Who is responsible
overlay.win is run by one independent developer: a single person, not a company, with no employees (“we”, “us”). We decide what is done with your data and why. Write to [email protected] for anything about your data. If the law entitles you to more details about who we are, ask at [email protected] and we will give them to you.
The short version
Recordings, clips, notes, themes, settings and everything you do inside the App stay on your PC. We do not see them. The account exists to tie your licence to your devices and to let you share plugins when you choose to. Below is the whole list of what we keep.
What we store on our servers
- Account: email, login, a hash of your password (Argon2id; we never store the password itself), the date the account was created.
- Licence: the plan, when it started and ends, and a hash of the licence key; the key itself is shown to you once and not kept.
- Devices: for each PC signed in with the loader, a name you can edit, a hardware fingerprint made of one-way hashes of the motherboard, CPU, disk, network adapter and Windows machine identifiers (never the identifiers themselves), the IP address and time of the last sign-in.
- Sessions: for each browser and loader session, a hash of the session token, the IP address, the browser's user-agent string, and when it was created and last used.
- Activity: a log of sign-ins, failed sign-ins, purchases, device changes and password changes with the time and IP address, kept for 90 days.
- Two-factor sign-in: if you turn it on, the secret behind your authenticator codes (encrypted) and hashes of your recovery codes.
- Friends and sharing: your friend list and pending requests, and the themes and presets you choose to share (their settings and name). Deleting your account removes them.
- Payments: handled by our payment provider; we receive a confirmation and an order reference, not your card details.
What stays on your PC
Recordings and replay clips, notes, files you open, browser data inside the App, plugin settings, themes, window layouts, and the loader's saved sign-in (stored with Windows Data Protection so only your Windows account can read it). None of this is uploaded unless you deliberately publish a plugin or theme to the marketplace.
Why we use it
To run your account and licence, to keep a licence to the number of PCs it allows, to stop someone else using your account, to detect abuse, to send you receipts and security notices, and to comply with the law. That is the whole list. We do not sell or rent your data and we do not show ads.
On what grounds
- To provide what you asked for (a contract): your account, your licence, the loader and the licence checks, the devices you sign in on, the friends and sharing features, payments.
- Our legitimate interest in keeping the service safe: the activity log, sign-in limits, the human check, blocking abuse and fraud, backups.
- A legal duty: keeping accounting records and answering lawful requests.
- Your consent: the optional cookie (remembering your theme). You can withdraw it at any time with “Cookie settings” in the footer.
Cookies
The website uses one cookie it needs, ow_session, to keep you signed in. It is HttpOnly, Secure and SameSite=Strict, and it is deleted when you sign out. The first time you visit, a notice asks what else you allow; your answer is remembered in a second cookie, ow_consent, for one year. The only optional thing today is remembering your theme (dark or light) in your browser's local storage: if you say no, the theme starts from your system setting on every visit. You can change your answer any time with "Cookie settings" in the footer. There are no tracking or advertising cookies and no third-party analytics.
The Assistant (Google)
The Assistant plugin is an AI chat. When you use it, what you type or say (as text), the conversation so far and the settings it needs to answer are sent through our server to Google’s Gemini API, which writes the answer. Our server passes the request on and does not store or log what is in it. Google processes it under its own terms for its API. Do not put passwords, keys or other secrets into the chat. Saying the wake word is recognised by Windows on your PC; nothing is sent until you speak or type a request. If you never use the Assistant, none of this happens.
Approximate location
The dashboard shows roughly where each sign-in came from (a city and country) so you can spot one that is not you. It is worked out on our own server from the IP address with a local database, so the address is not sent to anyone for this. The address itself is covered in the dashboard until you click it. IP geolocation by DB-IP.com.
Human check
Registration, sign-in and sensitive actions on the website use Cloudflare Turnstile to tell people from bots. Cloudflare sees the request the check runs in (your IP address and browser signals) and decides whether it looks human; we receive only pass or fail. Its terms and privacy policy apply to that check.
Who else sees it
Only the companies that run parts of the service for us, each for that part only and bound by contract to use the data for nothing else:
- OVHcloud hosts the server and its backups, in a data centre in Warsaw, Poland (EU).
- Cloudflare sits in front of the website: it provides DNS, TLS, protection against attacks and the human check (Turnstile). Every request to overlay.win passes through it, so it sees your IP address and the request itself.
- Stripe (or another payment provider shown at checkout) takes card and wallet payments once payments are switched on, and sends the receipt. Your card details go to Stripe and never to us; we receive a confirmation and an order reference.
- Google (Gemini API) answers Assistant requests, as described above, and only if you use the Assistant.
We do not sell or rent your data, we show no advertising and we use no analytics or tracking service, so there is nobody else. We disclose data when the law requires it.
Outside the EU
Cloudflare, Stripe and Google may process data in countries outside the European Economic Area, including the United States. Where that happens we rely on the safeguards those companies offer for it, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long
Account and licence data for as long as the account exists and for the period the law requires afterwards for bookkeeping. Session records until they expire or you sign them out. Activity for 90 days. Delete your account from the dashboard at any time; a lifetime licence cannot be restored afterwards.
Backups and logs
A backup of the server’s database is made every night and kept for 14 days; data you delete disappears from the backups when they expire. Our web server keeps no access log, only error messages. Cloudflare keeps its own request logs for security, under its own policy.
How we protect it
Passwords are stored only as Argon2id hashes. Authenticator secrets are encrypted. Connections use HTTPS only. Sign-in is limited and protected by a human check, optional two-factor sign-in and per-device licence checks, and every update the loader installs is checked against a signature that only we can make. No secret or provider key is ever stored in the website’s pages or in the App you download. Nothing can be perfectly safe; if we learn of a breach that puts your data at risk we tell you and the authority as the law requires.
Children
overlay.win is not meant for anyone under 16. If you think a child has an account, write to [email protected] and we will delete it.
Your rights
You can see, correct, export and delete your data from the dashboard, and you can ask us at [email protected]. Where the law gives you them, you also have the rights to restrict or object to processing, to data portability, and to withdraw consent. If you are in the EU/EEA or the UK you may complain to your data-protection authority (in Poland, the President of the Personal Data Protection Office, UODO).
Changes
If this policy changes in a way that matters, we tell you by email before it takes effect.