Privacy Policy

The controller responsible for the processing of your personal data is: Michel Chamoun, Alsterdorfer Straße 488, 22337 Hamburg, Germany.

Email: contact@ooverlap.app

VAT ID: DE365419012

If you have any privacy-related questions or want to exercise your rights, you can contact us at contact@ooverlap.app.

This Privacy Policy applies to personal data processed through:

• the ooverlap mobile app for iOS and Android;
• the ooverlap website;
• event invitation pages and guest access pages;
• communications sent by us in connection with events or your account;
• support and other communications with us.

**3.1 Registered Users

People who create an ooverlap account and use the app or website while logged in.

**3.2 Invite Guests / LWV Guests

People who access an ooverlap invitation or event page through a link without creating a full account ("LWV" stands for "Link Without Verification").

Different features, visibility levels, and data flows may apply depending on whether you are a registered user or a guest.

ooverlap is offered only to individuals who are 16 years of age or older. Where applicable law in your country requires a higher minimum age, that higher age applies instead.

Consent from a parent or legal guardian does not permit use below this minimum age. ooverlap is not offered to persons under 16, and we do not operate a separate access model for minors.

To enforce this, we ask for your date of birth when you create an account and verify it on our servers. We store your date of birth, whether the check was passed, and the time it was confirmed. This data is used solely to establish eligibility, is retained for the life of your account, and is deleted when your account is deleted.

We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a person under 16, we may delete that information and disable related access or accounts.

We collect personal data that you provide directly, data generated through your use of the Services, and limited technical data required to operate, secure, and improve the Services.

**6.1 Account and authentication data

• email address;
• password credentials (processed securely through our authentication provider);
• authentication identifiers;
• sign-in method;
• username and display name.

If you sign in using Google or Apple, we may receive account data from those providers, such as your email address, name, and basic profile information.

**6.2 Profile data

• profile photo;
• cover image;
• bio;
• country;
• interests;
• links to social profiles or websites.

**6.3 Event and participation data

• event title, description, date and time, location;
• cover image or cover video;
• RSVPs;
• waitlist status;
• event roles and permissions;
• event history and related timestamps.

**6.4 Social and community data

• membership data;
• role information;
• invitations;
• associations with spaces, groups, and events;
• interactions with other users.

**6.5 User content

• chat messages;
• comments;
• poll questions and poll votes;
• list items and assignments;
• image uploads;
• audio messages;
• documents;
• PDF tickets;
• ride and pickup information;
• story or feed activity summaries.

**6.6 Financial and expense data

• amounts;
• descriptions;
• who paid;
• split information.

ooverlap does not currently process payment card data and does not currently provide payment processing inside the Services.

**6.7 Notifications and communication preferences

• push notification tokens;
• email preferences;
• notification settings;
• unsubscribe status.

**6.8 Support and contact data

• your name;
• email address;
• message contents;
• any attachments or details you provide;
• support history.

**6.9 In-app feedback

• the feedback type you choose (general, idea, bug or issue) and your message;
• your account identifier, so we can follow up and apply our deletion process;
• whether you allowed us to contact you. Only then do we look up your account email address to reply;
• technical context: app version and build, platform and operating system version, language, time zone, and the area of the app the form was opened from (for example an event).

We do not attach chat messages, guest lists, poll answers or other event content to feedback. We use feedback, based on our legitimate interest, to fix problems and improve the Services. It is read by authorised team members and forwarded to our support inbox by email. It is deleted when you delete your account.

**7.1 Data collected from LWV guests

• name;
• email address;
• RSVP status;
• event-related actions;
• comment content;
• poll participation;
• list participation;
• event notification opt-in status;
• session data required to maintain guest access;
• if you choose "Continue with Google": the email address, name and Google account identifier that Google confirms for you. Google also sends the address of your profile picture; we do not keep it.

**7.2 What guests can view on invite pages

Depending on the event setup, guests may be able to view: invitation title and description, hero image or hero video, host profile name, guest previews, event date, time and address, RSVP totals, polls and lists, a limited gallery preview, and comments.

