COVEY PRIVACY POLICY

Controller / Business: Covey, Inc., a Delaware corporation (entity name, form, and registered address to be confirmed — see Annex D of the Terms of Service) Document: Privacy Policy (this “Policy”) Version: 2026-09-01 Effective Date: 1 September 2026 Supersedes: Version 2026-08-23 Publication URL: https://coveyapp.co/privacy

NOTICE AT COLLECTION

This Policy serves as the notice at collection required by the California Consumer Privacy Act, Cal. Civ. Code § 1798.100(a). It identifies the categories of Personal Information Covey collects, the purposes for which each category is used, the categories of recipients, and the applicable retention periods.

COVEY DOES NOT SELL PERSONAL INFORMATION AND DOES NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING.

COVEY DOES NOT COLLECT THE GEOLOCATION OF YOUR DEVICE. See Section 7.

Covey collects Sensitive Personal Information, comprising a government identity document and facial photograph, information concerning sexual orientation and gender identity where you enable Dating Features, and the contents of communications you address to persons other than Covey. See Sections 4.4, 4.5, and 16.4.

1. INTRODUCTION AND SCOPE

1.1 Covey, Inc. (“Covey”, “we”, “us”) is the “controller” of Personal Information for the purposes of the General Data Protection Regulation and the “business” for the purposes of the California Consumer Privacy Act.

1.2 This Policy describes how Covey collects, uses, discloses, retains, secures, and deletes Personal Information in connection with:

    1.2.1 the Covey mobile application;

    1.2.2 the website at coveyapp.co, including the waitlist and contact forms published on it; and

    1.2.3 Covey’s support and trust-and-safety channels.

1.3 This Policy does not apply to any third-party service that you reach through the Service, including venue websites, third-party music-streaming services, and application marketplaces. Those services are governed by their own privacy policies.

1.4 This Policy is incorporated by reference into the Covey Terms of Service and forms part of the agreement between you and Covey.

1.5 Capitalised terms not defined in this Policy have the meanings given in the Terms of Service.

2. DEFINITIONS

2.1 “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Where the GDPR applies, it has the meaning given to “personal data” in Article 4(1).

2.2 “Sensitive Personal Information” has the meaning given in Cal. Civ. Code § 1798.140(ae), and, where the GDPR applies, includes the special categories of personal data identified in Article 9(1).

2.3 “Processing” means any operation performed on Personal Information, whether or not by automated means.

2.4 “Service Provider” has the meaning given in Cal. Civ. Code § 1798.140(ag), and corresponds to a “processor” under the GDPR.

2.5 “Sale” and “Share” have the meanings given in Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah) respectively.

2.6 “User”, “Service”, “Dating Features”, “Plan”, “User Content”, and “Model Output” have the meanings given in the Terms of Service.

3. SOURCES OF PERSONAL INFORMATION

Covey obtains Personal Information from the following sources only:

3.1 directly from you, when you register, complete onboarding, create User Content, communicate with other Users, or contact Covey;

3.2 automatically from your device, when you use the Service;

3.3 from your chosen authentication provider, being Apple or Google, upon your sign-in; and

3.4 from other Users, where they name you in a Plan, invite you, report you, or include you in a communication or photograph.

Covey does not purchase Personal Information from data brokers and does not acquire Personal Information from advertising networks.

4. CATEGORIES OF PERSONAL INFORMATION COLLECTED

4.1 Account information. Your email address and the account identifier issued by your authentication method, being an email-and-password credential, Sign in with Apple, or Sign in with Google. Where you elect to use Apple’s Private Email Relay, Covey receives the relay address in place of your email address.

4.2 Profile information. Display name, username, profile photograph, biography, home city, occupation, personality-type indicator, and social media links you elect to publish.

4.3 Preference information. Activities, cuisines, dietary restrictions, food preferences, media genres, fashion styles, sports and self-declared skill levels, nightlife preferences, and outdoor preferences, each selected by you during onboarding or subsequently.

4.4 Date of birth and gender. Collected for the purposes of enforcing the minimum age requirement and of applying the age and gender criteria that Plan hosts and Users of Dating Features specify. Stored separately from your published profile and not disclosed to other Users.

4.5 Identity verification information — Sensitive Personal Information. A photographic image of a government-issued identity document and a facial photograph, together with the status and timestamps of the verification. Covey’s personnel compare the two images visually. Covey does not perform automated facial recognition and does not generate, derive, or store any biometric template, faceprint, or other mathematical representation of facial geometry. These images are stored in a private, access-controlled repository accessible only to their subject and to Covey’s authorised reviewers, are never displayed on any profile, and are never disclosed to other Users.

