covateLegal
Privacy Policy
Last updated 3 September 2026
The short version: Covate stores the GitHub profile you sign in with, plus the learning sessions you deliberately choose to upload. It never uploads your source code, never sends you email, and never sells your data. The detail is below.
This notice is published in English, in Chinese, and — as section 7(2) of Malaysia's Personal Data Protection Act 2010 requires — in Bahasa Malaysia. The three say the same thing; if they ever differ, the English version prevails. Notis Privasi (Bahasa Malaysia) →
Who we are, and what this covers
Covate is operated by DUOCODE TECHNOLOGY, a sole proprietorship registered in Malaysia under registration number LA0087244-A. In this policy "we", "us" and "Covate" mean DUOCODE TECHNOLOGY.
This policy covers the covate.org website, the Learning Center articles, and the learning ledger you reach by signing in at covate.org/dashboard. The Covate MCP server is a separate thing: it is open-source software that runs on your own machine, keeps its learning sessions in local storage there, and sends us nothing at all unless you deliberately configure the sync described further down.
What we collect when you sign in
Signing in is done through GitHub. We ask GitHub for two permissions only — read:user and user:email — which is enough to know who you are and to have an address to reach you at. We never see your GitHub password, and we do not ask for, and cannot obtain, access to your repositories.
From that sign-in we keep one record for your account:
- your numeric GitHub user ID — the key your history is tied to, so renaming your GitHub account does not lose it
- your GitHub username
- your display name and the web address of your GitHub avatar image (we store the link, not a copy of the picture)
- one email address: the public email on your GitHub profile or, if you have not set one, a verified address on your GitHub account — your primary one where GitHub tells us which it is. If GitHub gives us no address, we store none.
- a sync token — a random secret generated for your account, which the sync client uses to upload sessions; you can reveal it or replace it in the dashboard at any time
- a plan field, which reads "free" for every account, and the times the record was created and last updated
We do not keep the GitHub access token after sign-in. It is used once, to read the profile fields above, and then discarded.
Learning data you choose to sync
Your ledger stays empty until you put your sync token into the Covate sync client and run it. Nothing is uploaded before that, and turning it off is a matter of removing the token — or rotating it in the dashboard, which stops the old one working immediately.
When you do sync, each learning session reaches us as:
- an identifier your local copy already gave the session, so re-syncing updates that session instead of duplicating it
- the name of the project folder — the folder's name only, not the path to it on your machine
- the short summary of the code change the quiz was about
- how many questions the session had, how many you answered correctly, and when it started and finished
- for every question: the question text, the answer options, the correct answer, the answer you gave, whether it was right, the explanation, and the topic and concept labels
That question, explanation and summary text is written by the MCP on your own machine, from your recent code changes — so it can describe, and may quote, parts of the code you were working on. Please weigh that before syncing work you are not free to share. What the sync client does not send is the code itself: no files, no diffs, no repository contents, no directory paths. From the answers we also keep a running per-topic tally — how many you answered, how many were right, when the topic was last seen — which is what the dashboard's weakest-topics list is built from.
Cookies
Covate sets four cookies of its own. None of them are advertising cookies.
- covate_locale — the language you picked, so the site keeps serving it. Readable by the page, kept for a year.
- covate_session — your signed-in session: your account identifier plus a signature we verify on every request. HTTP-only, kept for 30 days, cleared when you sign out.
- covate_oauth_state — a one-off random value that stops the GitHub sign-in from being forged. HTTP-only, ten minutes.
- covate_device_code — during a device-flow sign-in, the code we are exchanging with GitHub on your behalf. HTTP-only, dropped once the sign-in finishes or expires.
These four are the only cookies this site sets, and nothing else here writes to your browser's storage. Until 3 September 2026 Google Analytics set cookies of its own alongside them; it has been removed, and those cookies are no longer set.
Analytics
We measure which pages get read, using Umami — open-source analytics software that we run ourselves, on our own server in Singapore, into a database only we can reach. Nothing from this site goes to Google, or to any other analytics or advertising company: the Google Analytics tag that used to load on every page was removed on 3 September 2026.
The script sets no cookie and stores nothing in your browser. It sends us the address and title of the page you are on, the address you arrived from, your screen size and your browser's language; link-tracking parameters carried in the address, such as utm_source or gclid, are recorded as fields of their own. From the request itself our server works out your browser, operating system and device type, and an approximate location — country, region and city — from your IP address.
