Privacy
The short version
Overlap answers one question: when can a group meet. To do that it needs to know what time zone you are in and the hours you keep. It does not need to know what is in your calendar, and it does not store that.
There is no account, no password, and no tracking or advertising of any kind.
What is stored
- The circle name you choose, and a random link for it.
- Your display name, time zone, sleeping hours, and working hours.
- Start and end times of your busy periods, if you connect a calendar. Nothing else about those events.
- An email address, only if you choose to add one for recovering lost links.
- Approximate coordinates of your time zone’s representative city, to place a marker on the globe. This is derived from the zone you picked, not from your device location.
Secrets are encrypted at rest with AES-256-GCM: your email address, and the calendar credential if you connect one. Your email is additionally indexed by a keyed hash so recovery can find your circles without the database holding a searchable list of addresses.
What is never stored
- Event titles, descriptions, attendees, locations, or any other calendar content. There is no column for them.
- Your device location, IP-based location, or precise coordinates.
- Passwords, since there are none.
- Analytics, advertising identifiers, or third-party trackers.
Google Calendar
Connecting Google is optional. When you do, Overlap requests exactly one scope, calendar.freebusy, which returns only the start and end times of periods when you are busy. It cannot read event titles, attendees, or any other content, so the promise above is enforced by the interface Google exposes rather than by our restraint.
Overlap’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to show when the people in your circle are free, is never sold or transferred, is never used for advertising, and is never read by a human.
Disconnecting is immediate: remove the connection and the stored credential is deleted. You can also revoke Overlap’s access at any time from your Google account permissions.
Who can see your information
Anyone holding a circle’s link can see the names, time zones, and availability of everyone in that circle. That is what the tool is for, and it is worth being plain about: a circle link is the only thing protecting it, so treat it like a shared document link and share it only with the people who should be in it.
Email addresses are the exception: they are never shown to anyone else in the circle, and are used only to send you your own links.
If you add an address, Overlap sends mail to it in exactly one situation: when someone asks for that address’s circle links to be re-sent. There are no newsletters, product updates, or marketing messages, because there is no system here to send them.
The recovery page never reveals whether an address is known to us. It shows the same response either way, so it cannot be used to check whether a particular person uses Overlap.
Deleting your information
Open your circle, choose to change your setup, and you can update or clear what you have entered. To remove yourself or a whole circle entirely, email privacy@advancelabs.dev with the circle link and it will be deleted.
Being straight about a limit: Overlap does not currently expire or automatically delete old circles. If that changes, this page changes with it.
Where it runs
Overlap is hosted on Vercel with a Neon Postgres database, and email is sent through Resend. Those providers process data on our behalf in order to run the service. Data may be stored or processed outside your country.
Contact
Advance Labs Inc., 92-971 Adelaide St S, London, Ontario N6E 2H3, Canada. Questions about this page go to privacy@advancelabs.dev.