Privacy Notice

This privacy notice explains how Overshow ("we", "us") collects, uses and protects your personal data when you use our website and services.

By using our website or contacting us, you acknowledge this notice.

Who we are

Overshow is a local-first AI application developed and operated by San Digital Limited, a company registered in England and Wales.

• Company name: San Digital Ltd
• Company number: 12957488
• VAT number: GB361512914
• Registered office: San Digital Limited, Kendal House, Oxenholme Road, Kendal, England, LA9 7RL
• Email: hi@over.show

San Digital Limited is the data controller for personal data collected through the Overshow website and licensing services.

Personal data we collect

We collect and process the following categories of personal data:

• Contact form data
  • Name
  • Email address
  • Company name
  • Any other information you choose to include in your message
• Licensing and single sign-on (SSO) data
  • Name
  • Work email address
  • Company/organisation
  • SSO identifiers and metadata (for example, unique ID from your identity provider, role or group membership where required for access control)
• Mobile account and installation data
  • Microsoft account name, email address and identity identifier used to sign in
  • Overshow user ID, random mobile installation ID, platform, app version, and account/session lifecycle timestamps
  • IP address and limited security metadata used to protect sign-in and rate-limit abuse
• Optional connected provider data
  • Identity provider name and account identifiers for Google or Microsoft sign-in, calendar, and mail connections
  • Granted permissions or scopes, token expiry, and connection status metadata
  • Encrypted access tokens and refresh tokens used to maintain authorised Google Workspace or Microsoft 365 connections
  • Google Calendar or Microsoft 365 calendar names, event titles, attendees, locations, descriptions, times, response status, recurrence data, and meeting links exposed by the provider
  • Gmail or Microsoft 365 message and thread identifiers, sender and recipient details, subject, date, labels, snippets, message headers, and qualifying message body text
  • Local full-text and semantic search indexes, source links, and reply state derived from authorised calendar or mail data
• Technical and usage data
  • IP address
  • Browser type and version
  • Device information
  • Pages visited and actions taken on our site
  • Date and time of access

Overshow is designed as a local-first AI application. Model inputs and outputs processed locally by your organisation are not transmitted to us by default, except where you choose to share information with us for support or improvement purposes.

The Android recorder processes microphone audio and produces transcripts on the phone. It does not send microphone audio or transcript content to Overshow's account service. The account service receives only the mobile account and installation data described above.

If you enable optional Google Workspace or Microsoft 365 sync, app.over.show stores encrypted provider tokens and related connection metadata so the desktop app can refresh access securely. In normal operation, the desktop app calls the provider APIs directly to fetch authorised calendar or mail data. Overshow servers do not proxy normal calendar event or message payloads, and we do not routinely ingest or store those payloads in the web portal as part of normal sync.

For Gmail, Overshow first reads message lists, identifiers, labels, snippets, and selected headers. For messages that pass its on-device filtering, it temporarily retrieves message body text so the local mail pipeline can determine whether a reply is owed and produce a useful excerpt. Overshow stores only a bounded excerpt, relevant metadata, source links, derived reply state, and local full-text and semantic search indexes in the encrypted local database; it does not persist full message bodies in normal operation.

For the encrypted connected-provider token store at app.over.show, San Digital Limited acts as data controller for the account and connection metadata needed to operate licensing and delegated provider access; Google and Microsoft remain separate controllers for the source data held in their own services.

Voice data

Overshow stores no voice embeddings at all, not even your own. A voiceprint is biometric data under UK GDPR (Article 9), so Overshow is designed not to create that category of stored data in the first place. Speaker labelling within a meeting runs on your device, is never persisted as a voiceprint, and voices are never matched across meetings. Who said what across meetings comes from names, calendar context, and the people you confirm, never from voice matching.

Android recorder

The Android recorder is a separate, local-first meeting recorder:

• Recording starts only after you take an explicit action and Android displays a foreground recording notification.
• Microphone audio is held in bounded memory while an on-device speech model produces text. The app does not write raw audio to storage or send it to Overshow, Microsoft, or another transcription service.
• Confirmed transcript text and meeting metadata are stored in a per-account SQLCipher-encrypted vault on the phone. There is no transcript cloud sync in this release.
• The app uses Microsoft only for account authentication and requests openid email profile. It does not request calendar access or store Microsoft provider access or refresh tokens for mobile sign-in.
• The current Android app contains no analytics or advertising SDK. It emits local, content-free performance diagnostics to Android's device log for testing and troubleshooting.
• Export happens only when you choose Share. The app creates a short-lived plaintext transcript file for Android's share sheet; the destination app or service then controls that copy.

