Overflow Privacy Policy

Last updated: 9/27/26 | Effective: 9/27/26

Our Privacy Philosophy

We built Overflow for people who ask hard questions - including questions about privacy and data use. This policy is written in plain language because we believe transparency means you shouldn't need a law degree to understand what happens to your data.

The short version: We collect what's publicly visible on social media, the campaign data you create, and parts of your DM conversations with leads (which our AI uses to draft replies). You control everything. We never sell your data. AI helps draft messages, but you always approve them before sending. You can delete everything anytime (just ask).

What We Collect

Public Social Media Data

When you create a campaign, Overflow searches Instagram and/or LinkedIn for prospects who match your criteria. We collect:

Public profile information (bio, username, profile photo)
Public posts and captions
Publicly listed followers/following (if relevant to search)
Hashtags and location tags

"Public" means: Information visible to anyone without logging in. We never access private accounts or locked profiles.

Your Campaign Data:

Prospects you select for outreach
Messages you create and approve
Comments you draft and post
Notes you add about prospects
Campaign performance (who responded, who booked calls)

Account Information

Email address
Payment information (processed by Stripe - we never see your full card number)
Name and any profile details you provide

Browser Extension Data (only if you use Overflow Sender)

Your logged-in Instagram username, used to confirm it matches the account registered to your Overflow profile before acting.
A connection token, stored locally in your browser, that lets the extension fetch your approved actions from Overflow.

Lead Conversation Data (your Instagram DMs with leads)

When Overflow helps you follow up with a lead, it reads the messages in your Instagram DM conversation with that lead — so it can tell whether they replied and draft a relevant next message. Parts of those conversations are stored in your Overflow account and sent to our AI providers (Anthropic's Claude, and any other AI platforms we use) to generate the drafts. This applies only to your conversations with the leads and prospects in your campaigns — never your personal or unrelated DMs.

Technical Data

Browser type and device info
IP address
How you use Overflow (which features, when)

What We DON'T Collect

Let's be clear about boundaries:

The contents of your personal or unrelated direct messages. Overflow only reads the DM conversations with the leads in your campaigns, and only to track replies and draft follow-ups (see "Lead Conversation Data" above) — never your other messages.
Data from locked/private social media accounts
Your social media passwords or login credentials
Anything behind authentication walls
Data from people who haven't given Overflow permission

How We Use Your Data

To Help You Find Aligned Clients

AI analysis: We use AI (Anthropic's Claude) to analyze public profiles and identify values, mission, and alignment signals from bios and posts
Message drafting: AI generates personalized message drafts based on prospect profiles
Campaign tracking: We track who you contacted, who engaged, who responded

Critical: Nothing goes out without your approval. You review and approve every message and action — AI drafts, you decide. If you use the Overflow Sender browser extension (see below), it only carries out the actions you've already approved; it never writes or sends anything on its own.

To Improve Overflow

Understand which features work well (and which don't)
Fix bugs and improve performance
Develop new features based on how people actually use the platform

To Communicate With You

Send campaign notifications
Respond to support requests
Share product updates (you can opt out)

The AI Question

"Does AI send messages on my behalf?"

No. Never. Here's exactly how it works:

Overflow finds prospects matching your criteria
AI drafts personalized messages based on their public profiles
You review, edit, and approve every message
You manually post/send the message yourself
You track responses in your campaign dashboard

"Do you train AI models on my data?"

No. We use Anthropic's Claude API for processing, but we don't use your data to train AI models. Your campaigns, messages, and prospect data stay yours.

"What does the AI see?"

Public profile data you're researching, the message drafts you're creating, and — when you're following up with a lead — the messages in that lead's Instagram DM conversation, so it can draft a relevant next message.

The Overflow Sender Browser Extension

Overflow Sender is an optional companion to your Overflow account. If you choose to install and connect it, this section explains what it accesses and stores. (Everything here is also governed by the rest of this policy.)

What the extension accesses

Your logged-in Instagram session in your browser, to perform the actions you approved in Overflow (likes, comments, follows, direct messages).
Your Instagram username, to confirm it matches the account registered to your Overflow profile before acting — a safety check so it can never act from the wrong account.
The list of approved actions for your account, fetched from Overflow using your connection token.

