1. Our Approach

CoveredIf is built around a simple principle: your insurance policy is your business. We collect as little data as possible, and we are transparent about every party that touches your data along the way.

Anyone can use CoveredIf for a one-time policy analysis without creating an account. If you choose to subscribe to the Professional plan, we collect the minimum information needed to maintain your account, process your subscription, and let you return to past reports.

2. What CoveredIf Itself Stores

The original PDF you upload is never stored on CoveredIf's servers. Your document is sent directly to Anthropic for analysis and is not written to disk, saved to our database, or backed up anywhere on our infrastructure. This is true for every user — anonymous one-time analyses and Professional subscribers alike.

For one-time anonymous analyses, CoveredIf retains nothing. No account, no record of the analysis, no usage tracking. Once you leave the page, there is nothing about your policy on our systems.

For Professional account holders, we retain a small amount of information to make the service work:

• Your name, email address, and Google profile picture (if you sign in with Google), along with a unique identifier from Google. If you sign up with email and password, we store your email and a one-way cryptographic (bcrypt) hash of your password — never the password itself.
• A Stripe customer ID and subscription status linking your account to your payment record.
• The structured analysis output for each report you run — for example, the list of covered scenarios and exclusions — along with the original filename. The PDF itself is never saved; only the analysis results, so you can return to them from your dashboard.
• A counter of how many analyses you've run in the current month, used solely to enforce the plan's monthly limit.

Your stored report history is visible only to you when you are signed in.

3. How Anthropic Handles Your Data

CoveredIf uses Anthropic's commercial API (the developer interface to Claude), not the consumer Claude.ai chat product. The two have meaningfully different privacy policies, and we use the stricter one. Specifically:

• Your data is never used to train AI models. Anthropic's commercial API terms prohibit using API inputs and outputs for model training. There is no opt-in or opt-out toggle — this protection is automatic for every CoveredIf user.
• API inputs and outputs are automatically deleted within 30 days. As of Anthropic's September 2025 policy update, this window is currently 7 days in practice. After that, your policy data is permanently removed from Anthropic's systems.
• Limited classifier scores are retained for abuse prevention. Anthropic retains certain safety classification scores to enforce their Usage Policy. These scores do not contain your policy content.

For comparison, if you uploaded your policy to Claude.ai (the consumer chat product) or ChatGPT instead, your data could be saved to your chat history indefinitely, could be used to train future models by default unless you explicitly opt out, and could be retained for up to five years. We use the commercial API specifically to avoid these issues for our users.

For Anthropic's current commercial API terms, see Anthropic's published data retention policy.

4. Authentication

You can sign in to CoveredIf using a Google account or an email and password. When you use Google, Google shares your name, email address, profile picture, and a unique Google account identifier with us. We do not receive your Google password and we cannot access your Gmail, Drive, contacts, or any other Google data.

If you choose email and password, we store a secure one-way hash of your password using industry-standard bcrypt. We never store or have access to your plaintext password.

Your CoveredIf session is maintained through a secure, encrypted cookie set on your browser. The cookie does not contain any personal data — only a session identifier that points to your session record stored on our servers.

5. Payment Information

All payments are processed by Stripe. CoveredIf does not see, store, or have access to your credit card number, expiration date, or security code at any point. Stripe handles this directly through their secure payment fields embedded on our site.

We do store a Stripe customer ID and subscription ID on your account record so we can manage your subscription, but these are reference identifiers — they cannot be used to charge your card outside of CoveredIf.

6. Third-Party Services We Use

The following third parties may process limited data on our behalf to make CoveredIf work:

• Anthropic — processes your uploaded policy document to generate the analysis. Subject to Anthropic's commercial API terms described in Section 3.
• Stripe — processes payments and handles subscription billing. Stripe's privacy policy governs your payment data.
• Google — provides sign-in if you choose to authenticate with a Google account.
• Railway — hosts the CoveredIf application and database infrastructure.

We do not use advertising networks, marketing trackers, or third-party analytics services.

7. Data Retention

For one-time analyses without an account, we retain nothing on our systems. Anthropic auto-deletes API logs within 30 days as described above.

For Professional accounts, we retain your account information and report history for as long as your account is active. If you cancel your subscription, your account remains accessible but no new reports can be saved beyond the monthly free quota. If you wish to delete your account and all associated data, contact us at the address below and we will permanently delete your records within a reasonable period.

8. Your Rights

You have the right to access, correct, or delete the personal data we hold about you. Most of this is visible directly on your account dashboard when signed in. For deletion requests or anything else not available through the dashboard, contact us at the address below.

If you are a resident of California, the European Economic Area, the United Kingdom, or another jurisdiction with comprehensive data protection laws, you may have additional rights under those laws. We will honor any rights granted to you under applicable law.

9. Security

We use industry-standard practices to protect the data we store, including encrypted connections, bcrypt password hashing, secure session cookies, and access controls on our database. No system is perfectly secure, however, and we cannot guarantee absolute security of data transmitted over the internet.

10. Children

CoveredIf is not directed to children under 13 and we do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time, including when our third-party providers (such as Anthropic) update their own policies in ways that affect our users. The date at the top of this page reflects when it was last updated. If we make material changes, we will provide notice through the site or by email to subscribers.

12. Contact

If you have questions about this policy, or wish to exercise any of the rights described above, reach out at [email protected].

By using CoveredIf, you acknowledge that you have read and understood this Privacy Policy.