The short version
Your live buyer, sale, and stream data is processed entirely on your own computer and never leaves your machine — we never receive it or store it. The only personal data we handle is what's needed to run the website, sell you a license, and keep the app working: basic analytics, your purchase/account details (handled by Stripe), and anonymous, no-PII product-usage data from the app. We don't sell your data. This summary is for convenience; the full policy below controls.
1. Who we are & scope
This Privacy Policy explains how Overlay Deck ("Overlay Deck," "we," "us," or "our") — an independent product — collects, uses, and shares information when you visit overlaydeck.com (the "Site"), purchase a license, or use the Overlay Deck desktop helper application and Chrome extension (together, the "App"). By using the Site or App, you agree to this Policy. If you do not agree, do not use them.
Overlay Deck is an independent tool and is not affiliated with, endorsed by, or sponsored by Whatnot, OBS, or any other third-party platform mentioned here.
2. Information we collect
a. Information you give us
- Purchase & account information. When you buy a license or manage a subscription, our payment processor Stripe collects your payment details and contact information. We do not see or store your full card number — Stripe handles that. We receive limited records such as your email address, the product purchased, subscription status, the last four digits / card brand, and a Stripe customer ID, which we use to issue and validate your license.
- Communications. If you email us (e.g., support), we receive your email address and the contents of your message.
b. Information collected automatically on the Site
- Analytics & usage data. We use Google Analytics 4 to understand how the Site is used. This may include your IP address (typically truncated/anonymized by Google), device and browser type, pages viewed, referring URLs, and approximate location, collected via cookies and similar technologies. See Cookies & Analytics below. We also record anonymous first-party events to our own analytics — for example which installer platform was downloaded — without cookies or personal identifiers.
c. Information from the App (desktop helper + extension)
- Local-only stream data. The App reads live data from your Whatnot stream tab — sales, bids, viewer counts, buyer usernames, leaderboard, and (if you use Card Comp) captured video frames. All of this is processed locally on your computer and transmitted only between the extension, the local helper app, and your own OBS over a local connection. It is never sent to us.
- License validation. To verify your license, the App periodically contacts our servers (hosted on Google Cloud / Firebase) with your license key and basic technical metadata (e.g., app version, a machine identifier, and timestamps). We use this to confirm entitlement and enforce the one-machine-per-key limit.
- Anonymous usage analytics. The App sends anonymous product-analytics events — for example app launches, license activations, connecting OBS, adding a widget to OBS, or using Card Comp — tagged only with a random install identifier, the app version, and your operating system. These events contain no buyer data, usernames, card images, stream content, payment details, or other personal information. We use them to understand which features are used and to prioritize improvements and fixes.
- Anonymous health signal. The App sends only aggregate technical counters — such as the number of data frames seen and how many were recognized — so we can detect when a platform change breaks the data tap and push a fix fast. This is on by default and can be turned off anytime via "Share anonymous health" in Settings. It contains no buyer data, usernames, card images, or other personal information.
d. Information we do not collect
We do not collect or store your viewers' or buyers' personal information, your captured card images, your full payment card number, or the contents of your stream. Those stay on your machine or are handled by Stripe.
3. How we use information
- To provide, operate, and maintain the Site and App;
- To process purchases, issue and validate license keys, and manage subscriptions;
- To respond to your support requests and communicate with you about your account or service changes;
- To monitor, debug, and improve reliability (including the anonymous health signal);
- To detect, prevent, and address fraud, abuse, security issues, and violations of our Terms;
- To comply with legal obligations and enforce our agreements.
Where required by law, our legal bases for processing are: performance of a contract (providing the service and processing purchases), our legitimate interests (security, analytics, product improvement), your consent (non-essential cookies where applicable), and compliance with legal obligations.
5. How we share information
We do not sell your personal information. We share information only as follows:
| Recipient | Purpose |
|---|---|
| Stripe | Payment processing, billing, and subscription management. See Stripe's Privacy Policy ↗. |
| Google / Firebase | Website hosting, backend functions, license validation storage, and analytics. |
| Legal & safety | When required by law, subpoena, or to protect our rights, users, or the public, or to investigate fraud or abuse. |
| Business transfer | In connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. |
6. Third-party services you connect
The App lets you connect optional third-party services using your own credentials. When you do, your interactions go directly between your computer and those providers under their terms and privacy policies — not ours:
- Card Comp uses your own Anthropic API key (to identify cards) and your own PokémonPriceTracker API key (for pricing). Your keys are stored only on your computer and are sent only to those services and your local comp service.
- OBS Studio connections (for one-click "Add to OBS") happen locally between the App and OBS on your machine.
7. Data retention
We retain purchase and license records for as long as your account/license is active and as needed to comply with legal, tax, and accounting obligations. Analytics data is retained per Google Analytics' default retention settings. Locally-processed stream data is controlled by you and is not retained by us. You may request deletion of your account data as described in Section 8.
8. Your privacy rights
Depending on where you live, you may have the following rights. We honor these regardless of location where practical.
EEA / UK (GDPR)
You have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your local data protection authority.
California (CCPA / CPRA)
You have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
How to exercise your rights
Email support@overlaydeck.com with your request. We may need to verify your identity before acting. We will respond within the timeframe required by applicable law.
9. Data security
We use reasonable administrative and technical measures to protect information, including transport encryption (HTTPS/TLS) and reputable infrastructure providers. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for safeguarding your own credentials, API keys, and license key.
10. International data transfers
We are based in the United States, and our providers (Google, Stripe) may process data in the U.S. and other countries. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. By using the Site or App, you understand your information may be processed in the United States.
11. Do Not Track & global privacy controls
Some browsers offer "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. Where required by law, we treat a recognized GPC signal as a valid opt-out of sale/sharing. There is no industry-standard response to DNT, so we may not respond to DNT signals beyond what is described here.
12. Children's privacy
The Site and App are not intended for anyone under 18, and are not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
13. Changes to this policy
We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, may provide additional notice. Your continued use after changes take effect constitutes acceptance.
14. Contact us
Questions about this Policy or your data? Email support@overlaydeck.com.