Privacy Policy

1. Who is responsible

The controller for your personal data under the EU General Data Protection Regulation (GDPR) is Robyn Goldstein, Pfarrhofgasse 2a, 1030 Wien, Austria. Contact: hello@overstand.app. See also the Impressum.

2. What we collect

• Account data: your email address and, if you sign in with Google, your name and profile picture as provided by Google. Passwords are stored only as a secure hash by our authentication provider.
• Study data: the exam plans you create (subject, exam date, goals, syllabus, instructions), lessons, quizzes, your answers, grades, mistakes, progress, review schedules, notes and chat messages.
• Uploaded materials: the text and images extracted from files you upload (for example PDFs, slides or photos of notes). We store the extracted content, not the original file.
• Settings: your preferences, such as teaching language and lesson depth.
• Subscription data: your plan (Free or Pro) and usage counters. When payments launch, payment details are handled by our payment provider; we never see or store your card number.
• Feedback: anything you send us through the Feedback button or a topic rating, together with the page you were on, the subject and topic, your device and browser type, and any recent error messages — so we can find and fix the problem. A cheap AI pass sorts each message by type and urgency.
• Survey answers: if you choose to answer our optional survey (for a reward), your answers — for example how you found Overstand, what you study for, your age range and what you’d pay — linked to your account so the reward is given only once.
• Technical data: IP address and basic request logs that our hosting provider records to keep the service running and secure.
• Usage statistics: anonymous counts of which pages are visited, the referring site, and the country, device and browser type, through Vercel Web Analytics. It uses no cookies and does not identify you or follow you across other websites.

We do not use advertising, tracking pixels or analytics cookies, we do not sell your data, and we do not use it to build advertising profiles.

3. Why we use it (legal bases)

• To provide Overstand to you — create your plans, generate and grade content, save your progress (Art. 6(1)(b) GDPR, performance of our contract with you).
• To keep the service secure, prevent abuse and enforce plan limits (Art. 6(1)(f) GDPR, our legitimate interest in a safe, working service).
• To handle payments, invoices and tax records (Art. 6(1)(b) and (c) GDPR, contract and legal obligations).
• To answer you when you contact us, and to use your feedback to fix problems and improve Overstand (Art. 6(1)(b) or (f) GDPR).

4. AI processing

Overstand’s lessons, quizzes, grading and chat are generated by OpenAI’s models. When you use these features, the relevant content — for example your topic, your uploaded materials, your answers or your chat message — is sent to OpenAI to produce the response. OpenAI processes this data on our behalf. Under OpenAI’s API terms, data sent through the API is not used to train their models, and it may be retained for up to 30 days for abuse monitoring before deletion.

Please don’t put sensitive personal information (for example health details or other people’s private data) into your materials or chat.

5. Who processes your data

We use these service providers, each bound by a data processing agreement:

• Supabase — database and user accounts.
• Vercel — hosting of the website and servers, and anonymous usage statistics (Vercel Web Analytics).
• Resend — sending account emails, such as sign-up confirmation, password reset and the welcome email.
• OpenAI — AI generation of lessons, quizzes, grading and chat (see section 4).
• Google — only if you choose “Continue with Google” to sign in.
• Lemon Squeezy — payments, once Pro subscriptions launch. Lemon Squeezy acts as the seller (merchant of record) and processes your payment and billing details under its own privacy policy.

Some of these providers are based in, or process data in, the United States. Transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses.

6. Shared plans

If you create a share link for a plan, anyone with that link can view that plan’s roadmap and copy it. Links are long and random, so they can’t be guessed, but anyone you send one to can pass it on. Your answers, grades and chat are not shared.

7. How long we keep it

• Your account and study data: until you delete a plan or your account. Deleting your account (Settings → Account → Delete account) permanently erases your account, plans, uploads, progress, notes and settings straight away.
• Backups of our database are overwritten on a rolling basis, so deleted data disappears from them within a few weeks.
• Payment and invoice records: as long as tax law requires (in Austria generally 7 years), kept by the payment provider.

8. Children and young people

You must be at least 13 to use Overstand. If you are under 16, please use Overstand only with the permission of a parent or guardian, and a parent or guardian must take out any paid subscription. If we learn that someone under 13 has created an account, we will delete it. Parents can contact us at hello@overstand.app to review or delete their child’s data.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted (you can do this yourself by deleting your account);
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw any consent you gave, at any time.

To exercise any of these, email hello@overstand.app. You also have the right to lodge a complaint with a data protection authority — in Austria, the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna (dsb.gv.at).

10. Cookies and local storage

We only use what is strictly necessary for Overstand to work: a login cookie that keeps you signed in, a cookie that remembers whether you chose English or German for the interface, and your browser’s local storage for small preferences (for example which vocabulary practice modes you chose). There are no tracking or advertising cookies, so no consent banner is needed.

11. Security

All connections are encrypted (HTTPS). Access to each account’s data is restricted at the database level so that only you can read your plans. No system is perfectly secure, but if a breach affecting your data ever occurs, we will notify you and the authority as the law requires.

12. Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email before the change takes effect. The date at the top shows the latest version.