**7.3 Actions available to LWV guests

• RSVP;
• write and read comments;
• participate in polls;
• view and edit lists;
• download or add calendar information;
• receive event-related emails if they explicitly opt in.

**7.4 Limited public visibility on invite pages

Invite pages may expose certain event information to anyone with the relevant invite link, including a limited set of guest previews, gallery images, comments, polls and lists.

**7.5 Signing in with Google on invite pages

On the RSVP and waiting-list forms of an invite page you can choose "Continue with Google" instead of typing your name and email address. Your browser then goes to Google, which signs you in and shows you that it shares your name, email address, profile picture and Google account identifier with ooverlap. The invite page itself loads no Google script, so Google is not contacted until you choose this option, and the option is not offered inside in-app browsers.

We use this information only to confirm the email address of your guest record for this event, and we accept it only when Google reports the address as verified. It does not create an ooverlap account and does not sign you in to the app. We store the confirmed email address and the Google account identifier with your guest record. If you already entered a name on the invite page, we keep that name; the name from Google is used only when you have not entered one.

Google processes the sign-in on its own pages under its own privacy policy (https://policies.google.com/privacy). If you cancel at Google, you can enter your details on the invite page as before.

When an LWV guest provides their name and email address, we may create a guest record to support RSVP handling, comments, poll votes, list participation, and event communication.

When you sign in to the ooverlap app with an email address you have confirmed, we connect guest records from invite pages that use the same email address to your account. This happens automatically: your RSVPs, poll votes and list items from those invite pages then appear under your account, you can open those events in the app, and if an event belongs to a Space, you join that Space as a guest. The app may also list the events it found.

We do this only for a confirmed email address, because confirming it shows that the guest and the account holder are the same person. Guest records that use a different email address are never connected this way.

If the email address Google confirms on an invite page already belongs to an ooverlap account, the invite page may offer to add this RSVP to that account and shows the account's display name. Only the person who has just confirmed that address sees this offer. If you accept, your RSVP moves to your account and, if the event belongs to a Space, you join that Space as a guest. If you decline or leave the page, nothing changes.

When you use the Services, we may automatically collect limited technical and usage data, including:

• IP address;
• device type;
• operating system;
• browser type;
• app version;
• language settings;
• timestamps;
• request and response metadata;
• crash and error information;
• security logs;
• audit trail information for user actions;
• internal product usage metrics.

For invite pages, we may use a necessary session mechanism, including a session cookie, to maintain guest access and invite-page functionality.

**10.1 Necessary cookies and session technologies

For invite pages and certain website functionality, we may use necessary cookies or equivalent session technologies to keep sessions working, support invite-page interactions, maintain security, prevent misuse, and ensure the website functions properly.

If you choose to sign in with Google on an invite page, we set one short-lived cookie to secure that sign-in. Our Cookie Policy describes it.

**10.2 Browser caching and technical storage

Media and other website assets may also be cached by your browser or content delivery infrastructure as part of normal technical delivery.

ooverlap does not currently use third-party analytics or advertising cookies for behavioral advertising or ad targeting.

We do not perform background location tracking or continuous GPS monitoring.

We may process location-related data in limited cases, such as event locations entered by users, pickup points for ride coordination, profile-level location preferences such as city or country, or a one-time current location selected by a user when actively using a map or ride-related feature.

ooverlap offers an optional calendar sync so the app can suggest times when everyone is free. It is off until you turn it on. If you enable it and grant calendar permission, we read the events in the calendars you select, across a rolling twelve-month window starting from today.

We deliberately take only busy time ranges. Event titles, descriptions, locations, attendees and notes are never transmitted to us. What leaves your device is the start and end time of each event, the identifier of the calendar it came from, and whether it was an all-day entry. Adjacent and overlapping ranges are merged before upload, so what we store is a coarse picture of when you are busy — not what you are doing.

You choose which calendars are included, and you can disconnect at any time in Settings. Disconnecting deletes the stored availability data along with the connection.

