Privacy Policy

Effective October 16, 2026

This Privacy Policy explains how Overlaify ("Overlaify", "we", "us") handles personal data when you use www.overlaify.com, the overlay studio, hosted overlay URLs, the overlay library and the Overlaify SDK (together, the "Service"). It should be read together with our Terms of Service. Overlaify is the controller of the personal data described here.

1. What we collect

Account information from Google or Twitch

You can sign in with Google or Twitch. We never see your password. With your permission, the provider gives us:

• Google (scopes openid email profile): your Google account ID, name, profile picture, and email address if Google has verified it.
• Twitch (scope user:read:email): your Twitch user ID, login name, display name, profile picture, and email address.

We store these together with an Overlaify user ID, the provider you used, and when you created your account and last signed in. We use the provider's access token once to fetch this profile and do not store it. Accounts created with Google and with Twitch are kept separate and are not merged.

Prompts and overlays

When you generate or refine an overlay, we receive your prompt (up to 2,000 characters), the overlay type you picked, the Fast or Smart tier, and, when you refine an overlay, its existing code. We store each result with its title, prompt, generated HTML, the overlay it was based on, your user ID, the AI model used, token counts and a timestamp. Please don't put personal information about yourself or anyone else in prompts.

Credits and usage

We keep your paid credit balance and a daily counter of free credits used. For each generation we record your user ID, the tier and model, token counts, cost and credits charged, and we keep a daily total per model that does not identify you.

Twitch channel name

If you type a Twitch channel name into the studio or library to preview chat, it is saved in your browser's local storage so it's filled in next time. It is added to the overlay URL you copy, but we don't store it on our servers.

Analytics and diagnostics

We use PostHog to see how the Service is used and to find problems. When you visit, PostHog records events such as the pages you view, the buttons and links you click, sign-in steps, overlay generations, copy actions and JavaScript errors, along with standard device data like browser type, screen size, referring page, approximate location derived from your IP address, and a random identifier stored in your browser. When you're signed in, we link these events to your Overlaify user ID, display name and sign-in provider. We do not send your email address to PostHog.

For each AI generation, our server also sends PostHog a record that includes your user ID, the full instructions and prompt sent to the AI (including any overlay code being refined), the code the AI returned, the model, token counts, how long it took, and any error message. We use this to monitor quality, debug failures and control costs.

Like most websites, our hosting provider, Cloudflare, processes your IP address, browser user agent and request details to deliver pages and protect the Service from abuse. Our server logs record generation usage (user ID, model, token counts, cost) and errors.

When you contact us

If you email us, we keep your email address and the content of your message so we can respond.

2. How we use it and why

• To provide the Service: sign you in, keep you signed in, generate overlays, host them at their URLs, let you reopen them in the studio, and track credits. Where GDPR applies, our legal basis is that this is necessary to perform our contract with you (the Terms).
• To keep the Service secure and fair: prevent abuse, enforce credit limits and our Terms, and handle copyright complaints. Legal basis: our legitimate interest in running a safe service, and legal obligations where they apply.
• To understand and improve the Service: product analytics, error tracking and AI generation monitoring in PostHog. Legal basis: our legitimate interest in making Overlaify work well. You can object at any time (see section 7).
• To communicate with you: reply to your messages and, where needed, tell you about important changes to the Service, our Terms or this policy. Legal basis: contract and legitimate interest.

We do not use your data for advertising and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Who we share it with

We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising as defined by California law. We use the following service providers, which process data on our behalf:

• Cloudflare hosts the website and our server code, and stores account, credit and overlay data.
• AI model providers. Your prompt, our instructions to the model and, when you refine, the existing overlay code are sent to the AI provider that generates the overlay. Today that is Anthropic (Claude models). We may use another provider that offers an OpenAI-compatible API instead. We send your prompt and overlay code, but not your name, email address or account ID.
• PostHog provides product analytics, error tracking and AI generation monitoring, as described in section 1. Browser traffic to PostHog is routed through our own subdomain, st.overlaify.com, and the data is stored in PostHog's US region.
• Google and Twitch handle sign-in when you choose them. Their own privacy policies apply to the data they hold about you.
• Google Fonts serves the fonts on our pages and, when an overlay uses them, in overlays. Your browser requests the fonts directly from Google, which receives your IP address.