What the extension stores

Your Instagram username, to confirm it matches the account registered to your Overflow profile before acting — a safety check so it can never act from the wrong account.

How sending works

The extension performs only the actions you've already approved in Overflow, from your own browser and IP, at a natural human pace. To track replies and draft context-aware follow-ups, it reads the messages in your DM conversations with leads; those are stored in your Overflow account and processed by our AI providers as described above. It does not read your other, non-lead conversations.

What the extension does NOT do

It does not collect your contacts or followers list, and it never sells any of your data.
It does not ask for or handle your Instagram password.
It does not run when your browser is closed, and it does not route traffic through any proxy or third-party server. Actions happen from your own browser.

Data sharing

The only network destinations for the extension itself are Instagram (to perform your approved actions) and Overflow's own backend at app.overflowthrive.com (to fetch your approved actions and report results, including the lead-conversation context described above). Overflow's backend may in turn process that data with our AI providers; it is never shared with advertisers, data brokers, or any other third party.

Data retention

Local browser storage persists until you disconnect or remove the extension. Action records live in your Overflow account, governed by the retention terms below.

Who Sees Your Data

You: Full access, always.
Overflow team: Limited access for customer support only.

Service providers we use:

Anthropic (Claude AI): Processes prospect data and lead DM conversation content, and generates message and follow-up drafts. Their privacy policy
Stripe: Processes payments. Their privacy policy
Supabase: Stores your encrypted data and handles authentication. Their privacy policy.
Railway: Hosts the application. Their privacy policy.

Who we DON'T share with:

Advertisers
Data brokers
Marketing companies
Anyone else, ever

We will never sell your data. Period.

Data Retention & Deletion

Campaign data: Stored for 90 days after a campaign ends, then automatically deleted (unless you explicitly save it).
Account data: Kept until you delete your account.
Prospect data: Deleted when the campaign ends (90 days) or when you manually delete it.

How to Delete Your Data

Delete a campaign: Go to Campaign Settings → Delete Campaign. All associated data is removed within 7 days.
Delete your account: Settings → Delete Account. Everything is permanently deleted within 30 days.
Export your data: Settings → Export Data. We'll send you a complete copy of everything we have.

Your Rights

You have the right to:

✅ Access your data anytime (it's all in your dashboard)
✅ Export everything we have about you
✅ Correct inaccurate information
✅ Delete your account and all data
✅ Opt out of marketing emails (unsubscribe link in every email)
✅ Object to data processing (though this means Overflow won't work)

For EU users (GDPR): You have additional rights including data portability and the right to lodge a complaint with your local data protection authority.

For California users (CCPA): You have the right to know what personal information we collect, delete it, and opt out of any "sale" (which we don't do anyway).

Security

We take security seriously:

All data is encrypted in transit (HTTPS) and at rest
Access to data is limited to essential team members only
We use industry-standard security practices
Regular security audits

If there's a breach: We'll notify you within 72 hours and explain what happened, what data was affected, and what we're doing about it.

Children's Privacy

Overflow is not intended for anyone under 18. We don't knowingly collect data from children. If we discover we have, we'll delete it immediately.

International Users

Overflow is based in the United States. If you're using Overflow from outside the US, your data may be transferred to and processed in the US. By using Overflow, you consent to this transfer.

We comply with GDPR for EU users and CCPA for California users.

Changes to This Policy

If we make significant changes to this privacy policy, we'll:

Email you at least 30 days before changes take effect
Post a notice in your Overflow dashboard
Update the "Last updated" date at the top of this page

Continued use of Overflow after changes take effect means you accept the updated policy.

Questions? We're Here.

We know privacy matters to you. If you have questions, concerns, or just want to understand something better:

Email us: joseph@overflowthrive.com
Response time: Within 2 business days

The Bottom Line

Your data is yours. We collect what's publicly available, what you create in campaigns, and parts of your DM conversations with leads (which our AI uses to draft replies). You control everything. AI helps you work faster, but you're always in charge. We never sell your data. You can delete everything anytime.

If something in this policy doesn't make sense or feels off, please tell us. We built Overflow for people who ask hard questions, and we want to earn your trust.

Overflow

OverflowThrive.com