Privacy policy
Updated 21 September 2026
Who is responsible
Overflown is a project of Moulton Barn Holdings (MBH), the controller of the data described here. This site is a validation tool: it collects the minimum needed to work.
Your map and your flights
We store the flights you enter (airports, date, flight number) and the name you choose to show. There are no accounts or passwords: the map is identified by a private link only you have, and it is private until you press Share. From the text you paste we keep only the extracted flights, not the original email or document. If our reader cannot understand the text, we send it to Anthropic to extract the flights; we do not keep it afterwards. Do not paste data you would not want to go through that process.
Email to send you your link
If you give us an email to receive your private link, we store it with your map and use it only for that, when you ask. We do not add it to any list or use it for news or advertising. It is deleted when the map is deleted.
Email to tell you about the app
This is a separate consent and a separate list. If you tick the box, we store your email and chosen platform to send you one notice when the app is available. It is never filled from the email in the previous section, nor the other way round. You can ask us to delete it at any time.
Poster orders
If you order a poster, Stripe handles the payment: we never see or store your card details. From Stripe we receive your email, your name and the shipping address, and we use them for that order only: to confirm it, print it and ship it. Printing and shipping are done by Gelato, which receives the poster file and the address. We keep the order and its print file even if you delete the map, because it has to be delivered and for accounting duties; we do not use that email to tell you about launches.
Email to tell you when poster orders open
If you ask us to tell you when poster orders open, we store your email, the format you chose and the date you agreed. It is a consent separate from the other two: we use it for one email when orders open, and you can unsubscribe at any time by writing to privacy@overflown.app.
Measurement
We count anonymously which steps are completed (visit, map created, shared, link opened) to decide whether to build the app. We use one first-party session cookie, with no third-party cookies and no advertising. We do not store your IP address: only an irreversible digest that changes daily. Events never contain your email.
Who else is involved
Hosting on Vercel and database on Supabase, in the United States. Measurement on PostHog, in the European Union. Email through Resend. To complete a flight's data we send its number and date, never your personal data, to AeroDataBox or FlightAware. Text extraction, when needed, is done by Anthropic.
Delete means delete
The “Delete the map” button removes the map, its flights and the recovery email, with no copies. A shared map stops being visible at once; its image may take up to an hour to leave the cache. Anonymous measurement figures are kept with no link to the map.
Children
This site is intended for adults and we do not collect data about children.
Contact and your rights
To access, correct or delete your data, or to object to its use, write to privacy@overflown.app.