Privacy Policy

Effective date: 6 June 2026 Last updated: 27 October 2026

This Privacy Policy explains what personal data the "Overthink This" mobile application (the "App") collects, how it is used, and the rights you have over it. The App is operated by Saša Marić, Fux-Weg 26, 8435 Wagna, Austria ("we", "us", "our"). You can contact us at fizzythemusician@gmail.com.

If you do not agree with this Policy, please do not use the App.

1. Who this Policy applies to

This Policy applies to anyone who installs, opens, or interacts with Overthink This on a mobile device — whether they create an account or use the App as a guest.

The App is intended for adults: users aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data to us, contact us and we will delete it.

2. What data we collect

We only collect what we need to run the App. Specifically:

2.1 Account data (when you sign in)

• Google account email, display name, and profile picture URL, retrieved via Google Sign-In when you choose to sign in with Google.
• Display name if you sign in as a guest (you type it).
• A session token we generate and store so you stay signed in.

2.2 Content you create (private)

• The text of every "spiral", text check, compatibility check, and any custom category, folder, or tag you create.
• Resolution notes ("how did it turn out?") and the status you assign.
• Settings and cosmetic choices (selected title, name colour, card theme, gradient, notification preferences).
• Optional profile picture you upload.
• Optional "About you" details you may enter during set-up or under Profile → About you: the name you want to be called, your age, gender, relationship status, and hobbies or interests, plus the overthinking style and frequency you pick. Every one of these is optional and can be changed or cleared at any time.

AI personalisation switch. The "About you" details are only sent to our AI providers if the "Let Otto use my details" switch is on. When it is on, they are included as background with the spirals and text checks you submit, so the answer fits your situation. When it is off, they stay on your profile and are never sent to an AI provider. You can turn the switch on or off at any time under Profile → About you. Separately, the "Fill with my details" button in the compatibility test copies your details into Person A only when you tap it.

By default everything you write stays private to your account. The only content that becomes public is what you explicitly choose to publish to the social feed (see Section 2.3).

2.3 Content you choose to publish (the public feed)

The App contains a social feed. If, and only if, you tap the "Share" sheet and confirm, the following becomes visible to other signed-in users:

• A snapshot of the spiral / text-check / compatibility verdict you chose to share (including its title, verdict text, outcomes, and — when active — the Oracle card used).
• Your display name, avatar, level, title, and other cosmetic choices.
• The like count, comment count, and the comments other users leave.

You can delete any of your posts and any of your own comments from the App at any time. Once deleted they are removed from public view immediately and from our database within 30 days.

Guests cannot post to the feed; sign-in with Google is required.

2.4 Social graph (friends and blocking)

• When you send, accept, reject, cancel, or block a friend request, we store a friendships row recording the two user IDs, the status, and the timestamp.
• Blocking is one-directional and hides the blocked user from your feed and their content from yours. Banned users are filtered from every friend surface automatically.

2.5 Invites

• If you ask for an invite code we create one and store it with your account. If you enter someone else's code we store which account invited you, so both of you can be given the bonus spiral. If you later buy a Pro subscription, the person who invited you is told that one of the people they invited subscribed (a count, without your name), because that counts towards their reward. We do not see who you share your code with, and we never read your contacts.

2.5a Usage data

• Counts of spirals created, resolved, and shared; likes given/received; comments given/received.
• Streak length, level, XP, and which tasks you have claimed.
• Tier-claim history (which Thinkpass+ items you own).
• Timestamps for the above.
• A small set of counted moments (the subscription screen was opened, a purchase was started or completed, a share image was made, an invite was shared), stored with your account ID and the time, with no content. We use them only to see how the App is used overall, and delete them after 180 days.

2.6 Push notification data

• If you grant the OS push permission, we store an Expo Push token for your device so we can send notifications about likes and comments on your posts.
• You can turn each notification category off at any time via Profile → Notifications, or revoke the permission system-wide in your device settings.
• We do not store device push tokens for guest accounts.

2.7 Safety / moderation data

• When the AI safety classifier flags input as describing the user perpetrating serious harm or being in crisis, we store a strike_logs row containing the original text, the classifier verdict (safe / victim / perpetrator), the severity, the topic tags, and a short summary.
• The number of strikes against your account, any ban reason, and any cooldown timestamp.

2.8 Purchase data

• When you subscribe to Overthink This Pro the purchase is processed by Google Play Billing and tracked by RevenueCat. We receive: the product purchased, the time of purchase, the expiration date of the subscription, and a RevenueCat anonymous identifier.
• We do not receive or store your full credit-card number, expiration, or CVC. Payment data stays with Google and the card network.

2.9 Technical / abuse-prevention data

• Your device IP address is observed when you sign in and when a request is rejected as suspicious, but is never stored in clear text. It is turned into a keyed hash (HMAC-SHA-256 with a secret that only our server holds) and only that hash is written to the database. Without the secret the hash cannot be turned back into an address. The clear-text IP exists only in memory for the duration of the request.
• A security event log: when a request looks like abuse (too many attempts, an invalid sign-in token, malformed input, an attempt to reach an operator-only function) we record the type of event, the time, the account ID if there is one, and the keyed IP hash. It contains none of your written content.
• A per-device installation identifier (Android ANDROID_ID, iOS identifierForVendor, or a generated UUID on web/Expo Go), used so reinstalling the App reattaches to the existing guest account instead of granting fresh free credits. A Google-signed-in account is never opened this way; it always needs its Google sign-in.
• Counters in a rate_limits table (a per-minute counter keyed by hashed IP or user ID) used to throttle sign-in attempts, AI calls, posts, comments, and friend requests. These rows hold no personal content.
• We do not currently use any third-party analytics, advertising SDKs, or crash-reporters.
• We do not collect location data.
• We do not access your contacts, microphone, calendar, or call logs.

