Privacy notice
Last updated: [date of the version approved at G4]
What this website collects, why, how long it's kept and what you can ask us to do about it, in plain words.
The short version
- This website does not ask you for any personal data. There is no account, no form and no sign-up.
- We count visits and clicks on the "download" and "repository" buttons, per channel, as totals only. [TO COME (counting method, before 29 October 2026): one sentence on how, once the method is fixed.]
- If you use the light/dark switch, your choice stays in your browser. It is not sent to us.
- If you email us, we use your message and email address to answer you.
- When you click to download OverPowered or to see its code, you go to GitHub. GitHub's own privacy statement applies there.
- We do not sell your data, and we do not use advertising or tracking cookies.
- Questions: [TO COME (D1): contact email address].
Who we are
This website (getoverpowered.ai) is run by [TO COME (D2, OQ-11): company legal name], registered in [TO COME (D2, OQ-11): country], [TO COME (D2): postal address]. In this notice, "we" and "us" mean that company. We decide why and how your personal data is used (in legal terms, we are the "controller").
Contact for anything about your data: [TO COME (D1): contact email address].
[LAWYER: if no company is registered by 29 October 2026, who is the controller (for example the person who runs the site), and how this section names them.]
[LAWYER: Data protection officer. State whether one has been appointed and give the contact, or remove this line.]
[LAWYER: Representative in the EU. Needed only if the controller is not established in the EU and Art. 3(2) applies; then give the representative's name and contact. Depends on D2.]
What this notice covers
This notice covers this website only. The OverPowered app runs on your own computer once you download it from GitHub. [TO COME (Saif, before 29 October 2026): whether the app sends any data to us, or to anyone other than the AI tools you connect it to, for example usage statistics, crash reports or update checks.] [IF the app sends nothing: The app does not send us any data about you or your work.] [IF the app sends data: The app has its own privacy notice: [link]. It must exist before 29 October 2026.]
What we collect, why, and on which legal basis
| What | When | Why | Legal basis [PROPOSED, decided at G4] | How long we keep it |
|---|---|---|---|---|
| Technical data your browser sends with every request: IP address, browser type, the page requested, the referring page, date and time | Every visit | To deliver the pages to you and to protect the website against attacks | Our legitimate interest in running a working and secure website (Art. 6(1)(f)) [LAWYER: balancing test] | [TO COME (SF-025, omar-devops): whether the server keeps logs, and for how long; proposed: the shortest period security needs] |
| Visit counts per channel: the page address (including the tag of the link you came from), the referring page and [TO COME (counting method): any other field the method uses, for example browser type or country] | Every visit | To count visits per channel, as totals only | Our legitimate interest in knowing which channels bring visitors (Art. 6(1)(f)), [IF the method stores or reads anything on your device: your consent (Art. 6(1)(a)), asked before anything is stored] [LAWYER] | Totals are kept. [TO COME (counting method): how long the raw data is kept before only totals remain] |
| Clicks on the download and repository buttons, with the channel tag of the visit | When you click one of them | To count how many visitors from each channel go on to get OverPowered, as totals only | As the row above, proposed | As the row above |
| Your theme choice (light or dark) | Only if you use the theme switch | To show the site in the theme you chose on your next pages and visits | Not sent to us. It stays in your browser (see "Cookies and storage in your browser") | Until you clear your browser's site data |
| What you write to us by email, with your email address and any name you give | Only if you write to us | To answer you | Our legitimate interest in answering messages (Art. 6(1)(f)) [LAWYER: or Art. 6(1)(b) where you ask about a contract] | Until your question is answered, then [TO COME (G4): period] |
We do not ask for your name, phone number, payment details or any sensitive information (such as health, religion or political opinions). There are no user accounts on this website, and nothing on it asks for your email address.
Do you have to give us anything?
No. You can read the whole website, and download OverPowered, without giving us any personal data. If you email us, we need your email address to answer.
Decisions made automatically
We do not make decisions about you based only on automated processing. Visits that look automated, and our own visits, are left out of our counts; this has no effect on you. [LAWYER: confirm this is enough for Art. 13(2)(f).]