We may also disclose information if required by law or valid legal process, to protect the rights, safety or property of Overlaify, our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.

4. Cookies and local storage

• ovl_sess: keeps you signed in. It's an HTTP-only, secure cookie that lasts 30 days, or until you sign out.
• ovl_oauth: protects the sign-in flow from forgery. It lasts 10 minutes.
• PostHog stores a random identifier and session information in your browser's cookies and local storage so it can tell visits apart.
• Local and session storage: the Twitch channel name you typed, the sign-in provider you clicked (until sign-in finishes), and a prompt you entered before being asked to sign in, so it's still there afterwards.

The first two are strictly necessary for sign-in. You can block or delete cookies and site data in your browser settings. If you do, you'll be signed out, and PostHog will treat you as a new visitor. Many ad blockers also block PostHog.

5. Hosted overlays and stream viewers

Anyone with an overlay's URL can load it and see its code. The editor can also show the overlay's prompt to anyone who has its ID. The overlay page doesn't show your name or email. Treat overlay URLs as unlisted links, and don't put anything private in prompts.

Overlays that react to chat connect directly from your streaming software to Twitch's public chat service anonymously, using the channel name in the URL. Chat messages, usernames and emotes travel between Twitch and the overlay; they are not sent to or stored by Overlaify. Overlay pages do not load PostHog.

6. How long we keep data

• Account information and credit balance: until you ask us to delete your account. Your profile is refreshed each time you sign in.
• Overlays and their prompts: for as long as we host them, which by default is until you ask us to delete them or your account. You cannot yet delete overlays yourself in the app; email us and we'll do it.
• Sign-in sessions: 30 days, or until you sign out.
• Free-credit counters: 48 hours. Daily usage totals (which don't identify you): 90 days.
• PostHog analytics and AI generation records: for the retention period set for our PostHog project, after which PostHog deletes them. We'll delete records linked to your user ID when you ask us to delete your account.
• Server logs: for the limited period Cloudflare keeps them.
• Emails: as long as needed to handle your request and keep a record of it.

We may keep some information longer where the law requires it, to resolve disputes, or to enforce our Terms, such as records of copyright notices or of accounts suspended for abuse.

7. Your rights and choices

Depending on where you live, including in the EU, UK and California, you may have the right to:

• access the personal data we hold about you and get a copy in a portable format;
• correct inaccurate data (your profile is updated from Google or Twitch each time you sign in);
• delete your account, your overlays and associated data;
• object to or restrict processing based on our legitimate interests, including analytics;
• withdraw consent, where we rely on it, without affecting processing that already happened;
• know what categories of personal information we collect, use and disclose, and opt out of sale or sharing (we don't sell or share it).

To make a request, email [email protected] from the address on your account, or tell us which Google or Twitch account you signed in with. We may need to confirm that the account is yours before acting. We'll respond within 30 days, or sooner if the law requires. We won't treat you differently for exercising these rights. You can also revoke Overlaify's access in your Google or Twitch account settings at any time. If you're in the EU or UK and you're not satisfied with our answer, you can complain to your local data protection authority.

8. Security

All traffic is encrypted with HTTPS. Session cookies are HTTP-only and secure, and generated overlays run in a sandbox isolated from overlaify.com. Access to stored data is limited to people who need it to run the Service. No system is perfectly secure, though, so we can't guarantee the security of your data. If we learn of a breach that affects your personal data, we'll notify you and the authorities as the law requires.

9. Children

The Service is not intended for children under 13, and you must be at least 13, and old enough to use Twitch in your country, to create an account. We don't knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, email us and we'll delete it.

10. International transfers

Overlaify and our service providers process data in the United States and other countries where they operate, which may have different data protection laws from where you live. Cloudflare runs a global network, PostHog stores our data in the US, and AI providers may process prompts in the US. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or our providers' certifications under the EU-U.S. Data Privacy Framework.

11. Changes to this policy

We may update this policy as the Service changes, for example when we add payments. We'll post the new version here with a new effective date. If a change is material, we'll also notify you in the Service or by email, where reasonable, before it takes effect.

12. Contact

Questions or requests about your privacy: [email protected]. See also our Terms of Service and Copyright Policy.