Privacy
What we store
Without an account, nothing on our servers. Your brands, campaigns, prompts and pictures live in your browser, and your API key on your device. With an account, we store your email, your name if you give one, and your workspace: brands, campaigns, prompts, the pictures you upload and the pictures made. You can choose to save an encrypted account key that our server decrypts for your requests, or keep a passphrase backup that only your browser can open.
Where your API key goes
Device keys send generation requests from your browser. Account keys send requests through Overs. Overs also uses your key to save finished videos directly into your cloud library. Keys are stored only when you choose an account key or an encrypted backup.
Where your pictures go
The reference pictures you upload are sent to the AI model you chose, through OpenRouter, as part of your request. If you are signed in, they are also saved in your private workspace so your team can see them. Otherwise they stay in your browser.
Who else sees anything
Four companies help us run Overs: Supabase holds accounts and workspaces, Resend sends our emails, Stripe takes payments, and Vercel hosts the site and counts page views without cookies. We never sell your data and never share it for ads.
Deleting it
You can delete your account from your account page. It goes at once, with every workspace only you belong to. Backups are cleared within 30 days. Without an account, clearing your browser data deletes everything, and we cannot get it back.
1. Who we are
Overs is run by 2587689 Alberta LTD., a company in Calgary, Alberta, Canada, at #315, 405 64 Ave NE, Calgary, Alberta, Canada T2J 6J6. It was founded by Abhi Chawla. We are the “controller” of the personal data described here, which means we decide what is collected and why. For anything about your data, write to abhi@paperkites.co.
This policy covers the Overs website and app at overs.studio. It does not cover OpenRouter, the AI model makers, Stripe’s checkout pages, or any other site we link to. They have their own policies.
2. What we collect, and why
If you never sign in
We collect nothing about you on our servers. Everything Overs makes and remembers is stored in your browser, on your device. Your API key is stored on your device only. If you clear your browser data, all of it is gone and we cannot restore it, because we never had it.
If you create an account
- Your email address and a password. We never see the password. Supabase stores a scrambled version that cannot be turned back into the password.
- Your name and a picture, if you add them, so the people in your workspace know who you are.
- The date you accepted the Terms and which version, so we have a record of what you agreed to.
- Your workspace: brands, brand notes and research, campaigns, prompts, the pictures you upload, the pictures made, and notes left on them.
- Who is in your workspace and who you have invited, by email address.
- Your plan, and a count of how many pictures your workspace kept this month, so we can apply the limits of your plan.
- Your API key, only when you choose to save it. Account keys are encrypted with a secret kept outside the database; our server decrypts them to make your requests. Passphrase backups remain encrypted in your browser with a passphrase we never receive.
If you pay for a plan
Stripe takes your card details on its own pages. We never see your card number. Stripe gives us a customer id, which plan you bought, and whether payments succeed or fail. Stripe also keeps your billing address and invoices, which you can see from your account page.
Emails we send
We send emails to confirm your address, to reset your password, to confirm a change of address, and to tell you about changes to prices, these terms, or the service. Stripe sends receipts. We do not send marketing email. Our emails go through Resend, which records the address, the time, and whether the message was delivered.
Page views
We use Vercel Web Analytics to count page views and see where visitors came from. It sets no cookies and does not follow you to other sites. Before a page address is sent, we strip the private parts: a campaign page is counted as /studio/campaign/[campaignId], not by its real id, and anything after a question mark is dropped. Your brands, pictures, prompts and key are never part of it.
Server logs
Like every website, our hosts keep short-term logs of requests: the IP address, the time, the page, and the browser type. Vercel and Supabase keep these for security and to fix faults, for a short time and never longer than 30 days. We do not use them to profile you.
3. Where your API key goes
Your OpenRouter key authenticates model requests over HTTPS. Device keys send generation requests from your browser. If you save an account key, Overs decrypts it on the server and sends those requests to OpenRouter. Finished cloud videos are fetched by Overs and saved directly into your private library. A device key used for that save passes through our server for the request and is not stored by the download service.
Account keys use AES-256-GCM encryption with a secret kept in deployment settings, separate from the database. Our server can decrypt these keys. You can replace or remove yours in Keys. Saving an account key is optional and does not convert an existing passphrase backup. Those backups can only be opened with your passphrase.
4. Where your pictures and prompts go
When you run a step, the pictures and text that step needs are sent to OpenRouter, directly or through Overs when you use an account key, which passes them to the AI model you chose. What those companies do with them is covered by their policies, not ours. OpenRouter lets you choose which model makers may receive your requests and whether they may keep them; that setting is on your OpenRouter account.
If you are signed in, your uploads and the pictures made are stored in a private bucket at Supabase. Only people in your workspace can open them, and every request is checked against that. Pictures are fetched with your sign-in, so there is no link that can be passed around. Nothing in your workspace is public unless you share it on purpose.
6. Where it is stored
We are a Canadian company and our providers are mostly in the United States. If you are in Canada, the European Union, the United Kingdom, or somewhere else, your data crosses a border to get there, and the privacy laws in the United States are different from yours. By using Overs with an account, you agree to that. Our providers all sign contracts that hold them to protect your data.
7. How long we keep it
- Account and workspace data: for as long as you have an account. When you delete it, it is removed from the live database at once and from backups within 30 days.
- A workspace with other members survives when you leave it, because it is theirs too. The owner of that workspace can delete it.
- Billing records at Stripe: 7 years, because tax law requires it.
- Server logs: up to 30 days.
- Emails we sent you: Resend keeps a delivery record for a short time, and never longer than 30 days.
- Data in your browser: until you clear it. We have no control over it.
8. Your choices and rights
You can do most of this yourself, without asking us.
- Delete your account. Account page, at the bottom. It asks you to type a word to confirm, then it is gone.
- Download your work. Every campaign can be exported as a ZIP with the pictures and a file that says how each one was made.
- Change your name or picture. Account page.
- Leave a workspace. Account page, under the people list.
For anything else, email abhi@paperkites.co. You can ask for a copy of everything we hold about you, ask us to correct something, ask us to delete something, or ask us to stop using it in a certain way. We will answer within 30 days, and we will not charge you.
These rights come from Canada’s PIPEDA and Alberta’s Personal Information Protection Act. If you are in the European Union or the United Kingdom, you have the same rights under the GDPR, plus the right to take a copy of your data to another service and the right to complain to your local data protection authority. If you are in California, you have similar rights under the CCPA, and we do not sell or share your data as that law defines it.
If you are not happy with how we handled a request, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.
9. How we protect it
- Every connection is encrypted with HTTPS.
- Passwords are hashed by Supabase and never stored as typed.
- Every database row is checked against who is asking, so a person can only read the workspaces they belong to. The same check applies to picture files.
- Server requests use your signed-in account to check workspace access. Account keys are encrypted with a secret stored outside the database.
- Passphrase backups are encrypted in your browser before they leave, with a passphrase we never receive.
No system is perfect. If you find a security problem, please tell us at abhi@paperkites.co before you tell anyone else, and we will fix it as fast as we can. If a breach ever affects your data, we will tell you by email and report it to the authorities as the law requires.
11. Children
Overs is for adults at work. You must be 18 or older to have an account. We do not knowingly collect data from anyone under 18. If you think a child has made an account, email abhi@paperkites.co and we will delete it.
12. Changes to this policy
When we change this policy, the date at the top changes. If the change affects what we collect or who we share it with, we will email the address on your account before it takes effect.
13. Contact
2587689 Alberta LTD.
#315, 405 64 Ave NE, Calgary, Alberta, Canada T2J 6J6
abhi@paperkites.co
The Terms are the other half of the agreement.