Privacy policy

OverFlow is a wrestling content platform. We collect what we need to run the product — your account info, what you post, who you follow, and how you use the app. We don’t sell your data. You can delete your account at any time at /settings/delete and we will scrub your identity from our database (followers, posts, comments, etc.).

Verification screenshots (IG handle, wrestler proof photo) are processed in memory and discarded — we don’t store them.

We use Cloudflare R2 for media, Anthropic for AI grading, Resend for email, Ably for realtime, and Vercel for hosting. They each see only what they need to do their job.

Account info. Email, username, display name, password hash (when set), and the OAuth identifiers we get back from Discord / Google / Apple if you sign in with those.

Profile info you provide. Bio, pronouns, tagline, social links, location (zip / city / state), avatar, cover banner.

Content you create. Posts, comments, reactions, saves, Promotions, proof submissions, scenes you join.

Activity signals. Posts you reshare, accounts you follow, accounts you block or mute, what you read (used to compute “new since you last looked” markers), trust score signals derived from the above.

Wrestler identity proof. If you submit a wrestler proof photo or Instagram screenshot for verification, we send the image to Anthropic’s Claude vision API for grading. The image bytes are discarded once we get the verdict back — we don’t store the photo. We do store the AI’s summary verdict (a short text string).

Technical info. IP address (hashed, never stored raw), device user agent, timestamps. Used for security + abuse detection only.

• To give you an account and let you sign in.
• To show your content to other users (per your visibility settings).
• To compute trust score, verification status, reshare-attribution credit, and feed ranking.
• To send you notifications you opted into.
• To detect abuse, spam, and impersonation (the imposter check flags accounts that take a major federation’s name in their first 30 days).
• To comply with legal obligations (DMCA, law-enforcement requests that meet the legal bar).

We share data with these vendors only to the extent they need to deliver the service:

• Vercel — hosting + edge cache. Sees HTTP requests + responses.
• Railway — managed PostgreSQL. Stores everything in §1.
• Cloudflare R2 — object storage. Stores media files (posts, avatars, banners). Cloudflare doesn’t inspect contents.
• Anthropic — Claude API. Sees captions for moderation grading and verification images for AI verification, transiently (Anthropic’s API does not retain content per their published policy).
• Resend — transactional email (verification, password reset). Sees your email address + the email contents.
• Ably — realtime channel auth. Sees account-scoped channel names so it can publish your saves/comments live updates to your own tabs.
• OneSignal / Web Push — when you opt into push notifications. Sees the notification payload + your push token.

We do not sell your data. We do not share it with advertisers. We will share it with law enforcement when legally compelled and will notify you when permitted to do so.

Manage your privacy settings at /settings/privacy:

• Who can DM you (everyone / followers / no one)
• Who can comment on your posts
• Who can tag you in posts
• Default post visibility (public / followers / scenes only)
• Hide from search — keep your account out of search results
• Block by Instagram handle — cross-platform block list
• Block specific accounts — blocked accounts can’t see your posts, comment, or mention you

• Active account data: kept while the account exists.
• Verification screenshots (IG + wrestler proof):processed in memory, never persisted. The AI verdict summary is stored on your account.
• IP hash: retained for 90 days for abuse detection, then purged.
• Soft-deleted account: when you delete, your identity (email, username, display name, avatar, IG handle, OAuth links) is scrubbed immediately. Your posts and comments are soft-deleted (status = ‘deleted’) and stop appearing in feeds. The row remains for 30 days for grace-period recovery, then a future hard-delete sweep removes it entirely.
• Followers, mutes, blocks: the edges remain after account deletion for historical accuracy of the social graph, but the deleted account is no longer addressable.

You have the right to:

• Access — request a copy of your data (email privacy@overflownetwork.app).
• Correct — edit profile, bio, social links at /settings/profile any time.
• Delete — at /settings/delete. Permanent. We honor it immediately.
• Export — email us; we will provide a JSON dump within 30 days.
• Opt out of marketing email — your default opt-in for marketing email is OFF. Verification + security email is required to use the service.

OverFlow is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a minor under 13 has created an account, email legal@overflownetwork.app and we will delete it.

We’ll update this page when our data practices change. Significant changes (new data category, new subprocessor, new retention window) will be announced in-app at least 14 days before they take effect.

For any privacy question: privacy@overflownetwork.app

For data access / export / deletion outside the in-app flow: privacy@overflownetwork.app

For DMCA or rights enforcement: /legal/report-rights