Privacy Policy

Draft notice: This document is a comprehensive starting draft intended to pass App Store review on submission. It still needs review by a qualified attorney in your jurisdiction before the app goes public. Sections in italics are flagged for legal review.

Quick summary

• OVRHD never sells your data.
• Your recordings stay on your device unless you explicitly share them.
• Audio captured for the "Join the Show" beat-detection feature is processed in real time and never stored or transmitted.
• You can delete your account and all associated data at any time by emailing hello@ovrhd.co.

OVRHD ("we", "us", "our") is operated by Jonas Enterprises. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it. It applies to the OVRHD iOS application and the website at ovrhd.co (together, the "Services").

1. Information we collect

1.1 Account information

When you create an account we collect:

• Phone number (via Firebase Phone Auth) or Apple ID identifier (via Sign in with Apple). You may choose either method.
• Optional display name and date of birth if you provide them during profile setup.
• A unique internal user ID generated when your account is created.

We do not collect or store your password — Phone Auth and Sign in with Apple do not expose one to us.

1.2 User-generated content

The Services let you create signs, post them publicly, and record video. Each type is handled differently:

• Saved signs (text, font, color choices) live in our database tied to your account so they sync with your devices.
• Concert Wall posts. When you tap "POST TO THE WALL", the sign you posted becomes public — visible to every OVRHD user. You can request a takedown by emailing us.
• "Steal this sign" QR codes. When you share a video, OVRHD publishes the sign's data (text, font, color) to a short code so the recipient's app can import it. The associated 6-character code is public and indefinite. Email us to revoke a specific code.
• Recordings. Video clips you record stay on your device by default. We never upload them automatically. You upload a recording only when you tap a share destination (Instagram, TikTok, the iOS share sheet, etc.); at that point the third-party service handles the upload, not us.

1.3 Device permissions

OVRHD asks for the following iOS permissions. Each is described before iOS prompts you:

• Camera — front and back cameras for the picture-in-picture concert recording. Used only while you have an active recording session open. We never access the camera in the background.
• Microphone — used by the "Join the Show" beat-detection feature to flash your phone's screen and torch in time with venue audio. The audio is analyzed in real time on your device only. It is not stored, transmitted, or sent to our servers. The microphone is only active while you're in the Join the Show screen with the feature running.
• Photo Library — only when you tap "Save to Photos" so OVRHD can write the resulting video to your library.
• Notifications — required for Firebase Phone Auth's silent-push verification, and (optionally) for "new follower" and "like on your post" alerts you control from Settings.
• Contacts — only if you opt in via "Find Friends" (Settings → Friends or the onboarding step). We read phone numbers from your address book, hash each one with SHA-256 on your device, and send only the hashed digests to our servers to find friends who are already on OVRHD. Raw phone numbers and contact names never leave your device. We never store your contact book, and we never message your contacts on your behalf — invite messages are sent through iOS's own Messages app, which you operate manually.

1.4 Purchase information

OVRHD Pro and Artist Packs are in-app purchases sold through the Apple App Store. Apple processes payment — we never see your credit card or billing address. From Apple we receive only the entitlement state (whether you've purchased each product). Apple's privacy policy governs the payment data Apple itself collects.

1.5 Analytics + diagnostics

We collect anonymized usage events (which screens are opened, which features are tapped, how long sessions last) and crash reports to improve the app. These are tied to a randomly-generated installation ID, not to your name, phone number, or Apple ID. You can opt out from Settings → Privacy → "Limit analytics" in the app.

1.6 What we don't collect

• Your location (GPS, IP-derived, or otherwise).
• Raw phone numbers from your address book — when you use Find Friends, contact phones are SHA-256 hashed on your device before transmission; we receive and store only the one-way hashes.
• Photos or files outside what you explicitly share with OVRHD.
• Camera or microphone data outside of an active session.
• Browsing history or activity on other apps.
• Health, financial, or biometric data.

2. How we use information

We use the information we collect to:

• Deliver core features — authentication, syncing saved signs across your devices, publishing to the Concert Wall, resolving "Steal this sign" codes, processing in-app purchases.
• Maintain stability + security — diagnose crashes, detect abuse, enforce our Terms.
• Improve OVRHD — anonymized analytics tell us which features matter and which don't.
• Communicate — respond to support requests you initiate. We don't email you marketing.

3. Legal bases for processing (EEA / UK users)

If you're in the European Economic Area or the United Kingdom, we rely on the following legal bases for processing your data:

• Contract (Art. 6(1)(b) GDPR) — to provide the Services you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) — to operate, secure, and improve the Services, balanced against your rights.
• Consent (Art. 6(1)(a) GDPR) — for analytics and any optional features that ask you to opt in. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR) — to comply with applicable law, court orders, or law enforcement requests.

4. How we share information

We don't sell or rent your personal information. We share it only in these limited situations:

4.1 Third-party service providers

• Google Firebase (auth, Firestore database, analytics, crash reporting). Subject to Firebase's privacy policy.
• Apple Inc. (App Store distribution, Sign in with Apple, StoreKit payments, APNs). Subject to Apple's privacy policy.
• Instagram / TikTok — only when you tap their share button, at which point control passes to that app.

4.2 Other situations

• Legal requirements — we may disclose information when required by law, court order, or valid government request.
• Safety — to protect users, our business, or the public from harm, fraud, or illegal activity.
• Business transfers — if OVRHD is acquired or merged, your information may transfer to the acquirer (you'll be notified).

5. Data retention

• Account data — retained for as long as your account is active. Deleted within 30 days of account deletion, except where law requires longer retention.
• Saved signs — same as account data.
• Concert Wall posts + "Steal this sign" codes — public content is retained indefinitely unless you request specific deletion.
• Crash + analytics events — retained for up to 14 months, then aggregated or deleted.
• Backup copies — automated backups may retain deleted data for up to 90 days before being overwritten.

6. Your privacy rights

Regardless of where you live, you have the following rights over your data:

• Access — request a copy of the personal information we hold about you.
• Correction — fix data that's wrong or incomplete.
• Deletion — request that we delete your account and associated data.
• Portability — receive your data in a machine-readable format (JSON).
• Opt-out — disable analytics from in-app Settings.
• Object — to specific kinds of processing (e.g. analytics).

To exercise any of these rights, email hello@ovrhd.co. We respond within 30 days.

6.1 California residents (CCPA / CPRA)

In addition to the rights above, California residents have:

• The right to know what personal information we collect, use, and disclose.
• The right to delete personal information (subject to legal-retention exceptions).
• The right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
• The right not to be discriminated against for exercising your rights.

6.2 EEA / UK residents (GDPR / UK GDPR)

You also have the right to lodge a complaint with your local data-protection authority if you believe we've mishandled your data.

7. Children's privacy

OVRHD is rated 12+ in the App Store and is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, email us at hello@ovrhd.co and we'll delete the account.

If you're between 13 and 18, please use OVRHD only with the involvement and consent of a parent or guardian.

8. International data transfers

OVRHD is operated from the United States. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (where applicable) for transfers from the EEA, UK, and Switzerland to the U.S.

9. Security

We take reasonable technical and organizational measures to protect your data: TLS in transit, encryption at rest via Firebase's default encryption, and access controls limited to engineers who need it. No system is perfectly secure, however, and we can't guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top. If we make material changes (broader data collection, new sharing arrangements), we'll notify active users via the app and/or email.

11. Contact us

Questions about this policy, or want to exercise one of your rights?
Email: hello@ovrhd.co
Jonas Enterprises · United States