Privacy Policy

Effective Date: [Last Updated: October 29, 2026]

This Privacy Policy explains how Hauke Jung ("we," "us," or "our") processes personal information in connection with Overhear (the "Service"), available at https://overhear.dev.

Overhear listens for your product on public platforms. You tell it which keywords to track; it searches X, Reddit, LinkedIn, YouTube, Hacker News and the web for public posts that contain them, sorts each post by what it needs from you, and alerts you to the ones that matter. That means we process two kinds of personal data: yours, as a customer, and that of the people who wrote the public posts we find (Section 3).

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German law.

1. Controller

Hauke Jung, Hauptstr. 41, 79199 Kirchzarten, Germany — info@overhear.dev.

2. Information We Collect About Customers

a. Account data

Your email address, username, an optional profile picture link, and what is needed to sign you in (such as passkeys and one-time codes sent by email). If you work in an organization, its name, its members and pending invitations.

b. Projects

For each product you track: its name, domain and description, your keywords (including competitors you chose to track), the authors and sites you told us to ignore, custom categories you defined, your webhook address and its signing secret, and whether email alerts are on.

When you add a product by its domain, we fetch that site's homepage once to suggest a name, description and keywords.

c. Mentions

The public posts found for your keywords (see Section 3), what our classification made of them (type, sentiment, urgency and whether a post is about your product at all), and what you did with them: saved as a testimonial, marked as unrelated, or the author muted.

d. Keys and usage

API keys — name, a short lookup prefix, an Argon2 hash and when it was last used. Never the key itself.
Scan log — each search we ran for your keywords: when, which source, which keyword, what it cost and how many posts it returned. It powers the Usage tab.
Credits — on overhear.dev: your Creem customer ID and credit account, the balance, the credits each scan used, and whether scans are paused. Payment details stay with Creem (see Section 5).

e. Technical data

Your IP address, for rate limiting and abuse prevention
Device and browser information in ordinary HTTP request headers, and short-lived server logs
A session record per signed-in browser (see Section 8)

We run no advertising and no third-party tracking, and do no profiling of customers. Page views are counted with Oxidt Analytics, a cookieless tool we operate on our own EU servers: it records the page, referrer, browser, device type and country, plus a few product events (signing up, creating a project, adding a keyword and its type, starting and completing a credit purchase with the pack size), and counts visitors with a hash of your IP address and browser under a salt that is deleted daily, so a visitor cannot be recognized across days and the IP address is not stored. When you are signed in, your use is also tied to your Overhear account id, a random identifier with no email or name in it, so we can see across days which features are used (such as scans, lead feedback, reply drafts and fact checks). The legal basis is our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR). The script is served from overhear.dev and our server passes each count on to Oxidt Analytics with your IP address, which is used for the hash and the country and then discarded. You can object at any time (Art. 21 GDPR) by writing to us; to stop counting your own browser right away, set localStorage.oxidt_ignore = "true" in its developer console on overhear.dev.

f. Feedback and votes

Every page loads a feedback widget from SeggWat, a service we operate (see Section 5). If you send feedback through it, we receive your message, the page you were on, any screenshot you attach, your email address if you give it, and — when you are signed in — your account ID and email. Votes on the roadmap are stored with your account ID.

3. People Who Wrote the Posts We Find

This section is for you if you posted publicly about a product someone tracks with Overhear, or asked publicly for a kind of product a customer offers (Art. 14 GDPR).

What we process: the post's text and title, its address, when it was posted, its engagement count, and the author's name or handle as the platform shows it publicly. For posts from X we also keep the follower count the search result carries, and for a post the customer sees as a potential lead, the bio and follower count of your public X profile, looked up once.
Where it comes from: public posts on X, Reddit, LinkedIn, YouTube, Hacker News and the open web, found by searching for the customer's keywords, and your public X profile page. We do not access private messages, closed groups or anything behind a login.
Why: so the customer whose product you mentioned, or whose product answers what you asked for, can read and answer what you said — fix a bug you hit, answer your question, suggest their product, or thank you. The profile bio lets them see whether their answer is relevant to you before they write it.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) of the customer and of us in knowing what is said publicly about a product, and in answering public requests for one. Only posts you chose to publish are processed: those containing a tracked keyword, or matching a search phrase for a need the customer's product serves. The profile bio is public on the same platform, next to every post you write there; we do not look you up on other platforms or collect contact details.
Classification: each post is sorted automatically (for example as a question, complaint or buying intent), and a potential lead is given a fit score. This sorting has no legal or similarly significant effect on you.
Retention: a post is kept until the customer deletes the project, mutes you as an author, or we delete it on request. A profile bio is deleted as soon as the customer dismisses the post as not a lead.
Your rights: you may object at any time, and ask for access or erasure, at info@overhear.dev. Tell us the post or handle and we delete what we hold and stop collecting it.

