Privacy policy

Last updated: 2 October 2026

This privacy policy is also available in German. Both versions say the same; if they differ, the German version applies.

1. Controller

Gurwinder Singh
Waldstr. 148
63263 Neu-Isenburg
Germany

Email: info@getovr.app

I have not appointed a data protection officer because there is no legal obligation to do so.

2. The ovr app

2.1 Principle: no data collection

ovr is local-first. Everything you enter in the app – contracts, subscriptions, deadlines, payments, meter readings, documents, notes and your sender details for cancellation letters – is processed and stored on your device. ovr does not transmit this data to me or to third parties. The app contains no analytics, crash-reporting, advertising or tracking libraries and no account or login system. That’s why ovr’s App Store privacy label reads “Data Not Collected”.

2.2 Storage on the device

The data is kept in the app’s protected storage on your iPhone and in an app group shared only with the ovr widget and the ovr share extension. It is protected by your device’s iOS security features.

2.3 Optional iCloud sync

If you turn on iCloud sync in the settings, ovr also stores your data in your private CloudKit database in your iCloud account. This database is operated by Apple; as the developer, I have no access to it. Apple’s privacy policy and your iCloud settings apply. You can turn sync off at any time. With sync off, nothing leaves the device.

2.4 Face ID

The optional app lock uses Face ID (or the device passcode) through the iOS LocalAuthentication framework. iOS performs the face recognition; ovr never gets access to biometric data and only learns whether unlocking succeeded. Face ID locks only the app’s screen; the widget can still show deadlines while the app is locked.

2.5 Notifications

Reminders about deadlines and payments are local notifications that iOS schedules and shows on your device. There is no push server. ovr asks for permission once; you can change it at any time in the iOS settings.

2.6 Bank CSV import

When you import a CSV file from your online banking, you pick the file yourself. ovr reads it on your iPhone, suggests recurring charges and keeps only the entries you confirm. ovr doesn’t keep the other transactions. If you hand the file over via “Share → ovr”, a copy sits in the app’s inbox on your device until you delete it there. ovr never connects to your bank and never knows your login details.

2.7 Documents, scans and camera

You can import contracts as PDFs, file them via “Share → ovr” or scan them with the camera. For scanning, iOS asks for camera access. Text recognition and reading out details run on the device (Apple Vision or Apple Intelligence’s on-device models). No documents are sent to me or to third parties.

2.8 Widget, Siri and Shortcuts

The widget shows deadlines and payments from the local data. If you use ovr with Siri or the Shortcuts app, Apple processes your voice request under Apple’s terms; ovr itself sends nothing to me.

2.9 Cancellation letters, PDF export and links

ovr drafts cancellation letters. Only you send them, for example from the Mail app or as a shared PDF; the terms of your email provider or of the app you share with then apply. Links to providers’ cancellation pages open in the browser, where that provider’s privacy policy applies.

2.10 App Store and crash reports

Downloads and updates go through Apple’s App Store; Apple is responsible for that. If you have turned on “Share with App Developers” in iOS, Apple gives me anonymised crash reports and aggregated usage statistics in App Store Connect. I can’t identify you from them. You can turn this off under Settings → Privacy & Security → Analytics & Improvements.

2.11 Export and deletion

You can export your data at any time under Settings → Data & Sync and delete it completely there with “Delete all data”. If you only delete the app, iOS removes the local data; you can also delete data in your iCloud in your iPhone’s iCloud settings.

3. This website (getovr.app)

3.1 No cookies, no tracking

This website sets no cookies, stores nothing on your device, uses no analytics or tracking services and loads no content from third parties (fonts, scripts and images are all served from this server). There are no forms.

3.2 Hosting and server logs

This website is hosted by: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you open a page, the hosting provider processes technically necessary data: IP address, date and time, requested address, referrer URL, browser and operating system (user agent), amount of data transferred and status code. This is needed to deliver the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is secure and stable operation. A data processing agreement under Art. 28 GDPR is in place with the hosting provider. The provider deletes the logs after a short time (Cloudflare doesn’t publish a fixed period; they are kept only as long as needed for operation and security). If the provider is based in the USA, transfers rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR).

3.3 Contact by email

If you write to me, I process your email address and the content of your message to answer your request (Art. 6(1)(b) or (f) GDPR). I delete the message once it’s resolved, unless statutory retention periods apply. Please don’t send me real contract or bank details.

4. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time (Art. 7(3)). Because the app sends no data to me, your app data stays with you alone, and you can export and delete it directly in the app.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, HBDI), Postfach 3163, 65021 Wiesbaden, Germany, https://datenschutz.hessen.de.

5. Other

There is no automated decision-making or profiling. ovr is not directed at children. If the app or this website changes in a way that processes data differently, I’ll update this policy beforehand.