Deleting your account in the Android app first removes the local transcript database and its wrapped encryption key, then requests deletion of the online Overshow account. Signing out does not delete local transcripts. Revoking an installation or deleting an account remotely locks the vault when that phone next checks the account service, but an offline or lost phone cannot be remotely erased. Use a device passcode and Android's device-management controls to reduce that risk.

Meeting transcripts can contain personal data about other people. You are responsible for telling participants and obtaining any consent or other lawful basis required in the place where you record.

Cookies and similar technologies

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember preferences and provide certain functionality.

Cookies we use

• Marketing site (over.show): no cookies at all. There are no advertising or marketing cookies, no tracking pixels, and therefore no cookie banner. The analytics described below are cookieless.
• Web app (app.over.show): first-party cookies only, used to sign you in and to complete a signup you started:
  • Session cookie: keeps you signed in while you use your account and billing area.
  • Security cookies: anti-CSRF and sign-in flow tokens used to protect authentication.
  • Signup journey cookies: short-lived signup_intent (24 hours) and, when you arrive through a referral link, referral_code and referral_token (1 hour), so the account you create is attributed to the journey and referrer you actually came from.

These cookies are essential or functional first-party cookies for services you have asked for (signing in, creating an account, honouring a referral). They are not shared with anyone, are not used for advertising, and do not require a consent banner.

You can manage or block cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in to the web app.

No advertising trackers

We do not run any advertising pixels or conversion trackers on our websites, and we do not send visitor data to advertising platforms.

Consent choices recorded under the previous cookie banner are retained server-side as a historical audit trail. Each record holds a random subject identifier, the IP address, and the browser user agent captured with the choice; records are not linked to your account, and no new records are created.

Cookieless analytics

We use Vercel Web Analytics and Vercel Speed Insights on the marketing site and web app to understand aggregated usage (which pages are visited, rough performance metrics such as Web Vitals). These products do not set cookies and do not use cross-site identifiers. Data is aggregated at Vercel's edge and contains no personal identifiers we can link back to an individual.

• Lawful basis: legitimate interests (understanding site usage and performance to improve the service). There is no consent requirement because no information is stored on, or retrieved from, your device for analytics purposes.
• Sub-processor: Vercel Inc. See "Sharing your personal data" below.
• What is collected: canonical page path visited, approximate country, anonymised device and browser class, and Web Vitals (LCP, CLS, INP, TTFB). Query strings and fragments are removed before collection, and personalised affiliate paths are grouped under one generic path. No IP addresses are retained.

Custom events

In addition to page views, we fire a small number of named events to understand how the marketing site and account journey convert. These events are sent to the same Vercel Analytics pipeline as page views, without cookies or cross-site identifiers, and carry only non-personal attributes about the interaction:

• pricing_cta_click - the public CTA label and selected plan. Target URLs and query strings are not included.
• cta_click - the public CTA label, a bounded destination category, and any explicit signup source tag. Other target URL and query-string values are not included.
• pricing_toggle_change - whether the pricing control is set to monthly or annual billing and, when relevant, which public pricing surface contains it.
• faq_interaction - the FAQ question text and whether it was opened or closed.
• form_start, form_submit, form_submit_error - which enquiry form was started or submitted, and, on error, an HTTP status or network error category. We do not send any form field values with these events.
• signup_page_view, platform_detected, pc_deflect_to_platform_support_clicked - the bounded acquisition source, referral presence, supported-platform result or deflection action. Unknown source strings are grouped as other.
• platform_interest_recorded - the bounded platform requested when a new availability or Mac-link record is stored. The submitted email address is not included.
• auth_method_selected, auth_success - the selected provider and login/signup mode, or whether a new account was created and its bounded acquisition source.
• desktop_download_click, desktop_exchange_redeemed, desktop_device_registered, desktop_device_conflict - download intent and server-observed desktop exchange, registration or device-limit outcomes. These contain only a bounded transaction flag or registration outcome.
• affiliate_application_started, affiliate_application_submitted, affiliate_application_error - application milestones and a bounded error category. Application answers, links and payout references are never included.

No personally identifying fields from forms (such as name, email, or free-text responses) are included in custom events. Events are stored in the same aggregated Vercel Analytics counters as page views and are subject to the same retention.

