Overplay

Overplay

Privacy Notice

Last updated 18 October 2026

Artem Svitelskyi operates Overplay Cloud at overplay.app and is the controller of the personal information described here. For privacy requests, contact a.svitelskyi@gmail.com.

Cloud and Community

This notice applies to Overplay Cloud, our managed service. The Community edition is free, source-available software that anyone can run on their own server. We do not receive or process data from Community servers. The person or organization that runs a Community server is responsible for its accounts, data and privacy notice. Contact your server operator about a self-hosted installation.

Information we process

Account. Your email address, first and last name, an internal username, password hash, email verification status and account creation time. We never store your password itself. If you turn on two-factor authentication, we also store your authenticator secret, hashes of your recovery codes, and short-lived sign-in records that count wrong codes.

Google and Apple sign-in. If you continue with Google or Apple, we receive your account ID at that provider, your verified email address and, the first time, your name. Google also sends a link to your profile photo; a new or newly connected account without a picture saves a small copy of it as the profile picture. With Apple you may share a private relay address instead of your email. We ask for nothing else: no contacts, files or calendar. You can remove a sign-in method in Account.

Profile pictures and project logos. A picture you upload, cropped and resized to 240 by 240 pixels in your browser before upload. Your picture shows next to your name in the dashboard, in the widget and on pins, and a project logo shows on the project. Anyone with the image address can open it, like most profile pictures, so do not upload anything private. Remove it any time in Account or the project's Settings; removing it deletes our copy.

Projects. Project names, website addresses (origins), project settings, memberships and roles, and requests to join a project with the website they came from.

Comments and replies. The text you write, its author and times, edit history counters, resolved state, and where the note belongs: the page address, the page title, the pin position, the element selector, a short readable name for the element (for example "Button Save in Settings") and, when needed, the menu steps used to show that element again. If the page address contains query parameters or a fragment, they are stored too. We also keep a project activity log of created, edited, resolved and deleted notes, with the author and time, but not the comment text.

Sessions. Hashed sign-in session records for the dashboard and for each website where you sign in to the widget. Dashboard sessions last up to 30 days. Email links for verification and password reset expire after one hour.

AI agent connections (MCP). If you connect an AI agent, we store the connection name, the projects and permissions you granted, your sharing choices, the expiry date, the last time it was used, hashed access tokens, and the agent app's name and return address. We keep an audit log of each agent action (tool, project, target and outcome, without comment text) for 90 days. The agent reads only what you granted, and what it does with that data is governed by the agent provider's own terms.

Billing. When you subscribe, we store Paddle customer, transaction and subscription identifiers, subscription status, plan (Pro or Max) and billing-period dates, and your monthly usage count. Paddle collects your payment details directly. We never receive full card numbers or card security codes.

Enterprise requests. If you send the Enterprise form on the pricing page, we store your name, work email, company, role, team size, hosting choice, company website and message. We use them only to answer you, email you a copy, and email our team. We delete a request after 12 months. To delete it sooner, write to the support email below.

Technical data. We use your IP address in memory to apply request rate limits. We do not store IP addresses or browser user agents in our database. Cloudflare processes request information, which can include IP addresses, request paths, timestamps and error details, to host, log and protect the service.

How information is used

We use this information to create and secure accounts, send verification, password reset and project membership emails, show feedback to authorized project members, enforce plan limits, manage subscriptions and provide support. We do not sell personal information, and we do not use it for advertising or analytics profiles.

Project members see comments, replies and the names of their authors in their project. The widget does not show your email address to other members. The project owner sees the email addresses of people who ask to join, in the dashboard and in request emails, so they know who they are approving. A member's email shows in the owner's member list only after that member asked to join or signed in to the project's widget. Being added by the owner alone does not reveal it. Install the widget only where you have permission, and tell your website users about the feedback tool.

Service providers

We use these providers to run the service. Their infrastructure can process information in countries outside your own.

Cookies and browser storage

We use only cookies and storage that the service needs to work. There are no analytics, advertising or tracking cookies, so we do not ask for consent. The cookie notice on our website tells you this once and remembers that you dismissed it.

You can clear cookies and site data in your browser at any time. Clearing the session cookie signs you out.

Retention and deletion

Comments and replies stay until a member deletes them, the project owner deletes the project, or the account is deleted. Deleting a project removes its comments, replies, members, join requests, widget sessions, logo and activity log. Account information is kept while the account exists and as needed for security, billing and legal obligations.

Deleting your account removes it at once, together with the projects you own and everything in them, your comments and replies in other people's projects (including replies others left under your comments), your profile picture, memberships, join requests, sessions, AI agent connections, two-factor data, usage counts and our billing records. Activity log entries in other projects stay without your name. While a paid subscription is active, cancel it in the billing portal before you delete the account.

Every day we remove expired sessions, email links, connection codes and agent tokens. Enterprise requests are removed after 12 months. Agent audit entries and payment webhook records are removed after 90 days. Backups kept by our providers may hold copies until their normal retention period ends.

Your choices and rights

You can edit or delete your own comments, delete projects you own, and disconnect AI agents in the dashboard. In Account you can download your data as a JSON file and delete your account yourself. To correct your account or for any other request, email us from your account address. We may need to verify that the account is yours. Depending on where you live, you may also have the right to object, restrict processing, or complain to your data protection authority.

Canceling a subscription does not delete your account or comments. Billing records held by Paddle follow Paddle's retention practices and legal obligations.

Changes

We will update this notice when the service changes how it handles personal information, and change the date at the top.