4.6 Dating information — Sensitive Personal Information. Where, and only where, you enable Dating Features, Covey collects your gender identity, the descriptive label you apply to your sexual orientation, the genders to which you are attracted, the age range you specify, your height, and your self-reported exercise frequency. Dating Features are disabled by default.

4.7 User Content. Plans and their particulars, including the name, address, and coordinates of each location added to a Plan; invitations, attendance, and join requests; posts and recaps; photographs and other media uploaded to profiles, Plans, posts, and conversations; messages in Plan conversations and direct messages; groups created or joined; bookmarks and saved places; and comments.

4.8 Trust and safety information. Reports you submit, the stated reason and any evidence attached; blocks you apply; and moderation determinations and their records.

4.9 Support and feedback information. The contents of your correspondence with Covey.

4.10 Usage and diagnostic information. Named application events with an associated session identifier, application version, and device type; screens viewed and features used; and crash reports, error traces, and performance measurements.

4.11 Connection information. Internet Protocol address and request timestamps, recorded by Covey’s infrastructure in order to serve requests, apply rate limits, and detect abuse. An Internet Protocol address yields an approximate geographic region of city-level granularity or coarser. It does not yield device geolocation.

4.12 Notification information. Where you enable notifications, the Apple Push Notification service device token, together with a device identifier, application version, and locale.

4.13 Consent records. The version of each policy document you accepted, the date and time of acceptance, and the registration method used.

4.14 Website information. The waitlist form at coveyapp.co collects an email address, first name, city, and your confirmation that you are eighteen (18) years of age or older. The contact form collects a name, email address, subject, and message.

5. PURPOSES OF PROCESSING

Covey Processes Personal Information for the following purposes and no others:

5.1 to create, authenticate, and secure your Account;

5.2 to verify that you are a real person of at least eighteen (18) years of age, and to detect and prevent impersonation and fraud;

5.3 to operate the Service, including creating Plans, presenting them to the Users entitled to see them, delivering communications and media, and storing User Content;

5.4 to determine the ordering and selection of Plans, places, and Users presented to you within the Service;

5.5 to apply the age, gender, and dating criteria specified by you and by other Users;

5.6 to deliver notifications concerning your Plans, invitations, communications, and Account;

5.7 to investigate reports, enforce the Terms of Service, and respond to abuse, impersonation, fraud, and threats to the safety of any person;

5.8 to diagnose defects, measure performance, and evaluate the operation of features;

5.9 to respond to support enquiries;

5.10 to comply with legal obligations and to establish, exercise, or defend legal claims; and

5.11 to generate the optional Model Output described in Section 8.

Covey does not Process private communications or non-public Plan content for advertising purposes, and does not use such content to train third-party machine-learning models.

6. LEGAL BASES FOR PROCESSING

Where the GDPR applies to the Processing, Covey relies upon the following legal bases:

Withdrawal of consent does not affect the lawfulness of Processing carried out before withdrawal.

7. INFORMATION COVEY DOES NOT COLLECT

7.1 COVEY DOES NOT COLLECT THE GEOLOCATION OF YOUR DEVICE. The Covey application does not request location permission and is not technically capable of reading the position of your device. Where the Service displays a map, it displays locations that a User has entered into a Plan by selecting them from a place search. It does not display your position or that of any other User.

7.2 Covey additionally does not:

    7.2.1 incorporate advertising software development kits, advertising networks, or third-party marketing trackers;

    7.2.2 track you across applications or websites operated by other companies, for which reason the application does not present the Apple App Tracking Transparency prompt;

    7.2.3 access your contacts, address book, calendar, microphone, or health data;

    7.2.4 connect to your music-streaming account or receive your listening history. Where a Plan references a playlist, a User has published a public share link;

    7.2.5 collect payment card numbers, bank account details, or any financial account information, the Service being provided free of charge; or

    7.2.6 collect government identification numbers other than by way of the document image described in Section 4.5, nor biometric identifiers, racial or ethnic origin, religious or philosophical beliefs, trade union membership, health data, or genetic data.

8. AUTOMATED GENERATION OF TEXT

8.1 Certain optional features generate suggested text: a profile biography, a draft Plan, a group description, conversation prompts, and the interpretation of free-text search queries. These features transmit data to the Gemini application programming interface operated by Google LLC.

8.2 Data transmitted. Only the data necessary for the requested feature is transmitted, being typically the preference selections you made during onboarding, the text you have entered, or the Plan you are drafting.