You can block browser-originated Vercel Analytics requests at the network level via browser extensions if you prefer. The site works the same either way. Server-observed platform-interest and desktop events are sent from our app server after a successful record, exchange, or registration request, so browser network blockers cannot suppress them.

How we use your personal data

We use your personal data for the following purposes:

• To respond to enquiries
  • Handling queries submitted through the contact form.
  • Providing information about our products, services and pricing where requested.
• To manage licensing and access
  • Verifying your identity via SSO and authorising access to Overshow.
  • Allocating and managing licences within your organisation.
  • Monitoring licence usage at an aggregate level for capacity planning and contract management.
• To operate mobile account access
  • Authenticating the Android app, binding sessions to a specific installation, preventing abuse, and supporting installation revocation and account deletion.
  • We do not receive microphone audio or transcript content through this account flow.
• To operate optional Google Workspace and Microsoft 365 features
  • Storing and refreshing encrypted provider tokens for authorised calendar and mail connections.
  • Allowing the desktop app to list authorised calendars and read event metadata on your behalf.
  • Powering meeting detection, calendar correlation, attendee matching, and pre-meeting briefs in the desktop app.
  • We do not use this access to create, edit, delete, or share calendar events on your behalf.
  • Allowing the desktop app to read authorised mail metadata and content for reply-owed detection, local search and Ask, meeting preparation, and links back to the source message.
  • We do not use this access to compose, send, edit, or delete messages on your behalf.
• To operate and improve our website and services
  • Ensuring the security and integrity of our systems.
  • Analysing anonymised or aggregated usage trends to improve usability and performance.

We do not sell your personal data.

Google Workspace and Microsoft 365 integrations

When you choose to connect a calendar or cloud mailbox in the desktop app, Overshow requests delegated, read-only access for the feature you enable.

• Google Calendar: https://www.googleapis.com/auth/calendar.events.readonly and https://www.googleapis.com/auth/calendar.calendarlist.readonly.
• Gmail: https://www.googleapis.com/auth/gmail.readonly.
• Microsoft 365 / Microsoft Entra ID: Calendars.Read for calendars and Mail.Read for mail. Microsoft sign-in may also include standard identity permissions and offline_access so the authorised connection can refresh without prompting you on every sync.

We use these permissions only to let the desktop app identify authorised calendars and messages, read the data needed for the connected feature, and provide user-facing calendar and mail features in the desktop app.

Calendar data handled through this integration can include calendar names, event titles, attendees, locations, notes or descriptions, start and end times, recurrence markers, response status, and meeting links or conference URLs present in the event. Sensitive calendar fields stored by the desktop app are encrypted locally. We do not use Google or Microsoft calendar data for advertising, sale to data brokers, or AI model training.

Mail data handled through this integration can include message and thread identifiers, sender and recipient details, subject, date, labels, snippets, selected headers, and the body text of qualifying messages. Message body text is processed on the device to produce a bounded excerpt, source link, derived reply state, and local full-text and semantic search indexes; full message bodies are not persisted by Overshow in normal operation.

Google user data is transferred over HTTPS and provider tokens are encrypted at rest in the app.over.show token relay. Calendar data, mail metadata, bounded excerpts, and derived results kept by the desktop app are stored in its locally encrypted database.

Overshow may use Google Workspace data as context for user-requested on-device search and inference. This processing does not update model weights. Overshow does not use data obtained through Google Workspace APIs to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models.

Overshow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can stop future provider access by revoking Overshow in your Google or Microsoft account, or through your organisation's administrator controls where applicable. If access is revoked or expires, future cloud sync will fail until you reconnect. Revocation does not automatically delete data already stored on your device; use Settings → Data → Reset local data if you also want to remove the local encrypted database.

Our lawful bases for processing

We rely on the following lawful bases under UK data protection law:

• Legitimate interests
  • Responding to contact form enquiries.
  • Operating, securing and improving our website and licensing services.
  • Managing existing or prospective business relationships.

Where we enter into a contract with your organisation, some processing may also be necessary for performance of a contract, for example, to provide and support the Overshow licensing service.

If we ever rely on consent (for example, for certain types of direct marketing), we will ask for it clearly and separately, and you can withdraw it at any time.

