1. Who is responsible
Miju Limited of PO Box 406, Wānaka 9343, New Zealand is responsible for the data described here. Contact hello@overspan.dev about anything on this page.
2. What the API records
For every request that reaches the service, we write one metering record containing:
| Field | Why it exists |
|---|---|
| api_key | Which subscription to count the request against. |
| timestamp | Quota periods and rate limiting. |
| outcome | Whether it completed, was rejected, or failed, and why. |
| http_status | Debugging and support. |
| duration_ms | Capacity planning and future usage-weight pricing. |
| bytes_out | Same. |
| backend | Which of our servers answered, for fault diagnosis. |
What is not recorded
- The content of your queries. The Overpass QL you send is used to serve the request and is never written to our database.
- Your results. Response bodies stream through to you and are not stored.
- Web server access logs. These are deliberately switched off. API keys travel in URLs, so an access log would be a file full of live credentials. The metering record above exists instead.
- Any advertising, profiling, or cross-site identifier. None, with one narrow exception: if you reach our pricing page from a Google ad and then buy, the click identifier from that ad link travels with your order, and any order carries the name of the site that referred you and the page you landed on. Section 5 explains exactly what these are.
Authorization header, it may appear in those logs. This is why the
documentation recommends the header where your client
supports it.
3. Billing information
Lemon Squeezy is the merchant of record for every Overspan subscription. They collect and hold your name, billing address, tax location, and payment details. We never see or store your card details.
What reaches us from them, through their webhooks, is the subscription and order identifiers, the plan you are on, and its status. Their notification also carries your email address. We use it for one thing, sending you the emails in section 4, and we never store it: it is held in memory for the one message and then dropped, so our server holds no record of who you are, only that a subscription exists and what it is entitled to. When you check your key on the usage page, we also ask Lemon Squeezy for your renewal date and your card's brand and last four digits, to show you, and store none of it. See Lemon Squeezy's privacy policy for how they handle the rest. Their checkout page also reports to our Google Analytics; section 5 says what it sends and why we keep that on.
4. Email and the contact form
If you write to hello@overspan.dev we keep the correspondence so we can help you and remember the context next time. We do not add you to a marketing list from a support email, and there is no newsletter to be subscribed to.
The contact form collects your name, your email address, the topic you choose, and your message. It is delivered straight to that same inbox and is not stored on this website, which has no database behind it. Delivery runs on Cloudflare's email service, and your address is set as the reply address so a reply reaches you directly. If delivery fails, nothing is kept and nothing is retried: the page tells you so and asks you to email us instead.
The emails we send you. We email the billing address on a subscription: your API key when you subscribe; a confirmation link when someone with your key asks, on the usage page, to change your plan or replace the key; the new key once a replacement is confirmed; and your key again when you ask with the usage page's "Lost your key?" form. Each time we fetch the address from Lemon Squeezy, hand it to Cloudflare's email service for that one message, and keep no copy. The address you type into "Lost your key?" is used the same way: one lookup with Lemon Squeezy, then dropped. Nothing is sent to an address that pays for no subscription, and we send nothing else: no newsletter, no marketing.
The contact form, and the usage page's "Lost your key?" form, are protected by Cloudflare Turnstile, which checks that a person rather than a script is submitting them. Turnstile loads on the contact page, and on the usage page only once you open that form; on no other page of this site. To make that judgement it processes your IP address, your browser's user agent and TLS characteristics, and the identifier of the site you are on. It is used for that check alone, never for analytics or advertising, and it does not track you between sites.
Turnstile is running in its standard mode here, not the optional pre-clearance mode,
which is the mode that would set a cf_clearance cookie on your browser.
Cloudflare classes what Turnstile does store as strictly necessary for security.
5. This website
We use Cloudflare Web Analytics to see how many people visit and which pages they read. It is chosen for what it cannot do. Per Cloudflare it uses no cookies and no other client-side storage, it does not track visitors over time by IP address, user agent or any other fixed attribute, IP addresses are stripped at their edge rather than stored, and query strings are not logged. It measures page loads, not people.
That counter stores and reads nothing on your device, which is why it needs no consent from anyone. There is no advertising and no profiling anywhere on this site. The one ad-related thing we record is described under "Ad click attribution" below.
