Privacy and your data

Four things, and nothing else:

• Your email address, so you can sign in. There’s no password to store.
• Your onboarding answers — what you’re protecting, roughly what cover you have, what matters most to you right now.
• The policies you add — the document itself, and the details pulled out of it.
• Anything you record about a claim, if you choose to use that part. See below.

Uncover doesn’t ask for your IRD number, your bank details, or your date of birth, because it doesn’t need them. If you pay for Plus, your card goes to Stripe, not to Uncover — see below.

When you add a policy, its text — or the photo, if you photographed it — is sent to an AI model to be read once. A photo is resized in your own browser before it goes anywhere, and it is read for the same details as a PDF, never for anything else in the picture. The model looks for the things that are hard to find yourself: your premium, excess, sum insured, renewal date, what you’re covered for, what you’re not, and the conditions attached.

It also records what each policy actually covers — the property address, the vehicle, or the person named on it — because “car insurance” tells you very little when you own two cars. That detail sits alongside the policy in Uncover and is only ever shown to you. It is never included in the anonymous usage counts described below.

Every detail it records has to carry the section or page it came from — that’s the “Source” tag you see next to answers. The model is instructed never to fill a gap with general knowledge about insurance. When it can’t confirm something from your document, Uncover says exactly that instead of guessing.

Your documents aren’t used to train AI models, and they’re not used to answer anyone else’s questions. Only your own policies are ever read to answer yours.

When something goes wrong you can describe it to Uncover, and it’ll read your own policies back to you — what they name, what excess may apply, and what they ask you to have ready.

What you write about what happened is the most personal thing Uncover holds, and it’s treated that way. It is stored in one place, against that claim. It is never included in the anonymous usage counts below, never put in an email or a notification, never copied into diagnostic records, and never visible to anyone at Uncover.

Deciding whether a policy may respond is done by matching what you wrote against the details already pulled out of your documents — not by asking an AI model whether you’re covered. The only thing a model is used for is sorting your description into a category like “water damage”, and it is sent your description and nothing else: no name, no email, no address, no policy number.

Photos and invoices you attach to a claim go into a separate private store from your policy documents, reachable only by you and only through links that expire after sixty seconds. Removing a claim removes them.

Uncover is not an insurer and does not handle claims. Nothing you record here is sent to your insurer, and nothing Uncover says about your cover binds anyone — your insurer holds the full policy and decides every claim.

On Plus or Family you can invite somebody into your household — a partner, usually. They see the same policies, documents and claims you do, because that is what sharing a household’s insurance means. What each of you asks Ask Uncover is not shared: your questions are yours and theirs are theirs.

An invite only works for the email address it was sent to, for fourteen days, and Uncover keeps a scrambled form of the link rather than the link itself. Whoever set the household up can remove anybody from it, and anybody can leave.

A licensed adviser can give you a link to connect your account to them. Nothing is shared until you tick which kinds of cover they can see and press the button, and nothing is ticked for you. They see those policies — the insurer, sums insured, excesses, exclusions and renewal dates — and never your questions to Ask Uncover, your claims or your documents.

Every time they open what you shared, it is recorded, and your Profile shows when they last did. You can change what they see or disconnect at any time, and disconnecting takes effect straight away. Uncover checks every adviser’s number on the Financial Service Providers Register before their link connects anyone.

If you’re the adviser: Uncover keeps your name, firm, FSPR number and contact email, shows them to anybody who opens your link, and gives Stripe your contact email for your plan’s receipts.

Your referral link carries a code, not your name or email. Uncover records that somebody joined through it and whether they’ve added a policy, so it can give you your month — and it shows you how many, never who.

Before Uncover opens, the waitlist keeps one thing: the email address you give it, and when you gave it. No name, no phone number. It’s used for two emails — a welcome note when you join and one when Uncover opens — sent through Resend, the service Uncover sends email with, which is given the address and the message and nothing else. It’s never shared beyond that. The coming-soon page shows how many people are on the list, never who. Every note has a link that deletes your address from the list, or email harshae.raniga@gmail.com and a person will.

• Never sells your information, to anyone, for anything.
• Never passes your details to an insurer or a broker.
• Never shares anything with an adviser unless you choose to, and then only the categories you pick.
• Never gives financial advice, and never recommends a specific product. Uncover explains what you already have.

Your data lives in a Postgres database and private file storage run by Supabase, hosted in Sydney, Australia. It’s encrypted in transit and at rest.

Every table has row-level security switched on, which means the database itself refuses to return another person’s rows — access is checked on every single query, not just in the app. Uploaded documents go into a private storage bucket that isn’t reachable from the public internet. When you open one, Uncover mints a link that expires after sixty seconds.

AI processing happens on the server. Keys never reach your browser, and your policy documents are never made public.

Payments are handled by Stripe. You type your card into Stripe’s own page; Uncover never sees or stores the number, and couldn’t charge it outside your subscription.

Uncover gives Stripe your account email, so it can send your receipts, and an internal household id, so a payment can be matched to Uncover. Nothing about your policies or claims. Uncover keeps your Stripe customer and subscription ids and what the subscription currently says — whether it’s active, when it renews, and whether you’ve cancelled.

Deleting your account deletes your Stripe customer first, which cancels the subscription and removes the saved card. Stripe keeps its record of payments already made for as long as tax law requires; that record is Stripe’s, under its privacy policy.

Uncover does not hold ISO 27001, SOC 2, or any other independent security certification. It’s an early product, and claiming otherwise would be untrue.

What’s true today is described above: encryption, row-level access control enforced by the database, private document storage, and server-side AI processing. The infrastructure Uncover is built on carries its own certifications, but that is the provider’s accreditation and not Uncover’s. As Uncover grows, formal certification is the right next step, and this page will say so plainly when it happens.

Uncover keeps diagnostic records of how well it read each document — how long it took, which fields it couldn’t confirm, and what the model sent back. A named operator can open those to work out why a document was read badly, and that record can contain details from your policy.

It exists to make extraction better, it is used for nothing else, and it is not how anyone browses your policies for interest. It’s written here because a page describing what Uncover does with your data should describe all of it.

Removing a policy from Uncover deletes the details extracted from it and the file behind it — the document is removed from storage, not just unlinked.

You can delete your whole account yourself, from your profile: every policy, document, reading, claim and answer in the households you set up goes — for everyone you shared them with, too — and the files go out of storage with them. It is permanent, not archived, and Uncover cannot undo it. If you can’t sign in to do it, harshae.raniga@gmail.com and it will be done for you.

If something here isn’t clear, or you want to know what Uncover holds about you, email harshae.raniga@gmail.com and a person will answer. Uncover is small enough that it really is a person.