Privacy Policy

What OvertChat is

The mobile app is a thin client. On first launch you enter a server URL—usually one you self-host, but it can be any compatible deployment. Your chats, messages, projects, and uploaded files live on that server, not on our infrastructure. We do not operate a hosted chat backend.

What the app sends to your server

Except for crash reporting described below, the app communicates with the server URL you configured, over HTTPS or HTTP, in order to:

• sign you in and keep you signed in (a session cookie stored locally on your device),
• send your messages, attachments, voice dictation, and realtime voice audio to your server so it can use the speech and language model providers configured by its administrator,
• load chat history, projects, and settings you have created on that server.

How that server stores, retains, or shares that data is governed by whoever administers it—that is a separate policy from this one. If you self-host, you are that administrator. Local providers can keep processing on infrastructure the administrator controls; hosted providers receive the requests routed to them under their own policies.

What is stored on your device

• The server URL you entered (in Android secure storage).
• Your auth session cookie (in Android secure storage).
• Your appearance, chat font, and web-search toggle preferences.
• Cached image previews and temporary copies of files you select, which the operating system may retain in the app cache until cleanup or uninstall.

Uninstalling the app removes all of the above. You can also clear the server URL from inside the app to start over.

What we collect

We—the publisher of the app—do not operate a hosted OvertChat backend. The app and project website do not include usage analytics or advertising SDKs.

We receive limited crash diagnostics through Sentry when crash reporting is configured in the distributed app, as described next.

Project website hosting

The project website at overtchat.com is delivered through Cloudflare. When you visit, Cloudflare processes ordinary web request data such as your IP address, browser and device information, requested URL, and request time to deliver and protect the site.

We do not add web analytics, advertising trackers, or analytics cookies to the site. Cloudflare handles request data under its own privacy policy. This website hosting is separate from your chats: visiting the project website does not send your conversations, account credentials, or configured OvertChat server URL to us.

Crash reporting (Sentry)

When the app encounters an unhandled error or crashes, it may send a diagnostic report to Sentry, a third-party error monitoring service, so we can fix bugs. A report may contain:

• the JavaScript error and stack trace,
• device model, OS version, and app version,
• a randomly generated install identifier (not tied to your name or email).
• recent network request metadata, which may include the configured server URL, HTTP method, and status code.

Sentry is initialized with default PII collection disabled. The app does not intentionally attach chat or attachment contents, session cookies, API keys, or other credentials to crash reports. Because reports capture diagnostic context, we do not make an absolute guarantee that user-provided data can never appear in an error message.

Sentry is governed by its own privacy notice and security information. If you would prefer no crash reports leave your device, you can build the app from source without the Sentry DSN configured.

Server version checks

When an administrator opens the account menu, an OvertChat server may request the public release manifest from overtchat.com to determine whether a newer server version is available. The result is cached for 12 hours. The request does not include an instance identifier, account information, server configuration, chat data, or the installed version.

Cloudflare processes ordinary request data such as the server IP address and request time when delivering the manifest. Server operators can disable version checks by setting the documented DISABLE_UPDATE_CHECK environment variable.

Permissions and why we ask for them

• Microphone—used only after you start dictation or a realtime voice conversation. Dictation is sent to your server for transcription when you stop recording and is deleted from the mobile app cache afterward. During browser realtime voice, audio streams to your server while the session is active; its transcript is saved there as a chat.
• Camera—used only when you choose “Take Photo” to attach an image to a message.
• Photos / Storage—used only when you pick an image or document to attach to a message.
• Foreground Service / Media Playback—used so audio playback (text-to-speech) does not cut off when you switch apps.

None of these permissions transmit data simply by being granted. Data selected through them leaves the device only when you choose an app action that uses it—for example, selecting an attachment uploads it to your server, and stopping dictation sends the recording for transcription. Realtime microphone streaming stops when you mute or end the voice session. Crash diagnostics are a separate data flow to Sentry, described above.

Children

OvertChat is not directed at children under 13. We do not knowingly collect personal information from children. Crash reporting handles limited technical diagnostics as described above.

Changes to this policy

If we change this policy, we will update the “Last updated” date at the top of this page. The change history is visible on GitHub.

Contact

Questions or concerns? Open an issue at github.com/yoloyash/overtchat/issues.