Privacy Policy

Overswan is made by Vivek Gowda S, an individual based in Bengaluru, India, who is responsible for your data under this policy (its “controller”). In this policy, “we”, “us” and “our” mean Vivek Gowda S. For anything about your privacy, email privacy@overswan.app.

Everything Overswan works with stays on your Mac: your clipboard history, notes, snippets, screenshots and recordings, the text it reads from the screen, the files it cleans, and your settings. None of it is sent to us or anyone else. There’s no account, and the app has no analytics, no ads and no tracking.

Some tools use macOS permissions, such as Accessibility, Screen Recording, the camera, the microphone or Calendar. Each is optional, asked for only when you turn on a tool that needs it, and what it gives Overswan never leaves your Mac.

To activate Overswan, and then when it opens and about once a day, Overswan checks its license with our server at api.overswan.app. It sends:

• the license key;
• an ID made from your Mac’s hardware, as a one-way hash that can’t be turned back into anything about your Mac;
• your Mac’s name (as set in System Settings), its model, and the versions of macOS and Overswan.

The server keeps a hash of the key (never the key itself), the IDs and names of the Macs it’s activated on (a license works on up to 2), and when it was last checked, so it can tell your Macs apart and stop a license that was refunded. Overswan keeps working offline for up to 30 days at a time.

Overswan looks for updates at api.overswan.app about once a day, using Sparkle. The request carries only what any web request does: your IP address and the app’s version.

Dodo Payments sells Overswan as our reseller and merchant of record. When you buy, you give your name, email address, billing address and payment details to Dodo Payments, not to us, and its privacy policy applies. Dodo Payments emails you your receipt and license key.

Dodo Payments tells our server about the order: the payment’s ID, amount, currency and country, the license key it issued, and whether the payment was refunded or disputed. We never see your card details, and we keep no names or email addresses from orders.

On a phone or another computer, you can send yourself one email with the link to Overswan, to open on your Mac. You give only your email address. We use it to send that one email, through Resend, and then forget it: we never store or log it.

To stop the form being misused, Cloudflare Turnstile checks that you’re a person; it processes your IP address and signals from your browser, as its privacy policy describes. We keep, for 8 days, a one-way keyed code made from your address, a code made from your connection and the time, so we can send at most one email to an address a day and three a week, whoever asks.

Every email has a link that blocks emails to that address for good, for anyone whose address someone else typed in. We keep a one-way keyed code made from a blocked address, never the address, so we can keep honouring it.

Our server’s logs shorten IP addresses and keep no license keys. Vercel, which hosts the website, keeps its own short-lived logs for security, including IP addresses.

If you email support@overswan.app or privacy@overswan.app, Resend, our email provider, receives and stores your message. We keep it, and our reply, for as long as we need to deal with it.

You can see and change what the site may use at any time in Your Privacy Choices, which is also linked at the bottom of every page. Overswan the app never contains any of these.

Always, because the site needs them. Your browser’s storage keeps your privacy choices and a random consent ID (“overswan.consent”, for 12 months after you say yes or 6 months after you say no), and, until you close the tab, the privacy rules that apply where you are (“overswan.region”). The thanks page remembers that it counted your purchase, so it counts it once.

Analytics. Google Analytics help us understand how people find and use the site, with cookies:

• Google Analytics (Google): Counts visits and purchases, and where visitors came from, so we can tell what works. Cookies: _ga and _ga_<ID>, up to 14 months. Privacy policy

Where you need to say yes first. In the European Union and European Economic Area, the United Kingdom, Switzerland, Brazil, Quebec, India (from 13 May 2027) and anywhere we can’t tell, nothing in “Analytics” or “Advertising” loads until you accept it in the banner.

Where they’re on until you switch them off. In the United States, Canada outside Quebec, Australia, New Zealand, Singapore, Japan, Hong Kong and, until 13 May 2027, India, the law lets you decide after you arrive: they’re on unless you switch them off in Your Privacy Choices. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of advertising, everywhere, and switch advertising off for you.

We work out which rules apply from the country your IP address is in, which Vercel tells the site for each visit; it isn’t stored. Each choice you make leaves an anonymous receipt on our server: your random consent ID, what you chose, the rules that applied and when. It contains nothing that identifies you, and we delete it after two years. It’s our record that we asked, as the law requires.

