Privacy Policy

Version: November 4, 2026. Live identity onboarding remains closed.

What we collect and why

Account: email, chosen display name, handle, optional bio and location, public passkey keys, settings and join date. These provide your account and preferences. Your passkey private key and device biometric unlock data stay with your device/passkey provider. Approving an engagement action uses a short-lived challenge bound to your account, login session and intended action. We store an encrypted request binding and a hash of the request, not draft text, in that challenge. It expires after two minutes and is removed when consumed or by temporary-record cleanup. Approval may use face, fingerprint or device PIN, depending on your passkey provider.

Content: posts, replies, uploaded media, follows, interests, likes, bookmarks, reports and moderation records. Anonymous post authors are held in a separate encrypted restricted record and are not displayed publicly.

Verification: a keyed hash of an issuer-scoped ID number, a keyed phone hash, an encrypted phone number, a keyed vendor face reference and a duplicate-face result. Hashes are still personal data. We do not retain raw ID numbers, dates of birth, legal ID names, ID images or face templates in Overt’s database. Date of birth and country evidence are checked transiently for eligibility.

Waitlist and invites: email, signup time, public referral code, referral source and queue priority. A separate private link controls access to your waitlist status. We record privately who vouched for an account, the redeemed code and time, and invite-related abuse actions. Do not share the private status link.

Phone-only checks: vouched accounts can use a mobile phone check without providing ID or face data. We keep a keyed phone hash and encrypted number with check status, country and line type. The current flow is a local simulation and sends no SMS.

Security: necessary authentication/session and security logs, with limited access. Server logs can contain IP addresses and must have a documented retention limit before launch. No advertising identifiers, third-party analytics SDKs or session recording are used. Product metrics are daily aggregate counts.

Biometric consent — read before agreeing

The proposed verification provider, Didit, may collect your ID document and selfie and create biometric information to test liveness, compare your face to the ID and look for duplicate or banned identities. These checks are for eligibility, preventing duplicate accounts and abuse control. Overt does not receive or store a face template. Vendor processing is still part of our privacy responsibility.

Before collection, you must give a separate affirmative, written-style consent with the purpose, provider, retention period and deletion procedure disclosed. Overt records the consent version and time. Declining consent leaves public browsing available. There is no paid route around verification.

DO NOT ENABLE LIVE COLLECTION until the provider contract defines deletion of ID images immediately after the check, a lawful face-template retention period, cross-account duplicate search and ban enforcement, subcontractors, locations, access, withdrawal and deletion evidence. Deleting a full vendor session may also destroy future duplicate matching. The current implementation deliberately does not assume those are compatible.

Illinois BIPA, Texas biometric law and Washington law require attorney review, along with other applicable state privacy laws. Counsel must approve the consent text, public retention schedule, destruction deadlines and whether alternative verification is needed. No blanket claim of compliance is made by this draft.

Who sees information

The public sees the profile information you choose and public content. Anonymous posts do not show your profile or photo. Overt’s authorized staff may access private author links only for a documented report or narrowly scoped account-rights/abuse enforcement operation, with auditing. Infrastructure administrators with server/database access are an additional trust boundary. Protect and audit those accounts separately.

Service providers process only what is needed for hosting, verification, delivery or purchases, under approved terms. We do not sell personal data or share it for behavioral advertising. Legal disclosures follow the law-enforcement policy.

Retention and deletion — proposed schedule, not yet approved

Account/content: until deletion or removal, with a proposed 30-day maximum backup rotation. Active database deletion is implemented locally; backup erasure and provider propagation require deployment configuration and verification.

Failed verification attempts: retain minimal status/consent evidence only; propose 30 days for failed/abandoned attempts, subject to counsel review. No identity documents in application logs or queues.

Vendor images: immediate deletion after verification is a contractual launch requirement. Face references/templates: period and withdrawal behavior are unresolved and block live verification.

Anonymous links: keep while needed for the content and abuse/rights/legal obligations; account deletion removes the active link. Lawful preservation must be narrowly scoped, access controlled and time bounded.

Permanent bans: retain only necessary keyed ID/phone/face identifiers, without the encrypted phone number after account erasure. Review necessity at least annually; counsel must choose a justified final maximum retention period. Do not label retained identifiers anonymous.

Signup signals: keyed IP and self-reported random device hashes support abuse review, not identity proof. They are cleared after 30 days by scheduled cleanup. Temporary phone challenges are removed after expiry. Waitlist records remain until release/deletion or an approved retention limit; account deletion removes the matching waitlist entry. Vouch edges for a deleted invitee are removed; a deleted inviter is disconnected from surviving edges. Counsel must set a final retention limit for unused waitlist records and invite/audit history.

Audit/security records: counsel and security owner must approve durations, protected access and tamper-resistant archival. Do not put raw verification or payment payloads in logs.

Your controls and rights

Change profile and notification preferences, switch light/dark mode, block or mute users, download account data or delete your account in Settings. The standard export excludes private anonymous-author associations to avoid accidental disclosure. A separate authenticated privacy process must be operational before launch for full statutory access/correction requests, authorized agents and appeals. California rights, where applicable, include access, deletion, correction and restrictions on certain uses; do not discriminate for exercising them. Overt does not sell/share for advertising; honor applicable privacy signals.

A monitored privacy contact and identity-check process are required before launch. Do not publish a guessed email address as an operational contact. Contact details: TO BE PROVIDED BY THE OPERATOR.