What happens in the cove stays in the cove

The app

Covo has no telemetry, no crash reporting and no usage statistics. Your sites, databases, logs and caught emails stay on your Mac. The app only goes online to:

• check for component updates once a day, by downloading a signed manifest from GitHub (see Update checks);
• check for new versions of the app itself once a day, by reading getcovo.dev/appcast.xml on this site's server, and download them from GitHub when you click Install;
• download the components you use (PHP, MySQL, Caddy and the rest) from their official sources or from GitHub, when you install or update them;
• fetch WordPress, themes, plugins and Composer packages, when you ask it to create a site or apply a blueprint;
• reach your own servers, when you run a pull or push.

These are plain downloads: nothing about you or your Mac is sent beyond what any download needs (your IP address reaches the server you download from). Every request carries the same short user agent, Covo/<version> (macOS <version>; <arm64 or amd64>), and no identifier. Agents you connect to Covo are your own tools, run by you; Covo never calls an AI model.

Update checks

Once a day, at most, Covo downloads its signed list of components from a release of getcovo/covo-binaries on GitHub. GitHub counts how many times that file is downloaded, and we read that number once a day: it tells us roughly how many Macs ran Covo that day. That daily total is the only thing we keep, and it is public, in stats/manifest-checks.csv.

Nothing identifies you or your Mac: no ID, no cookie, no extra data in the request. GitHub receives your IP address and the user agent above, as for any download; we never see them. Checks you start yourself (Check Now) are not counted.

To turn the daily check off, open Covo's Settings → General → Updates and switch off “Check for component updates daily” (or run covo update auto off). Covo then makes no update request by itself. The app's own update check is a separate switch in the same place.

This website

This site counts visits with Plausible Analytics, running on our own server at Hetzner (analytics.andreacasali.com). It sets no cookies and stores no personal data: your IP address is only used, together with your browser's user agent, to compute a visitor count that changes every day, and is never stored. What we see is aggregated: pages viewed, the site you came from, country, browser and operating system, and which downloads and outbound links get clicked.

No other trackers and no third-party requests: fonts and images are served from this site. The site is served from our own server at Hetzner, which keeps standard logs (IP address, page, time) for operating and protecting it, and nothing more is done with them.

Contact

Questions? Write to hello@getcovo.dev.