Your data, in plain English.

1. Who we are

CoolCove Climate Studio, LLC ("CoolCove," "we," "us") is a Delaware-incorporated climate-product company headquartered in Brooklyn, New York. When this policy mentions the "data controller," it means CoolCove. You can reach our data-protection team at the email address listed on our Contact page or by writing to the postal address on the homepage of this site.

2. Information we collect

CoolCove collects the minimum amount of information needed to run the business. Specifically, we collect:

2.1 Information you give us directly

• Account information — your name, email, and a hashed password when you create an account in the CoolCove companion app or on this website.
• Order information — shipping address, billing address, the last four digits of your payment card, and order history. Full payment data is held by our PCI-DSS Level 1 payment processor and never touches CoolCove servers.
• Support correspondence — emails, chat transcripts, and the diagnostic logs you choose to share when you contact our support team.

2.2 Information from your CoolCove device

• Operational data — ambient temperature, humidity, fan speed, compressor duty cycle, and error codes. This is sent over an encrypted MQTT channel only when the device is connected to Wi-Fi and the account owner has paired the device in the app.
• Firmware & app version — so we can deliver updates and diagnose crashes.
• Approximate location — derived from your IP address, used solely to display local weather and to set sensible default temperature targets. We do not collect precise GPS coordinates.

2.3 Information from this website

• Server logs — anonymized request logs retained for 30 days for security and capacity planning.
• Cookies — a single first-party cookie that remembers your cart and a privacy-respecting analytics cookie from Plausible Analytics. No cross-site tracking, no advertising cookies, ever.

3. How we use your information

We use the data we collect for the following purposes, and only these purposes:

We do not use your data for automated profiling, advertising, or any form of credit scoring.

4. Who we share it with

CoolCove does not sell personal data. We share it with a small set of trusted service providers, each bound by a written data-processing agreement:

• Payment processor — Stripe, Inc., for credit-card transactions.
• Shipping carriers — UPS, USPS, FedEx, and DHL, for delivering your order.
• Cloud hosting — Amazon Web Services (primary) and Hetzner Online GmbH (EU backup).
• Email delivery — Postmark, for transactional order and warranty emails.
• Analytics — Plausible Analytics, a privacy-respecting, cookieless analytics service.

We will also disclose information when we are legally required to — for example, in response to a valid subpoena or court order — and we will challenge any request that we believe is overbroad.

5. How long we keep it

We retain personal data only as long as we have a legitimate need:

• Account data — until you delete the account, plus 30 days for the deletion to propagate through backups.
• Order records — 7 years (required by U.S. tax law).
• Warranty records — the duration of the warranty period plus 3 years for product-liability claims.
• Support tickets — 3 years after the ticket is closed.
• Device operational data — 13 months, then aggregated and anonymized.
• Server logs — 30 days.

6. Your rights

To exercise any of these rights, open the app or email us at the address on our Contact page. We respond to all verified requests within 30 days, and most within 7.

7. How we protect your data

CoolCove uses industry-standard security measures, including TLS 1.3 for data in transit, AES-256 encryption for data at rest, hardware-security-module-backed key management, two-factor authentication for all internal systems, and a public bug-bounty program for the app and firmware. We commission an independent third-party security audit every twelve months and publish the executive summary on our Trust page.

No security system is perfect, and we cannot guarantee absolute security. If we ever experience a breach that materially affects your personal data, we will notify affected users and applicable regulators within 72 hours of discovery.

8. International transfers

CoolCove is a U.S.-headquartered company. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States under Standard Contractual Clauses (SCCs) and supplemented with technical safeguards (encryption-in-transit, encryption-at-rest, pseudonymization of identifiers). Customers in those regions may also request that their data be stored exclusively in our EU backup region.

9. Children's privacy

CoolCove products and websites are not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it within seven days.

10. Changes to this policy

If we make material changes to this policy — for example, adding a new category of data, sharing with a new service provider, or changing retention periods — we will announce the change with a banner on the homepage for at least 30 days and send an email to registered users. The effective date at the top of this page always reflects the most recent version. A redline archive of past versions is available on request.