Overplay

Security

Last updated 16 October 2026

This page describes how Overplay Cloud at overplay.app protects your account and your team's feedback. The source code of the service and the widget is public on GitHub, so you can check what is written here.

Hosting and data location

The website, dashboard, API and MCP server run as one Cloudflare Worker. Accounts, projects, comments and settings are stored in a Cloudflare D1 database. Cloudflare serves requests from its global network and chooses where the database is kept, so data can be processed outside your country. We do not run our own servers.

Encryption in transit

Connections to the service use HTTPS (TLS), handled by Cloudflare. Website pages are sent with Strict-Transport-Security for one year, so browsers use HTTPS only. Pages also send a Content Security Policy, refuse to be framed, and do not send a referrer.

Passwords

Passwords need at least 12 characters. We store only a scrypt hash (N=32768, r=8, p=3) with a random salt for each password, never the password itself. Sign-in is rate limited per IP address, and the response is the same whether or not an account exists.

Sessions

• Signing in sets one cookie, __Host-cw_session. It is HttpOnly, Secure and SameSite=Lax, and lasts up to 30 days or until you sign out.
• Session and email link tokens are 256-bit random values. The database keeps only their SHA-256 hashes.
• The widget on a website gets its own token that works for one project and that website only, for one hour.
• Dashboard requests that change data must come from the service's own origin.
• A password reset signs out every session and revokes AI agent tokens.

Two-factor authentication

You can turn on two-factor authentication in Workspace → Account. Sign-in then asks for a 6-digit code from an authenticator app (TOTP, RFC 6238) after your password. This also covers widget sign-in and AI agent (MCP) authorization, because both use your dashboard session. You get 10 one-time recovery codes; we store only their hashes. A used code cannot be used again, wrong codes are limited, and a password reset does not turn two-factor off.

The authenticator secret is kept on the server so it can check codes. It is encrypted with AES-256-GCM when the server has an encryption key set; otherwise it is stored like other account data in the database.

AI agents (MCP)

Agents connect with OAuth and PKCE or with a token you create. Each connection is limited to the projects and permissions you choose, tokens are stored as hashes, and you can pause or revoke a connection at any time. Each agent action is logged for 90 days without comment text.

Payments

Paddle is our merchant of record and collects payment details directly. We never receive card numbers. Payment webhooks are accepted only with a valid Paddle signature, and plan changes are read back from Paddle before they apply.

Providers

• Cloudflare: hosting, database, rate limits and account emails.
• Paddle: payments, tax, invoices and refunds.

The Privacy Notice lists what each provider processes.

Backups

We do not make separate backups. Cloudflare D1 keeps its own point-in-time recovery (Time Travel) for a limited period, 7 to 30 days depending on the Cloudflare plan. Deleted data can stay in that recovery window until it expires.

Your data

In Workspace → Account you can download your data as a JSON file and delete your account. Deleting an account removes the projects you own with everything in them, your comments and replies in other projects, your memberships, sessions and agent connections. Delete is blocked while a paid subscription is active; cancel it in the billing portal first.

Community edition

A self-hosted Community server runs the same code on Node.js and SQLite. Its operator is responsible for its hosting, HTTPS, backups and accounts. Operators can set TWO_FACTOR_KEY to encrypt two-factor secrets.

Report a vulnerability

Please report security problems privately through GitHub: open a private security advisory. Only the maintainers see it. Do not open a public issue, and do not test against other people's accounts or data. The security policy explains scope and supported versions. Our security.txt has the same contact.