Cookies and storage in your browser
- We set no cookies. [TO CONFIRM by ines-qa on the built site, after SF-025.]
- Theme choice. If you use the light/dark switch, your choice is saved in your browser's local storage under the name
op-theme, so the next page opens in the same theme. It is not sent to us. If you never use the switch, nothing is saved; the site follows your device's setting. - Visit counts. [TO COME (counting method): what, if anything, the counting method stores on or reads from your device.] [IF it stores or reads anything: a consent banner asks you first, and refusing is as easy as accepting (NFR-PD-05, NFR-PD-06); this section then lists each item.]
- No advertising, social media or tracking cookies, and no tracking pixels.
[LAWYER: confirm that the theme storage needs no consent under the ePrivacy rules (storage of a preference the visitor sets with the switch). If consent is needed, a consent banner is added and this section is rewritten.]
When you leave this website for GitHub
The "download" and "repository" buttons take you to GitHub, where OverPowered's app and code are published. GitHub is run by another company. Its privacy statement applies to the personal data that "GitHub, Inc. or GitHub B.V." processes as the "Data Controller": https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. We do not control what GitHub collects.
[TO CONFIRM (the human and Saif): GitHub shows a repository's owners totals, such as how many times a release file was downloaded and how many visitors the repository had in the past 14 days. We use only those totals.] [LAWYER: whether this sentence is needed, and its wording.]
Who receives your data
We do not sell or rent your data, and we do not share it for advertising.
- Our hosting provider runs the server that delivers this website and sees the technical data of every request: [TO COME (SF-025): provider name, its role (on our behalf, as our "processor", or not) and its contract]. [The human said Saif will host the site on his own server.]
- Our counting method, if it uses an outside service: [TO COME (counting method): provider name and role]. [IF the counting runs on our own server: no outside service receives this data.]
- Our email provider receives the emails you send us and the emails we send you: [TO COME (D1): provider name]. [LAWYER: role and contract.]
- The people who run OverPowered. Only [TO COME (the human): who reads the counts and the contact mailbox, by role] can see them.
- Authorities, only if the law requires us to disclose data. [LAWYER: wording.]
Transfers outside your country
[TO COME (SF-025, D1): where the server, any counting service and the email provider process data.] [IF any of them is outside the European Union: name the safeguard for each transfer, and how a person can get a copy.] [LAWYER]
How we keep your data safe
[TO CONFIRM by khaled-security before publishing, against the built site:] Every page is served over HTTPS only. Visit and click counts are stored as totals; network identifiers never enter our code repository, working documents or reports. Messages to us stay in the mailbox and are not copied elsewhere.
Your rights
You can ask us, free of charge, to:
- give you a copy of the data we hold about you (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- give it to you in a common format, or send it to someone else (portability);
- stop using it, where we rely on our legitimate interest (objection).
[IF consent is used for the counting method: You can withdraw your consent at any time, from the link on every page. Withdrawing it is as easy as giving it, and it does not affect what we did before.]
In practice, we hold very little that can be linked to you: an email you sent us, and technical data that we keep only for a short time. [LAWYER: wording for rights requests about server logs or counts we cannot link to a person.]
How to ask. Email [TO COME (D1): contact email address] and say what you want. If your request is about an email you sent us, write from that address, so that we do not give your data to someone else.
When we answer. Without undue delay and within one month of receiving your request. If a request is complex, or we receive many, we may need two more months; if so, we tell you within the first month and explain why. If we cannot do what you ask, we tell you why within one month.
Complaints. You can complain to a data protection authority, for example in the country where you live or work. We would appreciate the chance to help first. [LAWYER: name our lead authority once D2 is known, and adjust this section for visitors in the UK, the US and other countries.]
Children
This website is meant for adults and businesses, not children, and it asks nobody for personal data.
Changes to this notice
If we change this notice, we update the date at the top.
Contact
[TO COME (D2, OQ-11): company legal name], [TO COME (D2): postal address]. Email: [TO COME (D1): contact email address].