Ad click attribution
We may advertise on Google search. If you arrive here from one of those ads, the link carries a click identifier from Google and the campaign and search term it was shown for. If you then buy a subscription, the pricing buttons attach those values to your order, and Lemon Squeezy passes them to us with the subscription. They are kept for the current browser tab only, never in a cookie, and nothing is sent anywhere unless you buy. We use them for one thing: knowing which ads led to a sale. Once a month we send the click identifiers of paid orders back to Google Ads so it can count them as conversions. That upload contains the click identifier alone: no name, no email, nothing about your queries.
The same mechanism tells us where any sale came from, ad or not. When you first open
this site in a tab, we note the name of the site that sent you (the hostname only, such
as wiki.openstreetmap.org, never the full address, and nothing if your browser
sent none) and which of our pages you landed on. If you buy, those two values travel with
the order in the same way. Where your analytics choice (below) allows it, your browser
also keeps the sending site and landing page of your first visit for
90 days, so a purchase on a later visit can be credited to where you first heard of
us; the order then carries both that first visit and the one you bought in. Switching
analytics off deletes that note. Where your choice does not allow it, the values stay
in the current browser tab only. Either way they are never sent to Google, nothing
leaves your browser unless you buy, and they tell us only which sites and pages lead
to subscriptions.
The free export tool
The OpenStreetMap export tool sends what you type to this website's own server and nowhere else from your browser. To find the place you mean, our server passes the place name to the public search of Wikidata, run by the Wikimedia Foundation. Your network address is not passed on: Wikidata sees a request from our server, not from you. The export itself runs on our own API under a key that belongs to the tool, so nothing about you travels with it.
Neither the search nor the export is stored by this website. Answers are kept in Cloudflare's cache for up to an hour, labelled only with the place and the tag, so the next person asking the same thing gets them without a new query. To stop one visitor using the tool up for everyone, Cloudflare also counts requests per network address over a one-minute window, for that purpose only. The files you download are built in your browser and never uploaded.
The tool also keeps a note in your own browser of the exports you run in a day: how many, and the place and tag of each. It is there for one thing: once you pass ten exports in a day, the page shows you a ready-made script that reruns them all with an API key. The note is never sent to us or to anyone else, and it holds one day at most, because the tool deletes an older note as soon as it sees one. It follows your analytics choice below: in the EU, EEA, UK and Switzerland it is kept only after you accept analytics, elsewhere until you switch analytics off, and switching analytics off deletes it.
Google Analytics
We also use Google Analytics to understand how visitors move through the site: which pages bring people in, which lead on to the documentation, and where they leave. Unlike the counter above, it sets cookies on your device and it is operated by Google. We load it with its advertising features switched off: it measures, it does not build ad profiles, and nothing it collects is used for ads.
What happens depends on where you are:
- In the EU, the EEA, the United Kingdom or Switzerland, Google Analytics does not load on this site until you accept it on the banner. If you decline, or simply ignore the banner, no Google Analytics code runs here at all.
- Everywhere else it runs by default, and you can switch it off right here:
The checkout is the one exception, and we want to be plain about it.
The pages at store.overspan.dev are run by Lemon Squeezy, not by us, and we
have set their checkout to report to the same Google Analytics property: that a checkout
was opened, that payment details were entered, and the purchase, with the order total,
the tax and the currency. Lemon Squeezy loads Google Analytics there for every visitor,
before and regardless of any choice you made on this site, because their checkout has
no way to ask you and offers us no way to make it wait. So a visitor in the EU, EEA,
UK or Switzerland who declined analytics here still gets Google's cookies on the
checkout, and because those cookies are set for overspan.dev as a whole,
they come back to this site with you. They do nothing here: while your choice is
"declined", no Google code loads on this site to read them. We keep the checkout
reporting on for one reason, to see how many people who open a checkout finish it,
which is how we notice when the checkout itself is broken. It tells us nothing about
where you came from. If you would rather it did not run, block Google's analytics
domains in your browser before you open the checkout; the purchase works exactly the
same without them.
Your region is worked out from your network address at our edge when the page asks whether to show the banner, and it is not stored on our side. See Google's privacy policy for how Google handles what it collects.
This site stores these small things in your browser and sends none of them anywhere: your light or dark theme preference, your analytics choice, a for-this-visit note of whether your region requires the consent banner, and, where your analytics choice allows it, the export tool's note of the day's exports and the 90-day note of your first visit, both described above.
