Privacy Policy

This Privacy Policy explains what information Over-N-Out (the "Service") collects, how we use it, and the choices you have. Over-N-Out is provided by DadPro Technologies ("we," "us," "our").

We try to keep this short and honest. If anything below is unclear, email us at support@overnoutapp.com.

1. Information We Collect

Information you give us when you create an account

• Email address — used for authentication, account recovery, and important service notices
• Callsign — your chosen public display name, visible to other users on wires you join
• Authentication identifier — if you use Sign in with Apple, Apple provides us with a stable opaque identifier (and, if you choose, an email relay address). We do not receive your real Apple ID.

Information generated when you use the Service

• Subscription status — whether you have an active Personal subscription, the expiration date, and the product identifier. Payment details (credit card, billing address) are processed by Apple and are never sent to us.
• Push notification token — an Apple Push Notification service (APNs) token used to deliver invitation, approval, and request notifications. We do not use this token for marketing.
• Wire data — the name of any wire you have claimed; the list of users you have approved or denied access to your wires; pending join requests.
• Friends list — the callsigns of users you have added as friends.
• Recent wire history — the names of wires you have recently joined (stored on your device for quick-join; not synced to our servers).

Information that is not stored

• Voice transmissions — your voice is routed in real time through our LiveKit server and delivered to other participants on the wire. It is not recorded, archived, or stored on our servers in any form.
• Wire Captions transcripts — speech-to-text transcription is performed entirely on your iPhone using Apple's on-device speech recognition. The audio and resulting text are never sent to us or to Apple. (If we later add a paid "caption history" feature, transcripts saved through that feature will be stored on our servers, retained for 30 days, and clearly described before you opt in.)

Information we do not collect

• We do not use any third-party analytics SDKs (no Google Analytics, no Mixpanel, no Sentry, no crash reporting service).
• We do not use advertising identifiers (IDFA) or the iOS App Tracking Transparency framework.
• We do not collect location data.
• We do not access your contacts.

Diagnostic information

The Service writes diagnostic logs to your device for troubleshooting. These logs may include connection events, error codes, and the names of wires you have joined. They are stored on your device and are not transmitted to us unless you explicitly contact support and choose to share them.

2. How We Use Information

We use the information described above only to:

• Provide the core Service (route voice, deliver push notifications, enforce wire access permissions)
• Authenticate your account and manage your subscription
• Send service-related communications (subscription receipts, important account or policy changes)
• Detect, prevent, and respond to abuse, fraud, or violations of our Terms of Service
• Comply with legal obligations

We do not use your data for advertising, behavioral profiling, or sale to data brokers.

3. How We Share Information

We share information only with the third-party service providers we rely on to operate the Service ("sub-processors"). Each is bound by a written agreement requiring confidentiality and security.

Sub-processor	Purpose	Location
Apple Inc.	Sign in with Apple authentication, In-App Purchase processing, Apple Push Notification service	United States
Supabase Inc.	Database, authentication, and serverless edge functions	United States (AWS us-east)
Hetzner Online GmbH	Server hosting for our self-hosted LiveKit voice infrastructure	Germany

We may disclose information if required by law, subpoena, or other valid legal process, or to protect the rights, property, or safety of DadPro Technologies, our users, or the public.

We will never sell your personal information.

4. Data Retention

• Account data (email, callsign, subscription status, friends, wire memberships) is retained while your account is active. If you delete your account, this data is deleted from our active databases within 30 days. Backups are retained for up to 90 days and then deleted on a rolling basis.
• Push tokens are deleted when you sign out, uninstall the app, or revoke notification permission.
• Diagnostic logs on your device are retained until you uninstall the app or clear them manually.
• Voice transmissions are never stored and have no retention period.

5. Your Rights and Choices

For all users

• Stop using the Service. Uninstall the app at any time.
• Sign out. Sign out from within the app to revoke active sessions.
• Disable push notifications. iPhone Settings → Notifications → Over-N-Out.
• Manage subscription. iPhone Settings → [Your Apple ID] → Subscriptions.

For users in the European Union, United Kingdom, and California

Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated personal data
• Export a copy of your account data in a portable format
• Object to or restrict certain types of processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email privacy@overnoutapp.com. We will respond within 30 days.

We do not "sell" personal information as defined by the CCPA, and we do not share personal information for cross-context behavioral advertising.

6. International Data Transfers

If you use Over-N-Out from outside the United States, your data may be transferred to and processed in the United States and Germany (where our infrastructure operates). Where required by law, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

7. Children's Privacy

Over-N-Out is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

For users aged 13–17 in the United States, we comply with applicable provisions of state youth-privacy laws. Outside the United States, the digital age of consent in your country may apply (in the European Union, this is typically 16, but member states may set it as low as 13).

8. Security

We use industry-standard security measures including encrypted transport (TLS) for all client-server communication, encrypted-at-rest database storage, hashed credential storage, and least-privilege access controls. No system is perfectly secure; we cannot guarantee absolute security.

If we become aware of a personal-data breach that materially affects you, we will notify you and the appropriate authorities as required by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least 14 days before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

10. Contact