Privacy policy

Overshot is a research tool for public TikTok posts, run by Overshot. You can browse without an account. We do not sell personal data or use session recording. We use Google Analytics and Meta advertising tools as described below, and you can disable them at any time.

1. What we collect

• Account information: your email address and authentication details. If you use Google sign-in, we also receive your name, profile picture, and Google account identifier.
• Your activity: pages you visit while signed in, videos and products you save, account preferences, videos you open, and important account or subscription actions. Opened-video records are used to improve your recommendations; the short-lived activity timeline is used for customer support and product troubleshooting. This is an event history, not a recording of page contents, typing, or mouse movement.
• Subscription information: your plan, subscription status, and Stripe customer and subscription identifiers. Stripe handles your card and billing details; they do not reach our server.
• Technical information: your IP address may appear in short-lived server logs and is used for security and rate limiting. It is also included when you submit the contact form so abusive messages can be investigated.
• Analytics information: unless you disable measurement, Google Analytics receives information about page views, sessions, approximate location, and browser and device characteristics. Google Analytics may set browser identifiers to distinguish visits.
• Signup attribution: unless you disable measurement, we preserve the first Overshot path you visited, the referring page without its query string, and recognized campaign parameters such as UTM tags and Google, Meta, Microsoft, or TikTok click identifiers. We do not retain unrecognized landing-page query parameters.
• Advertising measurement information: unless you disable advertising measurement, we send Meta page-view, content-view, registration, checkout, and initial-subscription events. Matching information may include a hashed email address and hashed internal account identifier, along with your IP address, browser user agent, Meta click and browser identifiers, event source URL, and subscription value and currency.

2. How we use it

We use this information to operate your account, keep you signed in, save your choices, personalize recommendations, process subscriptions, provide support, enforce plan limits, and protect the service from abuse. Unless you disable measurement, we also use aggregate Google Analytics reporting to understand how the site is used and use Meta data to attribute registrations and subscriptions to ads, measure return on ad spend, and improve ad delivery. First-touch signup attribution helps us distinguish direct, search, referral, affiliate, and campaign-driven signups. We do not sell it or use account information to train AI models.

3. Cookies

Overshot sets one essential session cookie when you sign in. It contains a random token, is marked HttpOnly and SameSite=Lax, and is marked Secure over HTTPS. It is used only to authenticate your session. If you choose Google sign-in, we also use short-lived security cookies to complete that sign-in flow. If you change the measurement setting, we save that preference for one year so the site can remember it.

Unless measurement is disabled, a first-party HttpOnly cookie remembers a bounded copy of your first landing and recognized campaign markers for up to 30 days. It is attached to your account if you register and is then removed from the browser. It is not an authentication cookie and does not contain arbitrary query parameters.

Analytics and advertising measurement are enabled by default. Google Analytics may set_ga and _ga_* browser identifiers, which normally last up to two years. The Meta Pixel may set _fbp and preserve a Meta click identifier in_fbc. You can disable or re-enable Google Analytics, the Meta Pixel, and the Meta Conversions API below. Disabling measurement does not affect access to Overshot.

4. Public TikTok content

Our research index is built from public TikTok posts obtained through a third-party API. We store public post and creator information, engagement metrics, captions, and copies of videos, slides, and cover images, along with our analysis of that content. Copies are necessary because TikTok's media links expire.

We do not have access to private TikTok accounts or private TikTok data, and Overshot is not affiliated with TikTok or ByteDance. Creators can request removal through the contact form.

5. Service providers

We use a small number of providers to operate Overshot:

• Stripe for subscriptions and payment processing.
• Resend for account and billing emails.
• Google for Google Analytics and, when you choose it, Google sign-in.
• DigitalOcean for hosting, database storage, and archived media.
• Meta for ad attribution, audience matching, campaign measurement, and ad-delivery optimization through the Meta Pixel and Conversions API, unless you disable advertising measurement.
• Google Gemini and OpenAI to analyze public TikTok content, create embeddings, and perform some verification. They may receive public content and the search or verification input needed to provide those features, but not your billing details or saved items.
• RapidAPI to retrieve public TikTok content.

6. How long we keep data

• Your account, preferences, and saved items remain until your account is deleted.
• Opened-video records expire 180 days after the most recent open.
• Signed-in page and action history expires after 180 days.
• Sessions expire or are removed when you sign out.
• Email confirmation and password-reset codes expire within minutes.
• Billing records and Stripe event history may be retained for accounting, dispute, and legal obligations.
• Server logs are short-lived.
• Pending first-touch signup attribution expires from the browser after 30 days. If you register, that attribution remains with the account until you disable measurement or delete the account.
• Meta attribution context retained for a server-confirmed purchase—including click and browser identifiers, IP address, and browser user agent—expires after 30 days and is deleted earlier after successful purchase measurement, opt-out, or account deletion. Meta retains event data under its own business-tools terms and controls.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to certain uses. We honor those requests regardless of location where reasonably possible.

You can disable analytics and advertising measurement at any time using the controls above or Ad choices in the footer. We then stop Google Analytics collection and prevent its tag from loading on later pages, stop sending Meta events, remove the Google Analytics and Meta browser cookies we can access, and delete stored Meta attribution identifiers and first-touch signup attribution associated with your signed-in account.

To delete your account or make a privacy request, use the contact form or email us from the address on your account. Account deletion removes your sessions, saved items, preferences, usage records, and opened-video history. Stripe may retain transaction records it is legally required to keep. We aim to respond within 30 days.

8. Children

Overshot is intended for marketers and is not directed at children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

9. Changes and contact

If this policy changes materially, we will update the date above and notify account holders when appropriate.

• The contact form, which reaches an inbox that is read.
• overshotapp@gmail.com
• Overshot

See also the terms of service and the refund policy.