Privacy Policy

Last updated: October 4, 2026. This policy covers the app Overpage for iPhone, iPad and Android and the website overpage.agencyg.de.

1. Who is responsible

Leon Rudolf, Agency Scripts, Die Halde 2, 64853 Otzberg, Germany. Email: [email protected].

2. Without an account

Scanning, image processing, text recognition and AgencyAI run entirely on your device. Your documents are stored on your device or, if you choose so, in your own iCloud Drive (handled by Apple under Apple's privacy policy). On Android they stay in the app's storage on your device and in your device backup if you have it turned on (handled by Google). We receive none of this data. On Android, text recognition uses Google ML Kit through Google Play services and AgencyAI uses Gemini Nano through Android AICore; both run on your device, Google only downloads the models. The camera is used only while you scan, images are not sent anywhere. The app contains no advertising, no analytics and no tracking.

3. With an Overpage account

You can sign in with Apple or Google, in the app and on the website. We then receive an account identifier from Apple or Google and, if shared, your name and email address (with Apple possibly a relay address). If you keep documents in your Overpage account, the PDFs are transferred to and stored on our server in Germany so you can open them on other devices and on the web. Legal basis: performance of the contract you request (Art. 6(1)(b) GDPR). The data is stored as long as your account exists.

Each account has a storage limit. Data is transmitted encrypted (HTTPS). You can delete your account and all stored documents at any time in the app under Settings, Account, Delete account; the deletion on our server happens immediately. Documents on your device are not affected.

4. Website

The website sets no cookies and uses no tracking, analytics or third-party scripts or fonts. After you sign in, your session is kept in your browser's local storage until you sign out; this is strictly necessary for the service you request (§ 25(2) no. 2 TDDDG). When you choose "Sign in with Apple" or "Sign in with Google", your browser is sent to Apple or Google, who process your data under their own privacy policies; we only receive the confirmation of your sign-in.

5. Service providers

Our website and service are delivered through Cloudflare, Inc. (content delivery and protection against attacks). Cloudflare processes connection data such as your IP address on our behalf (Art. 28 GDPR). Cloudflare may process data in the USA; the transfer is based on the EU-US Data Privacy Framework, for which Cloudflare is certified, and standard contractual clauses. Legal basis: our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR). Documents themselves are stored only on our server in Germany.

6. Overpage Pro

Overpage Pro is sold through the App Store on iPhone and iPad and through Google Play on Android. Payment is handled by Apple or Google; we do not receive payment details. If you are signed in, the app sends Apple's signed purchase receipt or the Google Play purchase token to our server so Pro also works on the web; for Google Play our server confirms the purchase with Google. We store that Pro is active and the transaction or order number (Art. 6(1)(b) GDPR).

7. Share links

If you create a share link for a document, anyone who has the link can open and download that document until it expires or you stop sharing. You decide whom you send it to. For a link we store the document path, expiry date, an optional password (only as a salted hash) and the number of views, no data about the people who open it beyond the technical logs in section 9. Share links end automatically when the document or your account is deleted.

8. Uploads you set up

If you add your own Paperless-ngx, Nextcloud or WebDAV server, Overpage sends your documents directly from your device to that server. Passwords and tokens stay in the keychain of your device (on Android encrypted with the Android Keystore). We do not receive them.

9. Logs

Our server keeps technical access logs (IP address, time, request) for security and error analysis for up to 14 days (Art. 6(1)(f) GDPR).

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to lodge a complaint with a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (HBDI). Contact us at [email protected].