Your IP address is not stored in the analytics database: there is no column for one, anywhere in it. It is used only in the moment, to derive a visitor identifier — a one-way hash of the request, your IP address and browser among its inputs, salted with a secret that only our server holds. That identifier cannot be turned back into your IP address, but it is pseudonymous rather than anonymous: while you stay on the same network and browser, later visits are counted as the same visitor, and we have seen that hold for weeks at a time. It is shared with nobody.
This software can also record what a visitor does on screen and build heatmaps from it. Both are switched off for covate.org and have never been on: none of your keystrokes, mouse movements or screen contents are captured.
Because none of this stores anything on your device, there is nothing here for a cookie banner to ask your consent for — you do not see one because none is needed, not because we left it out. If you would rather not be counted at all, block the script with your browser or a content blocker, or set umami.disabled to 1 in this site's local storage; the tracker checks that flag before it sends anything.
Hosting and server logs
The site and its API run on Vercel; the database is Postgres hosted on Supabase. Serving you a page necessarily means the hosting provider handles the request, including the IP address it came from, and both providers keep their own operational logs under their own policies. Covate itself writes no request logs and stores no IP addresses in its database.
The analytics script is served from a third machine, our own, rented from Amazon Web Services in Singapore. Its web server keeps ordinary access logs, and — as any web server's do — those record the IP address of each request for the script and each measurement it sends back. Those logs are ours and nobody else's, we keep them to run the machine, and we do not join them to the analytics data.
What we do not do
- We do not sell, rent or trade personal data.
- We take no payment details, because nothing here is for sale: there is no paid plan, no subscription and no checkout anywhere on the site.
- We do not use your synced learning data to train machine-learning models.
- We run no advertising and carry no ad-network trackers.
- The site sends no email at all — no marketing, no notifications. Your address is stored to identify your account and so that we can reply if you write to us.
Why we process it, and on what basis
We process the data above to authenticate you, to show you your own learning ledger, and to keep the service running and free from abuse. Under Malaysia's Personal Data Protection Act 2010 we rely on your consent — given when you sign in, and again when you choose to configure the sync — and on the processing being necessary for the service you asked us to perform. You can withdraw that consent at any time; see "Your rights" below.
Who else handles your data
We use a small number of service providers, each for one purpose:
- GitHub — sign-in and the profile fields listed above
- Vercel — hosting for the website and its API
- Supabase — the Postgres database your account and learning records live in
- Amazon Web Services — the Singapore server our own analytics software and its database run on
These providers operate outside Malaysia, so your data is stored and processed outside Malaysia; by using Covate you consent to that transfer. Apart from them, we disclose personal data to nobody, unless a Malaysian authority or court lawfully requires it of us.
How long we keep it
We keep your account and your synced learning records until you ask us to delete them, or until Covate is shut down. We have not set a fixed retention schedule, and we would rather say so than publish one we do not actually enforce.
Deleting your account deletes everything attached to it: your sessions, every answer, and the per-topic tallies go with it.
Your rights
Malaysia's Personal Data Protection Act 2010 gives you the right to ask what personal data we hold about you, to have it corrected, to withdraw your consent, and to limit how it is processed. Write to duocodetechu@gmail.com — from the email address on your GitHub account, or telling us your GitHub username — and we will answer within 21 days, as the Act requires.
- Get a copy — we will send you what we hold, in a form you can read and re-use.
- Correct it — nearly all of it comes from GitHub, so correcting it there and signing in again refreshes your name, username, avatar and email here.
- Delete it — the dashboard has no delete button yet, so ask us by email and we will remove the account and everything attached to it.
- Stop syncing — take the sync token out of your MCP configuration, or rotate it in the dashboard, which invalidates the old one straight away. Sessions already uploaded stay until you ask us to delete them.
- Complain — if we have not put something right, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) in Malaysia.
Security
Your session cookie is HTTP-only, sent only over HTTPS, and carries a signature we verify on every request, so it cannot be edited into somebody else's account. The connection to the database is encrypted.
Your sync token is a password in every practical sense: whoever holds it can upload sessions into your ledger. It is never printed into the page's HTML — the dashboard fetches it only for a signed-in session — and it cannot be used to read or rotate itself. If you think it has leaked, rotate it in the dashboard.
No service can promise perfect security, and we are not going to pretend otherwise.
Children
Covate is a tool for working developers and is not directed at children. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian, as Malaysian law requires. If you believe a child has given us data, write to us and we will delete it.
Changes to this policy
If this policy changes, we will update it here and change the date at the top. A material change will be described in the change itself, not slipped in quietly.
Contact
DUOCODE TECHNOLOGY (registration no. LA0087244-A), Malaysia. Email duocodetechu@gmail.com — that is the address for privacy questions, data access requests and deletions.