4. How We Use This Information

Provide the Service: sign-in, scanning for your keywords, classifying posts, showing your feed, sending your alerts and webhooks
Keep the Service secure: rate limits, abuse prevention
Communicate with you about sign-in, alerts you turned on, a low or empty credit balance, support, security and changes to the Service
Comply with legal obligations

We do not sell personal data and do not use it to train any model.

Legal bases for customer data: performance of a contract (Art. 6(1)(b) GDPR) for your account and the features you use; our legitimate interest (Art. 6(1)(f) GDPR) in keeping the Service secure and available, for logs and rate limiting.

5. Processors and Recipients

Recipient	What	Why
Anthropic (USA)	The text of found posts, your project's name and description, and your custom categories; when you add a product, its homepage text	Classifying posts and suggesting project settings. Anthropic does not use API data to train its models.
treg.to (operated by us) and the data providers it uses	Your keywords as search terms, and the domain you add	Searching public platforms and fetching homepages. The providers receive search terms, not your account data.
SeggWat (operated by us)	Feedback you send through the widget and roadmap votes, as described in Section 2f; your IP address when the widget loads	Collecting feedback, feature requests and votes, and publishing the changelog. If spam protection is on, the widget may run a verification check before sending.
Oxidt Analytics (operated by us, servers in the EU)	Page views and events as described in Section 2e, passed on by our server with your IP address, which is not stored	Counting visits and which pages are used
Hosting provider (servers in the EU)	All data stored by the Service	Infrastructure
Email (SMTP) provider	Recipients' email addresses and the message	Sign-in codes, invitations and email alerts
Creem — Armitage Labs OÜ, Rotermanni 14, 10111 Tallinn, Estonia	When you buy credits, Creem collects your email address, name, country and payment details directly on its checkout. We receive your Creem customer ID, the order, and credit grant and usage events (amounts and balances), and send Creem the number of credits each scan uses.	Selling credit packs as merchant of record: payment, tax and invoicing. For the payment data it collects, Creem is an independent controller; see Creem's privacy notice.

Processors act on our behalf under data processing agreements.

What you send on yourself: if you set a webhook, every new related mention is sent to that address. AI assistants you connect over MCP with an API key can read your projects and mentions; if an assistant is backed by a hosted model, it passes that content to its provider under that provider's terms. These transfers are initiated by you, and you can remove the webhook or revoke the key at any time.

We may also disclose data if required by law or a competent authority, or in a merger, acquisition or asset sale.

6. International Data Transfers

The Service's data is stored on servers in the European Union. Anthropic processes data in the USA; we rely on the EU–US Data Privacy Framework where the provider is certified and on Standard Contractual Clauses (SCCs) otherwise. Data providers used by treg.to may be located outside the EU under the same safeguards.

7. Data Security

HTTPS for all data in transit
API keys stored only as Argon2 hashes
Webhooks signed so the receiver can verify they came from us, and sent only to public HTTPS addresses
Rate limiting and security headers

No system is 100% secure; we cannot guarantee absolute security.

8. Cookies and Local Storage

We use a strictly necessary session cookie that keeps you signed in, expiring after 7 days of inactivity. Your light/dark theme preference is kept in your browser's local storage and never sent to us. The feedback widget keeps your email address and unsent drafts in local storage so you don't have to type them again. There are no tracking cookies, which is why there is no cookie banner. See our Cookie Policy.

9. Data Retention

Projects and their mentions are kept until you delete the project (Settings → Delete project), which removes its keywords, mentions, testimonials and scan log immediately.
Billing records (your Creem customer ID, credit balance and the credits each scan used) are kept for as long as your organization exists; invoices and payment records are kept by Creem under its statutory retention duties.
Account data is kept for as long as your account exists. To delete your account, email info@overhear.dev; we delete it with all its projects.
Sessions expire after 7 days of inactivity.
Server logs and rate-limit counters are short-lived.

Mentions already sent to your webhook or read by a connected assistant stay there; they are governed by those systems.

10. Your Rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. To exercise them, contact info@overhear.dev.

You also have the right to lodge a complaint with a data protection authority, such as the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI).

Our Service does not respond to "Do Not Track" signals; there is no tracking for such a signal to switch off.

11. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect their data as customers. If you believe a child has provided us with personal data, contact us so we can delete it.

12. Changes to This Privacy Policy

We may update this policy from time to time. Material changes will be announced by email or a prominent notice on the website.

13. Contact

Data Controller: Hauke Jung Hauptstr. 41 79199 Kirchzarten, Germany Email: info@overhear.dev