached to your order when you buy, so a purchase can be traced back to the install that made it.
Each event carries six values and nothing else: the install identifier, which of the five events it is, the campaign the download came from, which variant of the purchase screen was shown, the app version, and, on the two events about buying, whether the plan was the Personal or the Business one. The campaign is a short label naming the ad or link a download came from. It is stamped on the copy of Cover you downloaded rather than worked out from anything on your Mac, and a download that came from no campaign reports the word "unknown".
None of those six values comes from your documents. No contents, no file names, no page counts, no names or numbers Cover found, no count of what it redacted.
How long we keep it. We keep these events only for as long as they are useful for measuring how people find and buy Cover, and delete them after that. We do not keep them indefinitely.
Turning it off. The switch is in Cover, under Settings in the Privacy pane: "Send install and purchase events". It is on by default, the same as crash reports. With it off, the app sends no events at all and attaches no identifier to a purchase.
These events are being sent now. Which of the five you generate depends on what you do: installing the app reports the install, starting the trial reports the trial, and the three about buying only happen if you open the purchase screen.
The email gate on this website. The same measurement has a second half that does not involve the app at all. When you enter your email address on this site, either to start the trial download or to go to checkout, the website also sends our server a keyed hash of that address (HMAC-SHA256 under a secret key) along with the campaign you arrived from. The server stores the hash and the campaign, and not the address. When an order comes in, the address on it is hashed the same way and matched against the stored hashes, which is how a purchase gets credited to the ad that brought it. Those rows are kept and deleted on the same basis. Your actual address sits with our email provider, named under "Service providers" below, and not in that table.
That is the whole list for the current version, and none of these calls carry your documents or their contents.
If you would rather the app not reach out at all, keep the Mac offline: redaction itself works fully offline.
The website and your email
To start the trial or to buy, you enter your email address. We use it to send your download link or your license key, plus getting-started tips, and to keep you posted about Cover: new versions, launch news, and things we think are genuinely worth your time. Every message has a working unsubscribe link, and unsubscribing sticks. We do not sell or rent your email address, and we do not share it with advertisers.
We also store a keyed hash of your address, described in "The email gate on this website" above, so that a purchase can be credited to the campaign that brought you here. The hash is not the address, and without the secret key it cannot be matched back to one.
Once you have entered your address, your browser keeps a copy of it, on your own computer, so the other forms on this site arrive already filled in and you do not have to type it again. It sits in this site's local storage for 180 days, it is not read by anything except those forms, and clearing your browser's site data for coverredact.com removes it.
The website's own analytics are privacy-respecting and cookieless. They count page views and a short list of named actions — a button clicked, a form submitted, a purchase completed — so we can see which parts of the site work. They record the action, never who took it. No cross-site tracking, no advertising pixels, no personal profile built about you from your browsing.
When we are trying out two versions of a page, your browser stores which version it showed you, so that you keep seeing the same one instead of the page changing under you. It is a single short word in this site's local storage, it names a version of a page rather than anything about you, it is never sent anywhere except alongside the counts above, and clearing your browser's site data for coverredact.com removes it.
Service providers
Like nearly every small company, we rely on a few service providers to run the business. Today that means an email provider (Loops) to deliver the messages above, a payment provider (Stripe) to take payment and send your receipt, and hosting and download infrastructure (Cloudflare) to serve this site and the app. Providers like these process only what they need to do their job, such as your email address or standard server logs. None of them handle the contents of your documents, because the current version of Cover does not transmit those contents to us or to them.
Changes to this policy
This page describes what the current version of Cover and this website do. It carries a "last updated" date, and the version published here is the one in force.
Contact
Questions about privacy? Reach us through the help page. We read every message.