Privacy Policy

01Who we are, and what this covers

Covate is operated by DUOCODE TECHNOLOGY, a sole proprietorship registered in Malaysia under registration number LA0087244-A. In this policy "we", "us" and "Covate" mean DUOCODE TECHNOLOGY.

This policy covers the covate.org website, the Learning Center articles, and the learning ledger you reach by signing in at covate.org/dashboard. The Covate MCP server is a separate thing: it is open-source software that runs on your own machine, keeps its learning sessions in local storage there, and sends us nothing at all unless you deliberately configure the sync described further down.

02What we collect when you sign in

Signing in is done through GitHub. We ask GitHub for two permissions only — read:user and user:email — which is enough to know who you are and to have an address to reach you at. We never see your GitHub password, and we do not ask for, and cannot obtain, access to your repositories.

From that sign-in we keep one record for your account:

• your numeric GitHub user ID — the key your history is tied to, so renaming your GitHub account does not lose it
• your GitHub username
• your display name and the web address of your GitHub avatar image (we store the link, not a copy of the picture)
• one email address: the public email on your GitHub profile or, if you have not set one, a verified address on your GitHub account — your primary one where GitHub tells us which it is. If GitHub gives us no address, we store none.
• a sync token — a random secret generated for your account, which the sync client uses to upload sessions; you can reveal it or replace it in the dashboard at any time
• a plan field, which reads "free" for every account, and the times the record was created and last updated

We do not keep the GitHub access token after sign-in. It is used once, to read the profile fields above, and then discarded.

03Learning data you choose to sync

Your ledger stays empty until you put your sync token into the Covate sync client and run it. Nothing is uploaded before that, and turning it off is a matter of removing the token — or rotating it in the dashboard, which stops the old one working immediately.

When you do sync, each learning session reaches us as:

• an identifier your local copy already gave the session, so re-syncing updates that session instead of duplicating it
• the name of the project folder — the folder's name only, not the path to it on your machine
• the short summary of the code change the quiz was about
• how many questions the session had, how many you answered correctly, and when it started and finished
• for every question: the question text, the answer options, the correct answer, the answer you gave, whether it was right, the explanation, and the topic and concept labels

That question, explanation and summary text is written by the MCP on your own machine, from your recent code changes — so it can describe, and may quote, parts of the code you were working on. Please weigh that before syncing work you are not free to share. What the sync client does not send is the code itself: no files, no diffs, no repository contents, no directory paths. From the answers we also keep a running per-topic tally — how many you answered, how many were right, when the topic was last seen — which is what the dashboard's weakest-topics list is built from.

04Cookies

Covate sets four cookies of its own. None of them are advertising cookies.

• covate_locale — the language you picked, so the site keeps serving it. Readable by the page, kept for a year.
• covate_session — your signed-in session: your account identifier plus a signature we verify on every request. HTTP-only, kept for 30 days, cleared when you sign out.
• covate_oauth_state — a one-off random value that stops the GitHub sign-in from being forged. HTTP-only, ten minutes.
• covate_device_code — during a device-flow sign-in, the code we are exchanging with GitHub on your behalf. HTTP-only, dropped once the sign-in finishes or expires.

05Analytics

Every page on this site loads Google Analytics 4 (measurement ID G-M3EQXS08MM). Google receives which page you viewed, basic browser and device information, and your IP address, and sets its own cookies in your browser; what Google does with that is governed by Google's own privacy policy. We use it for one thing: seeing which pages get read.

The site does not currently show a cookie banner and has no in-page opt-out. If you would rather not be measured, block the script with your browser's settings or a content blocker, or use Google's own Analytics opt-out browser add-on.

06Hosting and server logs

The site and its API run on Vercel; the database is Postgres hosted on Supabase. Serving you a page necessarily means the hosting provider handles the request, including the IP address it came from, and both providers keep their own operational logs under their own policies. Covate itself writes no request logs and stores no IP addresses in its database.

07What we do not do

• We do not sell, rent or trade personal data.
• We take no payment details, because nothing here is for sale: there is no paid plan, no subscription and no checkout anywhere on the site.
• We do not use your synced learning data to train machine-learning models.
• We run no advertising and carry no ad-network trackers.
• The site sends no email at all — no marketing, no notifications. Your address is stored to identify your account and so that we can reply if you write to us.

08Why we process it, and on what basis

We process the data above to authenticate you, to show you your own learning ledger, and to keep the service running and free from abuse. Under Malaysia's Personal Data Protection Act 2010 we rely on your consent — given when you sign in, and again when you choose to configure the sync — and on the processing being necessary for the service you asked us to perform. You can withdraw that consent at any time; see "Your rights" below.

09Who else handles your data

We use a small number of service providers, each for one purpose:

• GitHub — sign-in and the profile fields listed above
• Vercel — hosting for the website and its API
• Supabase — the Postgres database your account and learning records live in
• Google — website analytics

These providers operate outside Malaysia, so your data is stored and processed outside Malaysia; by using Covate you consent to that transfer. Apart from them, we disclose personal data to nobody, unless a Malaysian authority or court lawfully requires it of us.

10How long we keep it

We keep your account and your synced learning records until you ask us to delete them, or until Covate is shut down. We have not set a fixed retention schedule, and we would rather say so than publish one we do not actually enforce.

Deleting your account deletes everything attached to it: your sessions, every answer, and the per-topic tallies go with it.

11Your rights

Malaysia's Personal Data Protection Act 2010 gives you the right to ask what personal data we hold about you, to have it corrected, to withdraw your consent, and to limit how it is processed. Write to duocodetechu@gmail.com — from the email address on your GitHub account, or telling us your GitHub username — and we will answer within 21 days, as the Act requires.

• Get a copy — we will send you what we hold, in a form you can read and re-use.
• Correct it — nearly all of it comes from GitHub, so correcting it there and signing in again refreshes your name, username, avatar and email here.
• Delete it — the dashboard has no delete button yet, so ask us by email and we will remove the account and everything attached to it.
• Stop syncing — take the sync token out of your MCP configuration, or rotate it in the dashboard, which invalidates the old one straight away. Sessions already uploaded stay until you ask us to delete them.
• Complain — if we have not put something right, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) in Malaysia.

12Security

Your session cookie is HTTP-only, sent only over HTTPS, and carries a signature we verify on every request, so it cannot be edited into somebody else's account. The connection to the database is encrypted.

Your sync token is a password in every practical sense: whoever holds it can upload sessions into your ledger. It is never printed into the page's HTML — the dashboard fetches it only for a signed-in session — and it cannot be used to read or rotate itself. If you think it has leaked, rotate it in the dashboard.

No service can promise perfect security, and we are not going to pretend otherwise.

13Children

Covate is a tool for working developers and is not directed at children. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian, as Malaysian law requires. If you believe a child has given us data, write to us and we will delete it.

14Changes to this policy

If this policy changes, we will update it here and change the date at the top. A material change will be described in the change itself, not slipped in quietly.

15Contact

DUOCODE TECHNOLOGY (registration no. LA0087244-A), Malaysia. Email duocodetechu@gmail.com — that is the address for privacy questions, data access requests and deletions.