Privacy Policy
Overlap has two modes. Manual quiz-code mode works locally in your browser. Private trip mode stores the information needed to keep a shared trip available across devices. We do not sell personal data or build advertising profiles.
1. Controller
Overlap is a Dutch sole proprietorship at Oude Delft 60a, 2611 CD Delft, registered under KVK 42107390. Contact: hello@overlaptrips.com.
2. Manual code mode
Quiz answers, generated codes, matches, saved places and planning state remain in your browser unless you choose to share a code or create or join a private trip. We cannot recover local-only quiz codes.
3. Private trip mode
For a private trip we store the organizer email, first names, optional member emails, submitted quiz codes, trip dates, base area, saved places, completed places and planning state. We also store short-lived one-time access links and secure session records. This processing is necessary to provide the requested shared trip.
Free private trips are kept for up to 12 months after activity. Paid private-trip product data is kept for up to two years after purchase unless you delete it earlier. One-time access links expire quickly and sessions expire automatically. Minimal accounting records are retained separately where required for administration and tax obligations.
4. Purchases and email
Lemon Squeezy acts as merchant of record for paid orders and handles payment, invoicing, VAT and refunds under its own buyer terms and privacy policy. Overlap receives the order details needed to activate and support the trip. Access emails and support correspondence are delivered through our configured email provider.
5. Analytics
Public pages use Simple Analytics for aggregate, cookieless page-view statistics. Its script is loaded from the Simple Analytics content-delivery domain. Private trip, invite, authentication, quiz, group and Today pages do not load third-party page analytics. Overlap records a small allow-list of aggregate product events, such as “free trip created” or “quiz completed”, without storing answers, trip IDs, emails or device identifiers in those event counters.
6. Service providers
- Cloudflare: hosting, private-trip database, server functions, security and email routing.
- Lemon Squeezy: merchant of record, checkout, payment, invoicing, tax and refunds.
- Simple Analytics: aggregate public-page analytics.
- Email provider: access emails and support correspondence.
We maintain a processor register and review the contracts, data locations, retention and deletion procedures for these services.
7. Security
Private-trip access uses one-time email links that create secure HttpOnly sessions. Access tokens are stored as hashes, private pages are not indexed, rate limits protect sensitive endpoints, and security headers restrict framing and external connections. No system is risk-free. We maintain an incident-response procedure and assess whether affected people or the Dutch supervisory authority must be notified if an incident occurs.
8. Your rights
You may request access, correction, deletion, restriction, objection or portability where applicable. Trip owners can delete an entire trip. Other members can leave a trip and delete their own stored membership and quiz result. Contact hello@overlaptrips.com. You may also complain to the Dutch Data Protection Authority.
9. Children
Overlap is intended for people planning travel and is not directed at children. Do not submit a child’s email address or personal information without appropriate authority.
10. Changes
Material changes are published here with a new effective date. The current policy always describes the current production architecture.