Privacy
Last updated: November 1, 2026
What Coverage stores
- Your account id. The sign-in service gives it to us. Coverage does not keep your email address.
- Your repos: the owner and name you choose, the default branch, if the badge is public, and the time you made it.
- Your upload tokens: a SHA-256 hash of each token, its name, the times it was made and last used. Coverage never stores a token itself.
- Your reports: for each upload, the commit, the branch, the flag, the commit subject you send, the time, and the counts. For each file, its path, its counts and the line numbers that are not covered. Coverage never stores your source code, only the file names and numbers.
Only you see your reports. The one thing anyone can see is the badge of a repo, and only when you turn it on: it shows a percent. The commit subject and the file paths can name things you may want to keep private: do not send what you do not want stored.
Where it runs
Coverage runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for. To limit how many repos and tokens one account can make, Cloudflare counts requests by account id. We do not store or log an IP address.
Our logs hold the path of a request. They never hold a token or an Authorization header. If the page has an error, it sends a report with the error message, page type and browser. It has no repo name, token or email.
How long it stays
Your data stays until you delete your account. You can revoke a token at any time: it stops working at once.
Delete my account
Sign in and choose "Delete my account". The server then deletes all your repos, with their uploads, files and tokens. It also deletes your sign-in account. This cannot be undone.
Your sign-in is shared with Kevin's other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account within 30 days of your request.
Cloudflare D1 keeps point-in-time backups of the database for up to 30 days, so deleted data can stay in a backup for that time. Nobody reads these backups except Kevin, and only to restore.
Signing in
To sign in you use Google (on Google's site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app for 30 days. Every page asks the sign-in service whether you are signed in. That request carries your sign-in cookie if you have one. It carries none of your data. For details, read the sign-in section of Coro's privacy page.
Your rights, your contact and the law
Who is responsible
I am Kevin Amado, and I am responsible for the data in Coverage. I am one person in Alberta, Canada. Write to kamadorueda@gmail.com with any question or request about your data.
Why data is used, and for how long
- Counts, error reports and logs: to run the tool and fix errors. The legal basis is my legitimate interest. Counts stay 90 days. Logs and error reports stay 7 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
- Cloudflare also records about one request in ten in more detail. That record has your browser, operating system, language, network and approximate location (country, region and city). It is deleted after 7 days.
- Features you turn on, such as sign-in, sync, reminders or sharing: to give you that feature. The legal basis is your consent or our contract. This page says how long each kind of data stays.
- Data in your browser: I do not receive it. It stays until you clear it.
Who receives your data, and where it goes
Cloudflare hosts this tool and handles the data for me. It works in the United States and in other countries. For transfers from the EU and the UK, it relies on the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare Web Analytics counts visits to this page with a small script. Cloudflare says that it uses no cookies and does not identify you. If you sign in with Google, Google receives your sign-in request. I do not sell your data. This page names any other service.
Your rights
- You can ask for a copy of your data.
- You can ask me to correct it, delete it or stop using it.
- You can ask me to move it to another service.
- You can object to how I use your data.
- You can take back a consent at any time.
- Write to the address above. I answer within 30 days.
- If the request is about an account, write from the email address of that account. This shows me it is you.
- You can also clear the data of this site in your browser. That removes what the page keeps there.
- If you delete your account in one app, I get a request to delete what my other apps keep for it. I finish it within 30 days.
Complaints
If you are not happy, you can complain to a data protection authority. In the EU, this is the authority of your country. In the United Kingdom, it is the ICO. In Canada, it is the Office of the Privacy Commissioner of Canada. For Alberta, it is the Office of the Information and Privacy Commissioner of Alberta. In Saudi Arabia, it is SDAIA. I would like to answer you first.
Children
This tool is not for children under 13, or under 16 in the EU without a parent's permission. If a child gave me data, write to me. I will delete it.