8.3 Data not transmitted. Covey does not transmit to the model provider your identity verification information, your date of birth, your dating information, your direct messages, or your email address.

8.4 Server-side execution. Requests are issued by Covey’s servers and not by your device. The model provider does not receive your Covey account identity and Covey’s credentials are not exposed to the application.

8.5 Model Output is a suggestion, is not reviewed by any person before presentation, and may be inaccurate. Section 8 of the Terms of Service governs your use of it.

9. DISCLOSURE OF PERSONAL INFORMATION

9.1 Service Providers. Covey discloses Personal Information to the Service Providers listed in Annex B, each of which Processes it solely on Covey’s documented instructions, under written contract containing the terms required by Cal. Civ. Code § 1798.100(d) and, where applicable, Article 28 of the GDPR.

9.2 Other Users. Covey discloses Personal Information to other Users as described in Section 11.

9.3 Legal and safety disclosures. Covey may disclose Personal Information where it believes in good faith that disclosure is necessary to comply with Applicable Law or valid legal process, to enforce the Terms of Service, to investigate abuse or fraud, or to protect the rights, property, or safety of any User, the public, or Covey. Where Covey is legally permitted to notify you of a request for your Personal Information, it will endeavour to do so.

9.4 Corporate transactions. In connection with a merger, acquisition, financing, corporate reorganisation, or sale of assets, Personal Information may be transferred as part of the transaction. Covey will give notice before your Personal Information becomes subject to a materially different privacy policy.

9.5 Aggregated and de-identified information. Covey may disclose information that is no longer reasonably capable of being associated with an identified or identifiable individual. Covey maintains such information in de-identified form, does not attempt to re-identify it, and contractually obliges recipients to do likewise.

9.6 Covey does not disclose Personal Information to any third party for that third party’s own commercial purposes.

10. NO SALE; NO SHARE; NO CROSS-CONTEXT BEHAVIOURAL ADVERTISING

10.1 Covey does not Sell Personal Information and has not Sold Personal Information in the preceding twelve (12) months.

10.2 Covey does not Share Personal Information for cross-context behavioural advertising and has not done so in the preceding twelve (12) months.

10.3 Covey does not Sell or Share the Personal Information of any consumer whom it knows to be under sixteen (16) years of age. The Service is in any event restricted to persons of at least eighteen (18) years.

10.4 Because Covey neither Sells nor Shares Personal Information, an opt-out preference signal, including the Global Privacy Control, has no Sale or Share to which it may be applied. Covey nonetheless honours such a signal as a valid request to the extent any is applicable.

11. DISCLOSURE TO OTHER USERS

11.1 Profile. Your display name, username, profile photograph, biography, home city, occupation, preference selections, and social links are visible to other Users, subject to the discovery visibility setting you select.

11.2 Plans. A Plan is visible to the audience to which it is published. A public Plan is visible to Users browsing the Service; a friends-only or invitation-only Plan is not.

11.3 Date of birth. Your date of birth is not disclosed to any other User. It is stored separately from your published profile and is readable only by you. Where a Plan or dating criterion depends on age, Covey’s servers derive your age from your date of birth in order to determine eligibility; the date itself is not transmitted.

11.4 Dating information. Disclosed only to other Users who have enabled Dating Features and who fall within the criteria that you and they have specified.

11.5 Identity verification information. Not disclosed to any other User in any circumstance.

11.6 Communications. Messages are disclosed to the participants in the relevant conversation. Covey may access the content of communications where necessary to investigate a report or where required by Applicable Law.

11.7 NOTICE CONCERNING SHARED MEDIA. Photographs transmitted through the Service are stored at addressable locations. A person who obtains such an address — including a person who was formerly a participant in a conversation and who retained it — may remain able to retrieve that image after ceasing to be a participant, after being blocked, or after the conversation is deleted. You should treat any photograph you transmit as incapable of complete retraction.

12. COOKIES AND LOCAL STORAGE

12.1 The website at coveyapp.co writes a single item to your browser’s local storage, identified as covey-theme, recording your selection of a light or dark colour scheme. It remains on your device and is not transmitted to Covey.

12.2 Covey’s website host sets the cookies necessary to serve the site and to detect automated form submissions.

12.3 The website employs no advertising cookies, tracking pixels, or third-party analytics cookies.

12.4 The Covey mobile application does not employ cookies.

13. RETENTION

13.1 Covey retains Personal Information only for so long as is necessary for the purposes set out in Section 5, after which it deletes or de-identifies it.

