Privacy Policy

This policy explains what personal data Covey collects, why, how we look after it, and the rights you have. Covey is a directory that helps parents find children's clubs, classes and activities.

Who we are

Covey is operated by MyCovey Ltd ("we", "us"), a company registered in England & Wales (company no. 17269187), registered office 3 Ashmead Street, Aylesbury HP18 0HN. We are the data controller for the personal data described here.

For any privacy question, or to exercise your rights, contact privacy@mycovey.com. We are registered with the UK Information Commissioner's Office (ICO), registration number [ICO registration number].

What data we collect, and why

Parent / account data — your name, email address, and postcode. We use these to create and run your account, show you activities near you, and pass on the enquiries you send. Lawful basis: performance of our contract with you, and our legitimate interest in operating the service.

Children's data — for each child you add, their first name, date of birth or age, and optionally their school and interests. We collect this only because you choose to add it, to power age-appropriate suggestions and your family schedule. When you add a child you confirm you are their parent or guardian. Lawful basis: your consent, which you can withdraw at any time by removing the child or deleting your account.

Activity data — clubs you save, enquiries you send to clubs, reviews you write, and how you use the app. Lawful basis: our legitimate interest in providing and improving the service, and — for enquiries — performance of our contract.

Operator data — if you run a club, your contact details and any accreditation or DBS documents you upload (see special category data below).

Marketing preference — if you opt in, we use your email to send occasional Covey updates. Lawful basis: consent. You can opt out at any time.

Special category data (DBS certificates)

If an operator uploads a DBS certificate, this is criminal-records information and receives extra protection under UK data protection law. We process it only to help verify a listing, retain it for a maximum of 12 months (operators are notified 30 days before deletion), and strictly limit who can access it.

Children's data

Covey is a service for parents and other adults, not for children — children do not have accounts. We hold only the minimal children's data a parent chooses to add (first name and age), and we handle it in line with the ICO's Age Appropriate Design Code. You can view, correct or delete your children's data at any time.

Cookies

We use only strictly-necessary cookies and privacy-friendly, cookieless analytics, so there is no cookie consent banner. See our Cookie Policy.

Who we share data with

We do not sell your data. We use trusted service providers that process data on our behalf under contract: hosting (Vercel), database and file storage (Supabase, hosted in London), transactional email (Resend), analytics (Plausible — cookieless), error monitoring (Sentry), AI content-moderation and search (Anthropic), spam protection (hCaptcha), and DNS / email routing (Cloudflare). Where a provider processes data outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

When you send an enquiry to a club, we pass your message and name to that club so they can respond; replies are routed back through Covey.

Marketing to clubs

Where we contact activity providers about listing on Covey, we do so in line with the Privacy and Electronic Communications Regulations (PECR) — using publicly-listed business contact details, with an unsubscribe option in every message.

How long we keep it

We keep your account data until you delete your account. DBS certificates are deleted after 12 months. Suppression records (so we don't contact people who've opted out) are kept as long as necessary to honour that choice.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, object to, and port your personal data. You can download a copy of your data, edit your details in your account, or delete your account at any time. To exercise any right, or if you're unhappy with how we've handled your data, contact privacy@mycovey.com. You also have the right to complain to the ICO (ico.org.uk).

Changes

We may update this policy from time to time. The "last updated" date shown on this page reflects the latest version, and we'll bring material changes to your attention.