Privacy policy

What we collect

• Brand admin accounts: email, hashed password, workspace content you create, and billing identifiers handled by our payment provider when you subscribe.
• User accounts (Strava): Strava account id, display name, avatar, and encrypted OAuth tokens so we can fetch your activities and planned routes on your behalf. We request only read, read_all, and activity:read_all.
• User accounts (Google): Google account id, verified email, name, and avatar where you choose Google sign-in on hubs that do not need Strava data. We do not store Google API tokens.
• Usage: favourite brands, overlay copy events, product interaction events, and aggregate hub metrics. These are first-party records with no third-party cookie and no free-form content; anonymous events store only a salted, non-reversible hash of your IP.
• Notifications: your notification preferences and, if you enable push, the web-push subscription for your browser or device.
• Contact form: name, email, and message content.
• Technical: short-lived server logs (IP address, user-agent, request metadata) and strictly necessary session and consent cookies.
• Analytics (with consent only): pageviews and conversion goals via a privacy-focused analytics provider. We never send your email, name, or free-form content as analytics parameters.

Strava activity data

Activity data is fetched on demand to render overlays and is not stored in our database. It is not shared with brands; brand-facing metrics are aggregate counts only. Revoke access in /profile/settings or in your Strava settings. Strava's own practices are described in the Strava Privacy Policy.

Why we use it

• Contract: creating and running your account, integrations you authorise, and paid plans you subscribe to.
• Legitimate interests: security, abuse prevention, service improvement, and sending you notifications about activity from integrations you connect, which you can turn off at any time in your notification settings or via the unsubscribe link in any email.
• Consent: non-essential analytics cookies, which you can withdraw via "Cookie preferences" in the footer.

You must provide account data to use authenticated features; we do not use automated decision-making with legal or similarly significant effects.

Who we share with

We use service providers to operate OVRLAY, including providers for hosting and data storage, transactional email, payment processing, and (only after consent) product analytics. We also exchange data with Strava and Google when you choose to sign in or connect those accounts. We do not sell personal data or share it with advertisers. A current list of our sub-processors is available on request.

International transfers

Where a provider processes personal data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request more detail at privacy@ovrlay.io.

Retention

Account data is kept until you delete your account. Strava tokens are removed on disconnect. Activity data is not retained. Notification preferences and push subscriptions are kept until you disable them or delete your account. The consent cookie lasts up to 13 months after your last choice. Operational logs are kept for 30 days.

Cookies

Strictly necessary cookies keep you signed in and remember your analytics choice. Analytics cookies load only if you accept them in the consent banner. See "Cookie preferences" in the footer to change your choice.

Your rights

Depending on where you live, you may access, correct, delete, export, restrict, or object to our processing, and withdraw consent. You can delete your account from /profile/settings; otherwise email privacy@ovrlay.io. You may complain to your supervisory authority. In Ireland this is the Data Protection Commission.

Children

OVRLAY is not directed at children under 16 and we do not knowingly collect their personal data.

Changes

We will post updates here and change the "Last updated" date when anything material changes.