1. Who is responsible
Miju Limited of PO Box 406, Wānaka 9343, New Zealand is responsible for the data described here. Contact hello@overspan.dev about anything on this page.
2. What the API records
For every request that reaches the service, we write one metering record containing:
| Field | Why it exists |
|---|---|
| api_key | Which subscription to count the request against. |
| timestamp | Quota periods and rate limiting. |
| outcome | Whether it completed, was rejected, or failed, and why. |
| http_status | Debugging and support. |
| duration_ms | Capacity planning and future usage-weight pricing. |
| bytes_out | Same. |
| backend | Which of our servers answered, for fault diagnosis. |
What is not recorded
- The content of your queries. The Overpass QL you send is used to serve the request and is never written to our database.
- Your results. Response bodies stream through to you and are not stored.
- Web server access logs. These are deliberately switched off. API keys travel in URLs, so an access log would be a file full of live credentials. The metering record above exists instead.
- Any advertising, profiling, or cross-site identifier. None, anywhere.
Authorization header, it may appear in those logs. This is why the
documentation recommends the header where your client
supports it.
3. Billing information
Lemon Squeezy is the merchant of record for every Overspan subscription. They collect and hold your name, billing address, tax location, and payment details. We never see or store your card details.
What reaches us from them, through their webhooks, is the subscription and order identifiers, the plan you are on, and its status. Their notification also carries your email address, and we deliberately discard it rather than store it: nothing in the service needs it, so our server holds no record of who you are, only that a subscription exists and what it is entitled to. See Lemon Squeezy's privacy policy for how they handle the rest.
4. Email and the contact form
If you write to hello@overspan.dev we keep the correspondence so we can help you and remember the context next time. We do not add you to a marketing list from a support email, and there is no newsletter to be subscribed to.
The contact form collects your name, your email address, the topic you choose, and your message. It is delivered straight to that same inbox and is not stored on this website, which has no database behind it. Delivery runs on Cloudflare's email service, and your address is set as the reply address so a reply reaches you directly. If delivery fails, nothing is kept and nothing is retried: the page tells you so and asks you to email us instead.
The form is protected by Cloudflare Turnstile, which checks that a person rather than a script is submitting it. Turnstile loads on the contact page only, and on no other page of this site. To make that judgement it processes your IP address, your browser's user agent and TLS characteristics, and the identifier of the site you are on. It is used for that check alone, never for analytics or advertising, and it does not track you between sites.
Turnstile is running in its standard mode here, not the optional pre-clearance mode,
which is the mode that would set a cf_clearance cookie on your browser.
Cloudflare classes what Turnstile does store as strictly necessary for security.
5. This website
We use Cloudflare Web Analytics to see how many people visit and which pages they read. It is chosen for what it cannot do. Per Cloudflare it uses no cookies and no other client-side storage, it does not track visitors over time by IP address, user agent or any other fixed attribute, IP addresses are stripped at their edge rather than stored, and query strings are not logged. It measures page loads, not people.
That counter stores and reads nothing on your device, which is why it needs no consent from anyone. There is no advertising, no ad tracking and no profiling anywhere on this site.
Google Analytics
We also use Google Analytics to understand how visitors move through the site: which pages bring people in, which lead on to the documentation, and where they leave. Unlike the counter above, it sets cookies on your device and it is operated by Google. We load it with its advertising features switched off: it measures, it does not build ad profiles, and nothing it collects is used for ads.
What happens depends on where you are:
- In the EU, the EEA, the United Kingdom or Switzerland, Google Analytics does not load until you accept it on the banner. If you decline, or simply ignore the banner, no Google Analytics code runs at all.
- Everywhere else it runs by default, and you can switch it off right here:
Your region is worked out from your network address at our edge when the page asks whether to show the banner, and it is not stored on our side. See Google's privacy policy for how Google handles what it collects.
This site stores three small things in your browser and sends none of them anywhere: your light or dark theme preference, your analytics choice, and a for-this-visit note of whether your region requires the consent banner.
The web fonts are served from this site, not from a font CDN. Whether Google learns of your visit is decided by the Google Analytics rules above and by nothing else on the page. Besides the analytics described in this section, the only third-party code on the site is the Turnstile widget described in section 4, and that appears on the contact page alone.
6. Why we are allowed to hold this
Metering records exist because we cannot operate a metered subscription service without them: they are necessary to perform our contract with you and to protect the service against abuse. Billing data is processed to meet our legal and tax obligations. Google Analytics is the one optional thing on this page. In the EU, EEA, UK and Switzerland it runs on your consent and not before; elsewhere we rely on our legitimate interest in understanding how the site is used, and section 5 has the switch to turn it off. Everything else here happens without consent because none of it is optional: we could not run the service without it.
7. How long we keep it
A job runs once a day and enforces this automatically. It is not a policy we intend to follow, it is one the software applies whether anyone remembers it or not.
| What | Kept for | Then |
|---|---|---|
| Individual request records | 90 days | Collapsed into a per-day total for your key and deleted. After 90 days no record of any individual request exists. |
| Daily totals (request counts and bytes, per key per day) | 2 years | Deleted. Kept this long only to understand capacity and to work out fair usage-based pricing. |
| Your key and subscription status | While the subscription exists | The key is deactivated when the subscription ends. |
| Emails and contact form messages | As long as the correspondence is useful | They live in a mailbox, not in the service. |
| Billing and invoices | As long as tax law requires | Held by Lemon Squeezy as merchant of record, not by us. |
Ask us before you cancel if you would like a copy of your own usage history.
8. Who else touches it
- Lemon Squeezy, as merchant of record, for payments and subscription management.
- netcup GmbH, our hosting provider, whose server in Vienna, Austria runs the API. The service and its database therefore sit inside the EU.
- Cloudflare, which provides DNS, serves this website, delivers contact form messages to our inbox, runs the Turnstile anti-spam check on the contact page, and provides the cookieless page analytics described in section 5.
- Our backup storage, Cloudflare R2, which holds an encrypted-in-transit copy of the subscription and metering database so a server failure does not lose your account.
- Google, twice over:
hello@overspan.devis forwarded to a Gmail mailbox, so anything you email us, or send through the contact form, is delivered there and read there. And when Google Analytics runs, under the rules in section 5, Google processes that visitor data for us.
We do not sell data, and we do not share it with anyone else except where the law requires it.
Where your data actually goes
- The service itself runs in the EU. The API, its database and the metering records all live on the Vienna server, so using Overspan does not move your usage data out of Europe.
- We are based in New Zealand, which the European Commission recognises as providing an adequate level of data protection. Personal data may therefore move between the EEA and New Zealand without additional safeguards being required.
- Some providers are United States companies, specifically Lemon Squeezy, Cloudflare and Google, so data handled by them may be processed in the United States.
9. Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Mail hello@overspan.dev and we will respond within 20 working days.
Because there is no account system, we may need to verify that you control the email address on the subscription before acting on a request.
If you are unhappy with our response, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz). If you are in the EU or the UK, you may also complain to your local data protection authority.
10. Changes
If this policy changes materially we will email subscribers before it takes effect and update the version and date at the top of this page.