Privacy Policy

Version 2026-11-10-draft

DRAFT — not reviewed. This document has not been reviewed by a lawyer. It is not final, and words in [BRACKETS] are still to be filled in.

This policy says what Overtrain, run by [COMPANY NAME] ("we"), stores about you, what it passes through without storing, what it cannot see, and who else is involved. Contact: [CONTACT EMAIL].

What the relay stores

• Your account: your email address; a hash of your password (scrypt, never the password itself), or the account ID Google or Apple gives us if you sign in with them; whether your email is verified; your two-factor secret (needed to check your codes) and hashes of your recovery codes; the invite code and invite wave you joined with; your notification settings; when you accepted these terms and which version.
• Your devices: a name and browser description for each browser or phone you sign in on, a hash of its sign-in token, when it was last used; and, if you turn on notifications, the push token or Web Push subscription that lets us reach it.
• Your machines: each paired machine's hostname, agent version, a hash of its token, and when it was last online; short-lived pairing codes while you pair one.
• Sharing: the email address of each person you share a machine with, what they may do, and which sessions or projects you chose.
• Credits and billing: your credit history (coupons, purchases, refunds, machine charges with the hours they covered); your Stripe customer ID, the IDs of payments and Stripe events we have processed, and your plan and its period end. Card details go to Stripe only; we never see or store them.
• Cloud machines: each one's name, size, region, state, cloud instance ID and network address, its sleep setting, and, if its first start fails, the end of its start-up log (with secrets removed) so we can tell you what went wrong.
• Product metrics: a log of events such as "signed up", "paired a machine", "an agent started", "a notification was opened", "a payment was made", each with your account's random ID, a time, a short label (like "claude" or "t4g.medium") and a number. It holds no session content, file paths, folder names or command text. Agents appear in it only as opaque codes that even we cannot link back to a session.
• The waitlist: if you join it, your email address and any note you add.
• Server logs: the relay's logs record events such as sign-ins, sign-ups and password resets with the email address involved, and errors. They are kept for [LOG RETENTION — e.g. the system default of N days].

What passes through but is not stored

Your sessions — conversations with your agents, code, terminal output, files you open, and what you type — stay on your machines. To show them on your devices they pass through the relay while you are connected.

• Machines with end-to-end encryption on: session content is encrypted between your trusted browser and the machine. The relay cannot read it; it sees only that encrypted data is flowing, how much, and when.
• Machines without end-to-end encryption: session content passes through the relay unencrypted in the relay's memory (encrypted on the network by HTTPS). The relay does not save it, but it could technically read it while it passes. Turn on end-to-end encryption to prevent that.
• Activity reports: each machine tells the relay every minute how many people are viewing it, how many agent turns are running and how busy its CPU is, so an idle cloud machine can sleep. This is kept in memory only.

What never leaves your machines

Your Claude and Codex logins and API keys stay on the machine where you signed in to them or where you added them. If you add an API key from the app, your browser or phone encrypts it end to end for that machine before sending it: it passes through the relay only as ciphertext the relay cannot read, and Overtrain never receives it in readable form. Your code and files stay on your machines too, except as they pass through while you view them.

Notifications

Notifications are fixed text such as "Claude needs approval" or "A session finished". On machines with end-to-end encryption on, that is all they say. On other machines they also name the project folder the session runs in (for example, "Claude needs approval in shop-api"). They never contain your prompts, code or command text. They are delivered by the push services listed below.

Who else is involved (processors)

• Amazon Web Services hosts the relay and cloud machines in the United States ([CONFIRM: region, e.g. us-east-1]) and stores encrypted backups of the relay's database in S3, made hourly and deleted after 30 days.
• Resend sends our emails (verification, password resets, security alerts, invites), so it receives your email address and the message.
• Stripe processes payments and subscriptions. It receives your email address, and your card details directly from you; it may keep records as the law requires.
• Push services deliver notifications: Expo (for the iPhone and Android app), which passes them to Apple and Google; and, for browser notifications, your browser's push service — Google, Mozilla, Apple or Microsoft.
• Google and Apple, if you sign in with them.
• Telegram, only if you set up a Telegram bot on a machine: that machine messages Telegram directly; it does not pass through us.
• Anthropic, OpenAI and other AI providers receive what your agents send them, from your machines, under your own accounts and their policies. We are not part of that exchange.

We do not sell your data or use it for advertising. There are no third-party analytics or tracking scripts in the app or on these pages.

On your devices

The app keeps your sign-in token, preferences and a cached copy of your session lists in your browser's or phone's storage, so it opens quickly. Signing out clears them. We use no tracking cookies.

Deleting your account

Email [CONTACT EMAIL] from your account's address and we will delete your account. That deletes your devices, machines, shares, pairing codes, notification settings, credit history and cloud machines with it. What remains:

• Product metrics events stay, keyed by your account's random ID, which is then linked to nothing. [DECISION: keep these pseudonymous events after deletion, or delete them with the account.]
• Backups of the database that include your account until they expire, 30 days after they were made.
• Server logs until they expire.
• Stripe's records of your payments, which Stripe and we keep as tax and accounting law requires.

Sessions and files on your own machines are yours to delete. Your cloud machines and their disks are destroyed as part of deleting the account. [DECISION: offer self-service account deletion in the app (today it is by email).]

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, and to complain to a data protection authority. Contact [CONTACT EMAIL]. [DECISION: GDPR/UK representative and lawful bases, if serving the EU/UK.]

Changes

Each version of this policy has a version string (below). When it changes, we will ask you to accept the new version before you continue using the Service.