Trust

Data and security

Last updated July 2026

Your record is yours. Overshove is built so that you own your data, can take it with you, and stay private by default. Here is our stance on security and ownership.

Facing an empty chair, two face-down cards lie beside a white chip stack on dark poker felt

You own it

Every session, bankroll and note you enter is yours. Export the lot to CSV at any time. Sync is a convenience, never a lock-in. You can request deletion of your account and the personal data covered by your right to erasure whenever you choose. The sample you build over hundreds of hours is the asset; Overshove is the tool that stores it.

Private by default

Venues, location and exact figures are private unless you opt in to a sharing or leaderboard feature. Social features are coarse and opt-in by design. A public profile should never reveal where you are playing tonight, what your full bankroll is, or private notes on other players.

What we protect

Security choices are built around the data that would hurt a player if exposed: account access, exact sessions, venue history, bankroll numbers and private notes. The table shows the main data classes and the control attached to each one.

Data classes and controls
Data	Default visibility	Control
Account email and login	Private	Protected by authenticated access and used only to run the account.
Sessions and bankroll history	Private	Exportable to CSV and deletable with the account.
Venue and location fields	Private	Never public unless a future sharing feature asks you to opt in clearly.
Player notes and reads	Private	Kept out of public profiles and sharing surfaces by default.
Coarse social stats	Opt-in	Only shown when you choose to share a profile or leaderboard metric.

Exact venue, bankroll and private-note data stay off public surfaces by default.

How Overshove protects your data

Overshove encrypts data in transit, requires authenticated access and uses risk-based controls to protect your account. We do not place secrets on public pages, expose private data in pages that search engines can crawl or use advertising trackers. We record and assess any personal-data breach. If a breach is likely to put people at risk, we notify the Information Commissioner’s Office within 72 hours of becoming aware of it. If the risk is high, we also notify affected people without undue delay.