13.2 The retention periods applicable to each category are set out in Annex C.

13.3 Covey may retain Personal Information beyond the periods in Annex C where necessary to comply with a legal obligation, to conduct or conclude an investigation into a threat to safety, to establish, exercise, or defend a legal claim, or to give effect to a suspension or ban.

14. SECURITY

14.1 Covey implements administrative, technical, and organisational measures designed to protect Personal Information, including: transmission over Transport Layer Security; encryption at rest by Covey’s infrastructure provider; authorisation enforced within the database by row-level security policies, such that one Account cannot retrieve the records of another; storage of identity verification information in a private repository accessible only to its subject and to authorised reviewers; and security review of changes affecting authentication or data access.

14.2 No warranty of security. No system of information security is impenetrable. Covey does not warrant, and expressly disclaims any representation, that the Service or its Processing is secure or free from unauthorised access.

14.3 Where Covey becomes aware of a breach of security affecting your Personal Information, it will notify you and the relevant supervisory authorities to the extent and within the time required by Applicable Law.

14.4 Vulnerabilities may be reported to safety@coveyapp.co.

15. RIGHTS OF DATA SUBJECTS

15.1 Rights available to all Users. Irrespective of your place of residence, you may request that Covey:

    15.1.1 confirm whether it Processes Personal Information concerning you and provide access to it;

    15.1.2 correct inaccurate Personal Information;

    15.1.3 delete your Account and the Personal Information associated with it;

    15.1.4 provide your Personal Information in a portable, structured, commonly used, machine-readable format;

    15.1.5 give effect to the withdrawal of a consent previously given; or

    15.1.6 restrict or cease Processing, where Applicable Law confers that right.

15.2 Exercise of rights. You may delete your Account through the account settings within the application. Any other request may be submitted by email to support@coveyapp.co from the address associated with your Account.

15.3 Verification. Covey may require information sufficient to verify that the requester is the data subject or an authorised agent. Information supplied for verification is used for that purpose only and is then deleted. An authorised agent must furnish written authority.

15.4 Time for response. Covey acknowledges a request within ten (10) business days and substantively responds within forty-five (45) calendar days, extensible once by a further forty-five (45) days where reasonably necessary, in which case Covey will notify you of the extension and the reason for it. Where the GDPR applies, Covey responds within one (1) month, extensible by two (2) further months for complex requests.

15.5 No charge; no detriment. Covey does not charge for the exercise of these rights and does not discriminate against any person for exercising them.

15.6 Effect of Account deletion. Deletion removes your profile, the Plans you host, your posts, your communications, your bookmarks, and your preferences, and revokes your authentication credentials. Annex C identifies the categories that are retained and the basis for their retention. Communications and media previously delivered to other Users may persist in their Accounts.

16. CALIFORNIA PRIVACY DISCLOSURES

This Section supplements the remainder of this Policy in respect of California residents and is made pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

16.1 Categories collected. The statutory categories of Personal Information collected in the preceding twelve (12) months, the sources, the business purposes, and the categories of recipient, are set out in Annex A.

16.2 Sale and Share. Covey has Sold no Personal Information and has Shared no Personal Information for cross-context behavioural advertising in the preceding twelve (12) months. See Section 10.

16.3 Disclosure for a business purpose. Covey has disclosed each category identified in Annex A to the Service Providers identified in Annex B for the business purposes there stated.

16.4 Sensitive Personal Information. Covey collects the following categories of Sensitive Personal Information:

    16.4.1 a government-issued identification document and a facial photograph (Section 4.5);

    16.4.2 information concerning sexual orientation and gender identity, where Dating Features are enabled (Section 4.6); and

    16.4.3 the contents of communications addressed to persons other than Covey (Section 4.7).

Covey uses and discloses each such category solely for the purposes enumerated in Cal. Civ. Code § 1798.121(a) and its implementing regulations, namely to perform the services reasonably expected by an average consumer, to verify and maintain the quality of the service, to prevent, detect, and investigate security incidents and fraudulent or illegal conduct, and to ensure the physical safety of natural persons. Covey does not use Sensitive Personal Information to infer characteristics concerning any consumer, and does not use it for advertising. Accordingly, the right to limit the use and disclosure of Sensitive Personal Information under Cal. Civ. Code § 1798.121 does not arise. You may nonetheless disable Dating Features, request deletion of your identity verification images, or delete your Account, at any time.

