Privacy Policy

Account details (name, email, phone), listing content (photos, descriptions, locations, drawn property boundaries), booking records, messages between guests and hosts, reviews, favorites, community (Campfire) posts, listing view counts (aggregate, shown to hosts as analytics). Identity documents are never stored by Overlnd — see Identity verification below.

Like most websites, we automatically receive some technical data when you use Overlnd: IP address, browser and device information, and timestamps of requests. We use this for security, rate limiting, and fraud prevention. If you enable notifications in the mobile app, we store a push token for your device so we can deliver them.

We use essential cookies only — session cookies that keep you signed in and make the site function. We do not use third-party advertising or cross-site tracking cookies, and we don't run third-party ad networks.

Hosts are verified through Stripe when they set up their payout account: Stripe collects and checks identity and banking details under Stripe's own privacy policy. Overlnd receives only the outcome (verified or not) and never sees or stores identity documents.

Card details go directly to Stripe — Overlnd never sees or stores full card numbers. Direct payments between guests and hosts (cash, Zelle, Venmo, Cash App, PayPal) happen entirely outside our systems.

Exact addresses and property boundaries are revealed to guests only after a confirmed booking. Public listing pages show an approximate area when the host enables location privacy.

To operate the marketplace: showing listings, processing bookings, sending transactional notifications (booking requests, messages, receipts), fraud prevention, and legal compliance. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising.

We share data with the vendors that run the platform: Supabase (hosting and database), Vercel (web hosting), Stripe (payments, payouts and the identity checks Stripe performs when a host opens a payout account), Mapbox, Google and OpenStreetMap (maps and geocoding), Resend (email), Expo together with Apple Push Notification service and Google Firebase Cloud Messaging (mobile push notifications), and a scraping service used only to import a listing a host asks us to import from Airbnb or Vrbo. If you sign in with Google or Apple, that provider shares your name and email with us under its own privacy policy. Each processes data only to provide its service to us.

Some content on Overlnd can include information about non-users. Reviews imported by hosts from other platforms (e.g. Airbnb, Vrbo) include the reviewer's first name and profile photo as published on the source platform, and messages may mention other people. If you appear in imported content and want it removed, contact privacy@overlnd.com and we'll take reasonable steps to remove it.

We keep your data while your account is active. When you delete your account, profile details, photos, saved listings and notifications are removed at once; database backups roll off within 30 days. Bookings, payment records and tax-relevant data are kept for 7 years as required by law, with your name and contact details removed; messages and reviews already shared with another member stay visible to them without your name. Listings you created are removed from search immediately. Server logs are kept for 30 days.

Data is encrypted in transit (TLS) and at rest by our hosting providers, and access is limited by row-level security and role-based controls. Overlnd never stores identity documents — Stripe holds them under its own policy. No system is perfectly secure — if we learn of a breach affecting your data we'll notify you as required by law.

You can update your profile, delete listings, and request account deletion at any time. Booking and payment records may be retained as required for legal and tax purposes. The messages we send today are transactional (bookings, messages, receipts). If we ever send marketing email, it will include an unsubscribe link and honoring it won't affect transactional messages. Push notifications can be turned off in your device settings.

California residents may request access to, correction of, or deletion of their personal information, and to know what categories we collect (listed above) and why. We don't sell personal information, so there is nothing to opt out of selling. To exercise these rights, email privacy@overlnd.com — we'll verify your identity and respond within the time required by law, and we won't discriminate against you for exercising them. Our site does not respond to browser "Do Not Track" signals, because we don't track users across third-party sites in the first place.

Overlnd is not directed to children and is only for users 18 and older. We do not knowingly collect personal information from anyone under 18 — if you believe a minor has provided us data, contact privacy@overlnd.com and we'll delete it.

Overlnd operates in the United States and data is stored and processed on servers in the United States.

We'll post updates here with a new "last updated" date, and for material changes we'll give notice by email or in the product. Questions: privacy@overlnd.com.