Separately from sync, we may allow users or guests to add an event to their own calendar using an event file or platform intent, such as an .ics file or similar handoff.

**13.1 Event-related emails

We may send event-related emails where necessary to provide the Services or where the recipient has opted in. Examples include RSVP confirmations, event updates, rescheduling notices, location changes, cancellation notices, poll-result notices, reminders, and waitlist updates.

**13.2 Marketing emails

We may send occasional marketing or product-related emails to registered users. Registered users will have a clear ability to unsubscribe.

We do not use LWV guest email addresses for general marketing communications.

**13.3 Push notifications

Registered users may receive push notifications in the app, subject to device permissions and user settings.

We use personal data for the following purposes:

• to create and manage accounts;
• to authenticate users;
• to provide event planning and participation features;
• to enable spaces, groups, event communities, and guest access;
• to process RSVPs, polls, lists, comments, chats, galleries, rides, tickets, and related content;
• to send event-related communications;
• to send marketing communications to registered users where allowed;
• to maintain user preferences and settings;
• to support user requests and customer support;
• to secure the Services and prevent abuse;
• to investigate misuse, fraud, and violations;
• to maintain logs, records, and audit trails;
• to operate, troubleshoot, and improve the Services;
• to comply with legal obligations;
• to establish, exercise, or defend legal claims.

**Content review and moderation.** We may review User Content, including chat messages, direct messages, comments, and other communications, where reasonably necessary to respond to user reports, enforce our Terms of Service, investigate potential violations, comply with legal obligations, or protect the safety of our users. Content review may be performed by authorised team members or by automated tools. Separately, text you submit is automatically checked against our prohibited-content rules before it is published, and matching content is refused at the point of posting rather than removed afterwards. That check is applied to the text itself, is not retained, and involves no human review. We do not routinely monitor private conversations, but we may access specific content when a report is filed or when we have a reasonable basis to believe a violation has occurred.

**Reporting and blocking.** You can report content or users through in-app reporting tools. You can also block other users, which prevents them from contacting you or seeing your activity. When you block a user, we store that information to enforce the block across the platform.

**15.1 Performance of a contract

We process personal data where necessary to provide the Services you request, such as account creation and login, event participation, guest RSVP handling, in-app features, and event messaging.

This includes, under Art. 6(1)(b) GDPR, the optional sign-in with Google on invite pages (section 7.5), which you start yourself, and adding an RSVP to your existing account when you accept that offer on an invite page (section 8).

**15.2 Legitimate interests

We process personal data where necessary for our legitimate interests, including operating and improving the Services, securing the platform, maintaining logs and audit trails, preventing abuse and fraud, and enforcing our terms.

This includes, under Art. 6(1)(f) GDPR, connecting guest records with the same confirmed email address to your account when you sign in to the app (section 8), so that one person's participation is not split across two records, and securing the sign-in with Google against forged or reused confirmations.

**15.3 Consent

We rely on consent where required, including for certain guest email notifications, certain location uses, optional marketing communications, and certain optional permissions on mobile devices.

You may withdraw consent at any time for future processing where consent is the legal basis.

**15.4 Legal obligation

We may process personal data to comply with legal obligations, including recordkeeping and law-enforcement requests where valid.

**16.1 In-app visibility

Within the app, event participants may be able to see participant names and profile images, comments, lists, poll participation, ride information, gallery images, uploaded tickets, and other event-related contributions.

**16.2 Invite-page visibility

On invite pages, some event content may be visible without a full account, including event summary information, selected participant previews, comments, a preview of gallery images, and polls and lists for invited guests.

**16.3 Public and private distinction

Full galleries are restricted to event participants in the app. PDF tickets, ride information, and in-app chat are restricted to invited persons or event-related groups or spaces.

If you delete your account, we may delete or anonymize personal data associated with you, subject to legal, operational, and technical limitations.

Deletion takes effect immediately. Your account and profile are erased, the free text you wrote is overwritten, and your uploaded avatar and cover images are deleted. Residual copies may remain in backups for up to 30 days.