16.5 Rights of California residents. You have the rights to know, to delete, to correct, and to opt out of Sale and Share, together with the right not to receive discriminatory treatment for exercising them. Section 15 describes how to exercise each.

16.6 Method of submission. Covey is a business that operates exclusively online and has a direct relationship with the consumers from whom it collects Personal Information. Pursuant to Cal. Code Regs. tit. 11, § 7020(d), an email address is accordingly the sole designated method for the submission of requests: support@coveyapp.co.

16.7 Shine the Light. Covey does not disclose Personal Information to third parties for those parties’ direct marketing purposes, and accordingly makes no disclosure under Cal. Civ. Code § 1798.83.

17. OTHER UNITED STATES STATE PRIVACY LAWS

17.1 Residents of states having comprehensive consumer privacy legislation, including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Utah, have the rights described in Section 15 to the extent conferred by the law of their state.

17.2 Right of appeal. Where the applicable state law confers a right of appeal, you may appeal Covey’s decision on a request by replying to Covey’s response. Covey will determine the appeal and notify you of its determination, with reasons, within forty-five (45) days, and will inform you of the means by which you may contact the attorney general of your state should the appeal be denied.

17.3 Consent to Processing of sensitive data. Where the applicable state law requires opt-in consent for the Processing of sensitive data, the consent given at the point of submitting identity verification information or enabling Dating Features constitutes that consent.

17.4 Covey does not conduct targeted advertising and does not engage in profiling producing legal or similarly significant effects.

18. MINORS

18.1 The Service is offered exclusively to persons of at least eighteen (18) years of age.

18.2 Covey does not knowingly collect Personal Information from any person under eighteen (18). Where Covey becomes aware that it has done so, it will terminate the Account and delete the associated Personal Information.

18.3 A parent or guardian who believes that a minor has provided Personal Information to Covey should contact safety@coveyapp.co.

19. INTERNATIONAL TRANSFERS

19.1 Covey operates from, and Processes Personal Information within, the United States.

19.2 If you access the Service from outside the United States, your Personal Information will be transferred to and Processed in a jurisdiction whose data-protection law may differ from that of your own.

19.3 Where a transfer from the European Economic Area, the United Kingdom, or Switzerland requires an appropriate safeguard, Covey relies upon the Standard Contractual Clauses adopted by the European Commission and, as applicable, the United Kingdom International Data Transfer Addendum, concluded with the relevant Service Provider.

20. AMENDMENT OF THIS POLICY

20.1 Each published version of this Policy bears a Version identifier. The current Version is stated in the header.

20.2 Where an amendment is material — including the collection of a new category of Personal Information, Processing for a new purpose, or disclosure to a new category of recipient — Covey will publish the amended Policy, update the Version and Effective Date, give notice within the Service or by email before the amendment takes effect, and, where Applicable Law so requires, obtain your consent rather than presume it.

20.3 Covey records the Version of this Policy that you accepted and the date of acceptance.

21. CONTACT

Covey, Inc. San Francisco, California, United States

[TO BE CONFIRMED. A dedicated privacy@coveyapp.co alias is customary and should be substituted throughout once provisioned. The registered postal address must be inserted here before publication. Covey has not appointed a Data Protection Officer or an Article 27 representative; counsel should confirm whether either is required.]

ANNEX A — STATUTORY CATEGORIES OF PERSONAL INFORMATION

Collected in the twelve (12) months preceding the Effective Date. In every case the sources are those in Section 3 and the recipients are the Service Providers in Annex B. No category has been Sold or Shared.

Not collected: professional or employment information; education records; racial or ethnic origin; religious or philosophical beliefs; trade union membership; health, genetic, sex life, or sexual behaviour data other than the orientation label at Section 4.6; financial account information; government identification numbers other than as appearing on the document image at Section 4.5.

ANNEX B — SERVICE PROVIDERS

[TO BE VERIFIED. The legal entity names above should be confirmed against the executed data processing agreement with each provider. Covey should hold a countersigned DPA, incorporating Standard Contractual Clauses where relevant, for each. Adding a Service Provider requires an amendment to this Annex under Section 20.]

ANNEX C — RETENTION SCHEDULE

[OUTSTANDING. The retention period for identity verification images is not yet fixed. Covey has committed, in Section 4.5 and in the published policy, to implementing a defined period after which the images are deleted and only the determination is retained. That period must be inserted in this Annex, and the deletion mechanism implemented, before this Policy can be said to be accurate. A comparable maximum age should be fixed for usage and diagnostic information.]

End of Privacy Policy, Version 2026-09-01.