Privacy Policy
Effective Date: [Last Updated: October 17, 2026]
This Privacy Policy explains how Hauke Jung ("we," "us," or "our") processes personal information in connection with Overhear (the "Service"), available at https://overhear.dev.
Overhear listens for your product on public platforms. You tell it which keywords to track; it searches X, Reddit, LinkedIn, YouTube and the web for public posts that contain them, sorts each post by what it needs from you, and alerts you to the ones that matter. That means we process two kinds of personal data: yours, as a customer, and that of the people who wrote the public posts we find (Section 3).
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German law.
1. Controller
Hauke Jung, Hauptstr. 41, 79199 Kirchzarten, Germany — mail@haukejung.de.
2. Information We Collect About Customers
a. Account data
Your email address, username, an optional profile picture link, and what is needed to sign you in (such as passkeys and one-time codes sent by email). If you work in an organization, its name, its members and pending invitations.
b. Projects
For each product you track: its name, domain and description, your keywords (including competitors you chose to track), the authors and sites you told us to ignore, custom categories you defined, your webhook address and its signing secret, and whether email alerts are on.
When you add a product by its domain, we fetch that site's homepage once to suggest a name, description and keywords.
c. Mentions
The public posts found for your keywords (see Section 3), what our classification made of them (type, sentiment, urgency and whether a post is about your product at all), and what you did with them: saved as a testimonial, marked as unrelated, or the author muted.
d. Keys and usage
- API keys — name, a short lookup prefix, an Argon2 hash and when it was last used. Never the key itself.
- Scan log — each search we ran for your keywords: when, which source, which keyword, what it cost and how many posts it returned. It powers the Usage tab.
e. Technical data
- Your IP address, for rate limiting and abuse prevention
- Device and browser information in ordinary HTTP request headers, and short-lived server logs
- A session record per signed-in browser (see Section 8)
We run no advertising, no analytics and no tracking scripts, and do no profiling of customers.
f. Feedback and votes
Every page loads a feedback widget from SeggWat, a service we operate (see Section 5). If you send feedback through it, we receive your message, the page you were on, any screenshot you attach, your email address if you give it, and — when you are signed in — your account ID and email. Votes on the roadmap are stored with your account ID.
3. People Who Wrote the Posts We Find
This section is for you if you posted publicly about a product someone tracks with Overhear (Art. 14 GDPR).
- What we process: the post's text and title, its address, when it was posted, its engagement count, and the author's name or handle as the platform shows it publicly.
- Where it comes from: public posts on X, Reddit, LinkedIn, YouTube and the open web, found by searching for the customer's keywords. We do not access private messages, closed groups or anything behind a login.
- Why: so the customer whose product you mentioned can read and answer what you said — fix a bug you hit, answer your question, or thank you.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR) of the customer and of us in knowing what is said publicly about a product. Only posts you chose to publish are processed, and only those containing a tracked keyword.
- Classification: each post is sorted automatically (for example as a question, complaint or buying intent). This sorting has no legal or similarly significant effect on you.
- Retention: a post is kept until the customer deletes the project, mutes you as an author, or we delete it on request.
- Your rights: you may object at any time, and ask for access or erasure, at mail@haukejung.de. Tell us the post or handle and we delete what we hold and stop collecting it.
4. How We Use This Information
- Provide the Service: sign-in, scanning for your keywords, classifying posts, showing your feed, sending your alerts and webhooks
- Keep the Service secure: rate limits, abuse prevention
- Communicate with you about sign-in, alerts you turned on, support, security and changes to the Service
- Comply with legal obligations
We do not sell personal data and do not use it to train any model.
Legal bases for customer data: performance of a contract (Art. 6(1)(b) GDPR) for your account and the features you use; our legitimate interest (Art. 6(1)(f) GDPR) in keeping the Service secure and available, for logs and rate limiting.
5. Processors and Recipients
| Recipient | What | Why |
|---|---|---|
| Anthropic (USA) | The text of found posts, your project's name and description, and your custom categories; when you add a product, its homepage text | Classifying posts and suggesting project settings. Anthropic does not use API data to train its models. |
| treg.to (operated by us) and the data providers it uses | Your keywords as search terms, and the domain you add | Searching public platforms and fetching homepages. The providers receive search terms, not your account data. |
| SeggWat (operated by us) | Feedback you send through the widget and roadmap votes, as described in Section 2f; your IP address when the widget loads | Collecting feedback, feature requests and votes, and publishing the changelog. If spam protection is on, the widget may run a verification check before sending. |
| Hosting provider (servers in the EU) | All data stored by the Service | Infrastructure |
| Email (SMTP) provider | Recipients' email addresses and the message | Sign-in codes, invitations and email alerts |
Processors act on our behalf under data processing agreements.
What you send on yourself: if you set a webhook, every new related mention is sent to that address. AI assistants you connect over MCP with an API key can read your projects and mentions; if an assistant is backed by a hosted model, it passes that content to its provider under that provider's terms. These transfers are initiated by you, and you can remove the webhook or revoke the key at any time.
We may also disclose data if required by law or a competent authority, or in a merger, acquisition or asset sale.
6. International Data Transfers
The Service's data is stored on servers in the European Union. Anthropic processes data in the USA; we rely on the EU–US Data Privacy Framework where the provider is certified and on Standard Contractual Clauses (SCCs) otherwise. Data providers used by treg.to may be located outside the EU under the same safeguards.
7. Data Security
- HTTPS for all data in transit
- API keys stored only as Argon2 hashes
- Webhooks signed so the receiver can verify they came from us, and sent only to public HTTPS addresses
- Rate limiting and security headers
No system is 100% secure; we cannot guarantee absolute security.
8. Cookies and Local Storage
We use a strictly necessary session cookie that keeps you signed in, expiring after 7 days of inactivity, and a language cookie only if you pick a language yourself. Your light/dark theme preference is kept in your browser's local storage and never sent to us. The feedback widget keeps your email address and unsent drafts in local storage so you don't have to type them again. There are no tracking cookies, which is why there is no cookie banner. See our Cookie Policy.
9. Data Retention
- Projects and their mentions are kept until you delete the project (Settings → Delete project), which removes its keywords, mentions, testimonials and scan log immediately.
- Account data is kept for as long as your account exists. To delete your account, email mail@haukejung.de; we delete it with all its projects.
- Sessions expire after 7 days of inactivity.
- Server logs and rate-limit counters are short-lived.
Mentions already sent to your webhook or read by a connected assistant stay there; they are governed by those systems.
10. Your Rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. To exercise them, contact mail@haukejung.de.
You also have the right to lodge a complaint with a data protection authority, such as the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI).
Our Service does not respond to "Do Not Track" signals; there is no tracking for such a signal to switch off.
11. Children's Privacy
The Service is not intended for children under 16. We do not knowingly collect their data as customers. If you believe a child has provided us with personal data, contact us so we can delete it.
12. Changes to This Privacy Policy
We may update this policy from time to time. Material changes will be announced by email or a prominent notice on the website.
13. Contact
Data Controller: Hauke Jung Hauptstr. 41 79199 Kirchzarten, Germany Email: mail@haukejung.de
© 2026 Hauke Jung. All rights reserved.