Draft: needs legal review. Not in force yet.

Privacy

Overhand is built so that we see as little as possible. The controller for the hosted services is Craftly Oy (Finland).

What never reaches us

• Your code, your agents' work, your dashboard's contents, your tokens and keys. They stay on your computer. With Access from anywhere, your browser talks to your computer directly over an encrypted WebRTC connection; when NAT forces a relay, Cloudflare's TURN service carries the encrypted traffic without being able to read it.
• Your push notifications' contents: your computer encrypts them for your browser and sends them through your browser's push service (Apple, Google or Mozilla), not through us.

What we keep

• Your account: your email address and an account id, from sign-in through WorkOS.
• Your subscription: plan, seat count, status, renewal date, and Paddle's customer and subscription ids. Paddle holds your payment details and invoices; we never see your card.
• Your computer's link: we sign a certificate binding your computer's public key to your account; we don't store it, and we never hold your computer's private key.
• Operational logs at Cloudflare (requests to the relay), kept briefly for security and debugging.

Processors

• Cloudflare (hosting, signalling, TURN, database)
• WorkOS (sign-in)
• Paddle (payments, tax, invoices; merchant of record)

Your rights

You can ask for a copy of your data or for its deletion, and cancel your account at any time. Deleting your account removes your subscription record once Paddle's legal retention allows. Ask at hello@overhand.dev. You may complain to your data protection authority; in Finland, the Data Protection Ombudsman.