3. How we use this data

We use the data above strictly to:

1. Operate the App. Sign you in, run the AI features, save your spirals, render your customisations, ship notifications you've opted into, render the public feed and friend system.
2. Bill you. Process and verify subscriptions, restore purchases across reinstalls.
3. Keep the App safe. Run the safety classifier before generating a spiral; act on strikes / bans / cooldowns; rate-limit sign-in attempts and abusive activity; log incidents for operator review.
4. Improve the App. Aggregated, de-identified counts (e.g., "X% of users complete the tutorial") may be reviewed internally. We do not sell raw user data.

We do not use your content to train AI models, and we do not sell or license it to anyone for that purpose. Each AI call is made on demand, from our server. We never send your name, email address or account ID with a prompt — only the text you submitted and, if you switched it on, your "About you" details. The AI providers (see Section 5) process the prompt to return an answer under their own API terms. Under those terms a provider may keep prompts for a limited time and may use them to improve its own services; Google states this for the tier of the Gemini API we currently use. For that reason, please do not put names, addresses or other identifying details of yourself or other people into a spiral.

4. Legal bases for processing (EU/UK users)

Where the GDPR or UK GDPR applies, we rely on the following bases:

You may withdraw consent at any time via the App's settings or by contacting us. Withdrawal does not affect processing already carried out.

5. Who we share data with

We share data only with the service providers required to run the App. Each has its own privacy commitments, and we have a written agreement (Data Processing Agreement / equivalent) with each:

We do not sell personal data. We do not share data with advertisers or data brokers.

International transfers (e.g., to the United States) are made under the EU Standard Contractual Clauses (2021/914) or an equivalent transfer mechanism.

6. How long we keep data

• Account, content, settings: kept until you delete your account.
• Guest accounts: a guest account that has not been used for 90 days is deleted automatically, together with its content. Sign in with Google to keep your spirals.
• Public feed posts and comments: kept until you (or we) delete them; deleted within 30 days of removal.
• Friendship rows: kept until either party removes the relationship.
• Push tokens: deleted within 30 days of account deletion or token revocation.
• Strike logs: kept for 24 months after the most recent incident, then anonymised (operator notes preserved without the source text).
• Purchase records: kept for 7 years for tax / audit compliance.
• Rate-limit counters: deleted automatically once they are more than 24 hours old.
• Hashed IP signup buckets: kept 30 days, then deleted automatically.
• Sessions: an unused session expires and is deleted automatically.
• Security event log: kept 90 days, then deleted automatically.
• Reports of AI output you send us: kept for 12 months, then deleted.
• Bug reports you send us (your description, app version, phone model and operating system version): kept with your account until you delete it. A copy is emailed to us through our email provider (Resend, Inc., USA) so we can act on it.
• Backups: where database backups are enabled they are encrypted and kept for no longer than 30 days.

When you delete your account (see Section 8) we erase your row in users, your spirals, text checks, compatibility tests, folders, custom categories, sessions, tasks, push token, feed posts, comments, likes you've given, and avatar within 30 days. We may retain strike logs in pseudonymised form to prevent re-registration evasion, as permitted by Art. 17(3)(e) GDPR.

7. Security

• All traffic between the App and our servers is encrypted with TLS 1.2 or higher.
• Stored data is encrypted at rest by Supabase using AES-256.
• Session tokens are kept in the App's private storage on your device, which other apps cannot read. Current versions of the App encrypt them with the Android Keystore.
• Service-role credentials live only on our edge functions; the mobile app never sees them.
• No employee or contractor accesses user content except for safety review, debugging with the user's consent, or as legally required.

No system is perfectly secure. If you become aware of a vulnerability please email fizzythemusician@gmail.com; we will respond within 5 business days.

8. Your rights

Wherever you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (e.g., your display name, settings).
• Delete your account and the associated data ("right to erasure").
• Export a copy of your spirals and content in a portable format.
• Object to or restrict processing in certain cases.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint with your local data-protection authority. In Austria: the Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at. Users elsewhere in the EEA may file with their national DPA.

To exercise any of these rights:

1. Delete account — Profile → Delete account (in-app; takes effect within 30 days). If you no longer have the App installed, follow the steps at overthinkthis.pages.dev/delete-account.
2. Other requests — email fizzythemusician@gmail.com with your account email; we respond within 30 days.

We do not charge a fee unless a request is clearly excessive (and we will tell you first).

9. Children

Overthink This is for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you are a parent and you believe your child has provided data to us, email fizzythemusician@gmail.com and we will delete it.

10. Automated decision-making and AI

The App uses AI to:

• Generate the spiral, text check, and compatibility outputs.
• Run a safety classifier on the text you submit before generating a spiral.

The safety classifier produces a classification ("safe", "victim", "perpetrator") that may result in a one-time block of a specific spiral, a strike against your account, or — at three strikes — an automatic ban. This decision can affect access to the service, which under Art. 22 GDPR qualifies as automated decision-making.

You can request human review of any moderation decision (ban, strike, cooldown) by emailing fizzythemusician@gmail.com within 30 days of the decision. We will respond within 14 days.

11. Changes to this Policy

If we materially change this Policy we will notify you in-app and update the "Last updated" date above. Continued use of the App after such changes constitutes acceptance of the revised Policy.

12. Contact

• General: fizzythemusician@gmail.com
• Privacy and data rights: fizzythemusician@gmail.com
• Moderation appeals: fizzythemusician@gmail.com
• Security disclosures: fizzythemusician@gmail.com

Data Controller: Saša Marić, Fux-Weg 26, 8435 Wagna, Austria.