• There’s no account to create.
• Overswan the app has no analytics, ads or tracking, and never sends us what it works with.
• We never see your card details, and we keep no names or email addresses from your orders.
• We don’t use analytics or advertising cookies unless you allow them or, where the law works that way, until you switch them off.
• We never sell or rent your personal data.

We use your data only for these purposes:

• To sell you Overswan and keep its license working (activating it, checking it, and stopping it after a refund or dispute), and to offer updates. The legal basis is our contract with you, under Article 6(1)(b) of the GDPR; in India, it’s a legitimate use of data you gave us for that purpose, under section 7(a) of the Digital Personal Data Protection Act, 2023. We keep order records because tax and accounting laws require it, under Article 6(1)(c) of the GDPR.
• If you use Email me the link: to send you the email you asked for, and to stop the form being misused. The legal basis is taking the step you asked for, under Article 6(1)(b) of the GDPR, and our legitimate interest in preventing abuse, under Article 6(1)(f); in India, it’s a legitimate use of data you gave us for that purpose, under section 7(a) of the DPDP Act.
• To answer you when you write to us: taking the step you asked for, under Article 6(1)(b) of the GDPR, and in India a legitimate use of data you gave us for that purpose.
• To keep the server and the license check secure and stop abuse, with shortened or hashed IP addresses: our legitimate interest, under Article 6(1)(f) of the GDPR.
• For analytics and advertising: your consent, under Article 6(1)(a) of the GDPR and the cookie laws of the EU and UK, which you can withdraw at any time in Your Privacy Choices. Where the law lets you decide after you arrive, your right to opt out, which we honour straight away.

A few providers help us run the website, licenses and our email:

• OVHcloud hosts our license server and its database, on a server in Canada.
• Vercel hosts the website.
• Resend, Inc., in the United States, sends our emails and receives the emails you send to our overswan.app addresses. You can read its privacy policy.
• Cloudflare runs the Turnstile bot check on the Email me the link form, which processes your IP address and signals from your browser to tell people from bots. You can read how Cloudflare handles this data in its privacy policy.

Dodo Payments sells Overswan as our reseller and merchant of record. For your purchase it’s a controller in its own right, and its privacy policy applies. To activate a license, our server sends it your license key and your Mac’s name.

The analytics and advertising companies above (Google) receive data about your visit only as this policy describes. Some of them also use it for their own purposes, such as improving their services; for that, they are controllers in their own right, and their own privacy policies, linked above, apply.

These providers may process your data outside the country you live in, including in Canada and the United States. Where the law requires it, these transfers are protected by appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

We keep a license’s records for as long as the license exists, and order records for as long as tax and accounting laws require. If you ask us to delete a license’s records, the license stops working.

We keep emails you send us, and our replies, until we no longer need them to help you or for your license.

Email me the link keeps no email address. The codes it keeps for its limits, with the time of each request, are deleted after 8 days. The code made from a blocked address is kept for as long as we send email, so we can keep honouring it.

Our server’s logs, with shortened IP addresses only, are overwritten as they fill up. Vercel keeps its logs for a short time, as its own policy describes.

Cookies last as long as listed above. Google Analytics keeps data about visits for 14 months. Consent receipts are deleted after two years. Advertising companies keep what they receive as their own policies describe.

You can:

• Ask for a copy of the data we hold about you.
• Correct it if it’s wrong.
• Ask us to delete it.
• Withdraw your consent at any time, as easily as you gave it, in Your Privacy Choices.
• Object to how we use your data.
• If you’re in India, nominate someone to exercise these rights for you if you die or become unable to.

To do any of these, email privacy@overswan.app. We reply within 30 days. We may ask you to confirm the request comes from you, for example by writing from the email address you bought with.

If you have a complaint, write to us first at privacy@overswan.app: we’re the contact for grievances about your data. If you’re still unhappy, you can complain to a regulator: in India, the Data Protection Board of India; in the EU or UK, your local data protection authority.

Overswan and overswan.app aren’t meant for children under 16, and we don’t knowingly collect data from them. If you think a child has given us data, write to privacy@overswan.app and we’ll delete it.

Your data travels over encrypted connections (HTTPS). License keys are stored only as hashes, and the database isn’t reachable from the internet; access to it is limited to us.

When we change this policy, we update the date at the top of this page, and if a change is significant, we’ll say so on overswan.app. This is version 2026-11-05.