Privacy policy

What we collect

• Brand admin accounts: email, hashed password, workspace content you create, and billing identifiers handled by our payment provider when you subscribe.
• User accounts (connected providers): When you sign in with or connect a third-party account, we store the identifiers and profile details that provider supplies, plus encrypted OAuth tokens where we need them to fetch data on your behalf. Current providers:
  • Strava: athlete id, display name, and avatar. We request read and activity:read_all for your activities. The editor's saved-routes feature additionally requests read_all for planned private routes.
  • WHOOP: user id, name, and email. We request offline, read:profile, read:workout, read:recovery, read:sleep, and read:cycles.
  • Google: account id, verified email, name, and avatar where you choose Google sign-in on hubs that do not need connected activity data. We do not store Google API tokens.
• Usage: favourite brands, overlay copy events, product interaction events, and aggregate hub metrics. These are first-party records with no third-party cookie and no free-form content; anonymous events store only a salted, non-reversible hash of your IP.
• Notifications: your notification preferences and, if you enable push, the web-push subscription for your browser or device.
• Contact form: name, email, and message content.
• Technical: short-lived server logs (IP address, user-agent, request metadata) and strictly necessary session and consent cookies.
• Analytics (with consent only): pageviews and conversion goals via a privacy-focused analytics provider. We never send your email, name, or free-form content as analytics parameters.

Connected activity and wearable data

When you connect a fitness or wearable provider, we fetch the workout, activity, and related metrics needed to personalise overlays — for example Strava activities and planned routes, or WHOOP workouts, recovery, sleep, and strain. That data is fetched on demand and is not stored in our database. It is not shared with brands.

Some wearable metrics (such as recovery, sleep, and heart-rate variability) are health-related. We process them only to render the overlays you request, on the basis of the consent you give when you connect that provider.

Revoke access in /profile/settings or in the provider's own account settings. Each provider's practices are described in their privacy policy: Strava, WHOOP.

Why we use it

• Contract: creating and running your account, integrations you authorise, and paid plans you subscribe to.
• Legitimate interests: security, abuse prevention, service improvement, and sending you notifications about activity from integrations you connect, which you can turn off at any time in your notification settings or via the unsubscribe link in any email.
• Consent: non-essential analytics cookies, which you can withdraw via "Cookie preferences" in the footer; and health-related wearable data, which you can withdraw by disconnecting that provider.

You must provide account data to use authenticated features; we do not use automated decision-making with legal or similarly significant effects.

Who we share with

We use service providers to operate OVRLAY, including providers for hosting and data storage, transactional email, payment processing, and (only after consent) product analytics. We also exchange data with the providers you sign in with or connect (currently Strava, WHOOP, and Google). We do not sell personal data or share it with advertisers. A current list of our sub-processors is available on request.

International transfers

Where a provider processes personal data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request more detail at privacy@ovrlay.io.

Retention

Account data is kept until you delete your account. OAuth tokens for connected providers are removed on disconnect. Activity and wearable data is not retained. Notification preferences and push subscriptions are kept until you disable them or delete your account. The consent cookie lasts up to 13 months after your last choice. Operational logs are kept for 30 days.

Cookies

Strictly necessary cookies keep you signed in and remember your analytics choice. Analytics cookies load only if you accept them in the consent banner. See "Cookie preferences" in the footer to change your choice.

Your rights

Depending on where you live, you may access, correct, delete, export, restrict, or object to our processing, and withdraw consent. You can delete your account from /profile/settings; otherwise email privacy@ovrlay.io. You may complain to your supervisory authority. In Ireland this is the Data Protection Commission.

Children

OVRLAY is not directed at children under 16 and we do not knowingly collect their personal data.

Changes

We will post updates here and change the "Last updated" date when anything material changes.