How long we keep your data

We keep personal data only for as long as necessary for the purposes described above:

• Contact form data: normally retained for up to 2 years from the last meaningful interaction, to manage ongoing conversations and potential opportunities.
• Platform availability requests: Mac download-link requests are removed after 30 days. Other platform notification requests are removed after no more than 2 years if the requested version has not shipped sooner.
• Licensing and SSO data: retained for the duration of your organisation's licence plus up to 2 years, to support audit, security and contract management.
• Mobile authentication flows: expire after 10 minutes and are removed after a further 24 hours.
• Mobile installation and session data: retained while the account exists, subject to the shorter session and security-log retention periods described by the service, and deleted or unlinked when the account is deleted except where limited security records must be retained by law or for abuse prevention.
• Connected provider tokens and sync metadata: retained while the connection remains linked to your account. Provider tokens are deleted when the Overshow account is deleted, except where limited records must be retained by law or for abuse prevention.
• Local calendar and mail data: retained in the encrypted local database by default until you use Settings → Data → Reset local data, uninstall and remove the app's local data, or an explicit retention setting or operator policy deletes eligible data. A plan's searchable-history window limits recall; it does not itself delete older local data. Revoking provider access stops future sync but does not remove data already stored locally.
• Technical logs: retained for short periods (typically up to 12 months) for security, troubleshooting and service improvement, unless a longer period is required for investigation or legal reasons.

We may retain data for longer where required to comply with legal or regulatory obligations or to establish, exercise or defend legal claims.

Sharing your personal data

We may share your personal data with:

• Service providers and suppliers who support our website, licensing infrastructure, hosting and security. These providers only process personal data on our instructions and under written contracts.
• Single sign-on, calendar, and mail providers, and your organisation's identity systems, where necessary to authenticate users, refresh delegated tokens, or access authorised data on your behalf.
• Professional advisers, such as legal or accounting advisers, where necessary for our legitimate interests.
• Regulators, law enforcement or courts, where we are legally required to do so or where necessary to protect our rights, users or the public.

We do not allow third parties to use your personal data for their own marketing.

Authorised calendar and mail data is not transferred to third parties by default. If you explicitly approve a local or AI client in Overshow, relevant snippets from the encrypted local database may be returned to that client as part of the user-facing feature you requested. A local client keeps that transfer on your device; a cloud client sends its query and returned snippets to its own provider under that provider's terms. Overshow does not transfer Google Workspace data for advertising, sale to data brokers, credit or lending decisions, or development of generalised or non-personalised AI or machine-learning models.

International transfers

Our core services are hosted within the UK or European Economic Area (EEA) wherever practicable.

If we need to transfer personal data outside the UK or EEA, we will ensure appropriate safeguards are in place, such as:

• An adequacy decision by the UK Government or European Commission; or
• Standard contractual clauses or equivalent contractual protections.

You can contact us for more details of these safeguards.

Security of your personal data

We take appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (for example, HTTPS for our website).
• Encryption at rest for connected-provider tokens and SQLCipher encryption for locally stored calendar and mail data.
• Access controls and authentication for administrative systems.
• Regular security updates and vulnerability management.
• Restricted access to personal data on a need-to-know basis.
• Staff awareness and confidentiality obligations.

No system can be guaranteed to be completely secure, but we work to reduce risks to a level appropriate to the nature of the data and our services.

Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access. To obtain a copy of your personal data and information about how it is used.
• Right to rectification. To correct inaccurate or incomplete data.
• Right to erasure. To request deletion of your data in certain circumstances.
• Right to restrict processing. To limit how we use your data in certain situations.
• Right to data portability. To receive your data in a structured, commonly used format and transmit it to another controller, where applicable.
• Right to object. To object to processing based on legitimate interests, and to direct marketing.
• Rights in relation to automated decision-making and profiling. Where these are used in a way that has legal or similarly significant effects on you.

To exercise any of these rights, please contact us using the details above. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: https://ico.org.uk
• Telephone: 0303 123 1113

We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first if possible via office@sandigital.uk.

Direct marketing

If you have given consent or we otherwise have a lawful basis (for example, where you are a business contact and we rely on legitimate interests), we may use your contact details to send you information about Overshow and related services.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any email, or
• Contacting us using the details above.

Opting out of marketing will not affect essential service or transactional communications.

Third-party websites

Our website may contain links to third-party websites. This privacy notice does not cover those sites, and we are not responsible for their content or privacy practices. You should review their privacy notices before providing any personal data.

Changes to this notice

We may update this privacy notice from time to time to reflect changes in our services or legal obligations. When we do, we will update the "Last updated" date at the top of this page.

Where appropriate, we may also notify you of significant changes by email or through our website.