The web fonts are served from this site, not from a font CDN. Whether Google learns of your visit is decided by the Google Analytics rules above and by nothing else on the page. Besides the analytics described in this section, the only third-party code on the site is the Turnstile widget described in section 4, which appears on the contact page and in the usage page's lost-key form alone.
6. Why we are allowed to hold this
Metering records exist because we cannot operate a metered subscription service without them: they are necessary to perform our contract with you and to protect the service against abuse. Billing data is processed to meet our legal and tax obligations. Google Analytics is the one optional thing on this page, together with the export tool's note of your exports, which follows the same choice. In the EU, EEA, UK and Switzerland they run on your consent and not before; elsewhere we rely on our legitimate interest in understanding how the site is used and in showing heavy users of the free tool how to automate it, and section 5 has the switch to turn both off. The checkout page is the one place this falls short: Lemon Squeezy loads Google Analytics there without asking first, we cannot change how their checkout works, and we have chosen to keep that reporting for the reason given in section 5. We say so here rather than pretend the choice reaches it. Everything else here happens without consent because none of it is optional: we could not run the service without it.
7. How long we keep it
A job runs once a day and enforces this automatically. It is not a policy we intend to follow, it is one the software applies whether anyone remembers it or not.
| What | Kept for | Then |
|---|---|---|
| Individual request records | 90 days | Collapsed into a per-day total for your key and deleted. After 90 days no record of any individual request exists. |
| Daily totals (request counts and bytes, per key per day) | 2 years | Deleted. Kept this long only to understand capacity and to work out fair usage-based pricing. |
| Your key and subscription status | While the subscription exists | The key is deactivated when the subscription ends. |
| Ad click identifier, campaign, referring site name and landing page attached to a subscription | While the subscription record exists | Deleted with it. Sent to Google Ads once, within 90 days of the click, as a conversion (section 5). |
| Records of confirmation links: which subscription asked, for what, and when. Never your email address. | 2 days | Deleted. Kept that long only to enforce the limits on how often confirmations can be asked for. |
| Emails and contact form messages | As long as the correspondence is useful | They live in a mailbox, not in the service. |
| Billing and invoices | As long as tax law requires | Held by Lemon Squeezy as merchant of record, not by us. |
Ask us before you cancel if you would like a copy of your own usage history.
8. Who else touches it
- Lemon Squeezy, as merchant of record, for payments and subscription management; their checkout also reports to our Google Analytics (section 5).
- netcup GmbH, our hosting provider, whose servers in Nuremberg, Germany and Vienna, Austria run the API. The service and its database therefore sit inside the EU.
- Cloudflare, which provides DNS, serves this website, delivers contact form messages to our inbox, sends the emails described in section 4 (your key and the confirmations), runs the Turnstile anti-spam check on the contact page and the usage page's lost-key form, provides the cookieless page analytics described in section 5, and caches and rate-limits the free export tool (also section 5).
- Our backup storage, Cloudflare R2, which holds an encrypted-in-transit copy of the subscription and metering database so a server failure does not lose your account.
- Google, twice over:
hello@overspan.devis forwarded to a Gmail mailbox, so anything you email us, or send through the contact form, is delivered there and read there. And when Google Analytics runs, under the rules in section 5, on this site or on the Lemon Squeezy checkout, Google processes that visitor data for us. Where a subscription came from a Google ad, Google Ads also receives that order's click identifier, as described in section 5.
We do not sell data, and we do not share it with anyone else except where the law requires it.
Where your data actually goes
- The service itself runs in the EU. The API, its database and the metering records all live on netcup's servers in Germany and Austria, so using Overspan does not move your usage data out of Europe.
- We are based in New Zealand, which the European Commission recognises as providing an adequate level of data protection. Personal data may therefore move between the EEA and New Zealand without additional safeguards being required.
- Some providers are United States companies, specifically Lemon Squeezy, Cloudflare and Google, so data handled by them may be processed in the United States.
9. Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Mail hello@overspan.dev and we will respond within 20 working days.
Because there is no account system, we may need to verify that you control the email address on the subscription before acting on a request.
If you are unhappy with our response, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz). If you are in the EU or the UK, you may also complain to your local data protection authority.
10. Changes
If this policy changes materially we will email subscribers before it takes effect and update the version and date at the top of this page.