Privacy Policy
Last updated 14 October 2026
This policy explains what information Kova ("we", "us") collects, why, and how it is handled. We keep it to the minimum needed to run a paid, one-device-per-account service, and we do not sell your data.
What we collect
| Account identifiers | Your PlayFab ID, Xbox user ID (XUID), and gamertag, obtained when you sign in with Microsoft/Xbox. Used to identify your account. |
| Session tokens | A login session, stored only as a one-way hash, so we can keep you signed in without storing the token itself. |
| Device identifier | A one-way hash derived from your PC's Windows machine identifier. Used to enforce one device per subscription. We cannot reverse it back to your machine details. |
| Subscription data | Your subscription status, period end, and the Stripe customer and subscription IDs that link your account to its billing. |
| Cosmetic choices | Any cosmetics you equip, so they persist across sessions. |
| Payment details | Handled entirely by Stripe. We never see or store your card number. Your email and receipts are held by Stripe for billing. |
Kova is a client-side tool. It does not collect your chat, your worlds, your location in-game, or your gameplay content, and it does not include third-party advertising or tracking.
Why we use it
- To sign you in and provide the service you subscribed to.
- To process and manage your subscription and billing (through Stripe).
- To enforce one active device per account and prevent account sharing and abuse.
- To deliver cosmetics and keep your preferences.
Our legal basis for this processing is performing our contract with you and our legitimate interest in preventing abuse of a paid service.
Who we share it with
We share data only with the providers that make Kova work, and only as needed:
- Microsoft / Xbox / PlayFab — to verify your sign-in.
- Stripe — to process payments and manage your subscription.
- Cloudflare — to host our website, API, and database.
We do not sell your personal data or share it for advertising. We may disclose data if required by law.
Where it is stored
Account and subscription data is stored in Cloudflare's database (D1) and processed on Cloudflare's global network. Payment data is held by Stripe. These providers may process data in countries other than yours, with their own safeguards.
How long we keep it
We keep your account data while your account exists. Expired login sessions are deleted automatically. If you ask us to delete your account, we remove your account data, except records we must keep for legal, tax, or fraud-prevention reasons (billing records are retained by Stripe as required).
How we protect it
Session tokens and device identifiers are stored only as one-way hashes. The offsets your client downloads are encrypted and signed, and tied to your account and device. Traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To make a request, contact us (below). You can manage your billing data directly through the Stripe portal from your account page.
Children
Kova is not directed at children under 13, or under the minimum age of digital consent where you live. We do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will remove it.
Changes
We may update this policy. The "last updated" date above shows the current version. Material changes take effect when posted.
Contact
Questions or privacy requests? Email support@kovaclient.com or reach us in the Kova Discord. If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).