If you own a space and do not transfer it before deleting your account, that space becomes ownerless and is scheduled for deletion after a 14-day grace period, during which any remaining admin of that space can claim it.

Because ooverlap includes collaborative features, some contributions may remain within the event context but be anonymized so that other users can no longer identify the deleted user.

We may also retain limited information where necessary for security, fraud prevention, dispute handling, legal compliance, backup restoration cycles, or enforcement of our rights.

For instructions on how to delete your account, visit https://ooverlap.app/delete-account.

Our current retention approach generally includes:

• Account data: deleted when you delete your account, with residual copies remaining only in backups for up to 30 days;
• LWV guest data: generally until the relevant event has ended plus up to 180 days;
• Google sign-in confirmations on invite pages: usable for up to 15 minutes, then deleted automatically within two days;
• Unsubscribe / suppression records: up to 3 years;
• Audit trails and administrative logs: up to 12 months;
• Technical server and security logs: generally up to 30 days;
• Error and incident logs: generally up to 90 days;
• Backups: generally up to 30 days;
• Support communications: generally up to 24 months after the matter is closed;
• Media and uploaded content: until deleted by the user or the account is deleted.

We may share personal data with service providers and infrastructure providers that help us operate the Services, in categories including:

• authentication and database hosting;
• cloud hosting and deployment;
• email delivery;
• push notification delivery;
• content delivery and security;
• map and geocoding services;
• GIF and sticker search;
• OAuth identity providers;
• platform providers such as Apple and Google.

Our current or anticipated service providers include: Supabase, Vercel, Resend, Cloudflare, Google, Apple, Expo, Geoapify, and KLIPY.

GIF and sticker search is provided by KLIPY. When you open the GIF picker or run a search, your search terms, your app language, your IP address and a randomly generated identifier are sent to KLIPY. That identifier is generated on your device and is not your ooverlap account ID, so it does not identify you to KLIPY.

GIFs and stickers are loaded directly from KLIPY rather than copied onto our servers. This means that when a GIF is sent in a chat, KLIPY also receives the IP address of each person who views that message, not only the person who sent it.

We do not sell your personal data.

We primarily use infrastructure located in the European Economic Area or nearby European regions, including Supabase in eu-central-2, Vercel in eu-central-1 (Frankfurt), and Resend in eu-west-1 (Ireland).

Where personal data is transferred outside the EEA or UK, we will take steps to ensure that appropriate safeguards are in place as required by applicable law.

If you sign in with Google on an invite page, Google acts as an independent controller for the sign-in on its own pages; for users in the EEA this is Google Ireland Limited. Where Google processes this data in the United States, Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Our servers contact Google only to receive the confirmation described in section 7.5.

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit;
• secure transport over HTTPS/TLS;
• password protection and secure authentication flows;
• access controls;
• database security controls;
• row-level access restrictions;
• audit logging;
• validation and abuse prevention measures.

However, no service can be completely secure, and we cannot guarantee absolute security.

As of the current product design, ooverlap does not currently do the following as part of its normal operation:

• no background GPS tracking;
• no continuous live location tracking;
• no contact list syncing;
• no device advertising ID collection for ad targeting;
• no payment card data processing;
• no third-party analytics SDKs for behavioral analytics;
• no sale of personal data for advertising purposes.

If this changes in the future, we will update this Privacy Policy.

Depending on your location and applicable law, you may have rights regarding your personal data, including the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to certain processing;
• request portability of your data;
• withdraw consent where processing is based on consent;
• complain to a supervisory authority.

You can exercise your rights by contacting us at contact@ooverlap.app. We may need to verify your identity before responding.

If you are in the European Union, you may also have the right to lodge a complaint with the competent data protection authority in your country.

The Services may contain links to third-party websites, services, or apps. We are not responsible for the privacy practices of third parties. You should review their privacy notices separately.

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice through the app, the website, by email, or by other reasonable means. The "Last updated" date at the top indicates the latest revision date.

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact:

contact@ooverlap.app

Postal address: Michel Chamoun, Alsterdorfer Straße 488, 22337 Hamburg, Germany