Privacy Policy

This Privacy Policy explains how elepea (“elepea”, “we”, “us”), a company organised under the laws of the Republic of Colombia, handles information in connection with the OverlayCam macOS app (the “App”) and the website at overlaycam.app (the “Site”).

It sits alongside our Terms of Use. Where this policy speaks about the App, it covers both the OverlayCam application and the camera system extension it installs.

No personal data. The App creates no account, never asks who you are, assigns no advertising ID, and contains no analytics, crash reporting or advertising SDK.

Once a day, and whenever you ask it to from the OverlayCam menu, the App fetches a small file from this Site listing the latest version. The request carries nothing that identifies you or your Mac: no identifier, no serial number, no system profile, no account. Like any web request it reaches our server with your IP address, which Cloudflare handles as an ordinary request log and which we neither store nor use. You can turn the daily check off in Settings, and nothing is ever downloaded or installed without you choosing it in the dialogue that appears.

There is one exception, and it is yours to switch on. Setting OverlayCam up means approving a macOS system extension and sometimes restarting, and we cannot see how often that goes wrong. If you tick “Help make setup less painful” — in the welcome screen or later in Settings, off until you do — the App reports how far the setup got: that it launched, that the camera became available, that you turned it on, or that it stopped at the approval, at a restart, or at a refused camera.

Each of those is sent at most once, so the numbers count installations rather than launches. Alongside it go the App version, your macOS version, and whether your Mac is Apple silicon or Intel, which is what lets us tell “this fails only on macOS 26” from “this fails for everyone”. And a random identifier the App invents for that installation, so six reports from one Mac are not read as six people.

That identifier is generated on your machine, is not derived from your hardware, your account or your address, and is deleted the moment you switch the setting off — after which turning it back on produces a new one that cannot be joined to the old. Nothing else is included: not your video, not your logo, not your name, title or company, not your preset names, not which camera you use, not any file.

We use it for one thing: to see where setup fails so it can be fixed. It is not sold, not shared, not combined with the website analytics below, and not used for advertising.

macOS asks for your permission before the App can use a camera, and you can withdraw that permission at any time in System Settings › Privacy & Security › Camera.

When the App is running it reads frames from the webcam you select, draws your overlay on top of them, and publishes the result as a camera device that other applications on your Mac can select. All of that happens on your Mac, in memory, on the fly.

If you turn background blur on, your Mac uses Apple’s on-device Vision framework to work out which pixels are you and which are the room, and softens only the room. That analysis runs on your machine, frame by frame, and its result is discarded with the frame.

The App does not record, save, buffer to disk, or transmit your video or audio. elepea never sees the contents of your calls and has no technical means of doing so.

Once you select OverlayCam inside a video conferencing application, that application receives the branded picture exactly as it would receive a picture from any physical webcam, and its own privacy policy governs what it does with it.

Your brand presets — names, titles, companies, colours, layout settings and the logo image you chose — are saved to a file in your own user folder, at ~/Library/Application Support/OverlayCam/presets.json. The App and its camera extension share that data through a private app group so the extension can draw what you configured.

This file lives on your Mac. It is not uploaded anywhere. It may be included in your own backups, such as Time Machine or iCloud backups, if you have configured those; that is under your control, not ours.

Deleting the App and that folder removes everything the App has stored. Exporting a preset to share it with a colleague is an action you take deliberately, and the file goes wherever you send it.

The Site loads Google Tag Manager and, through it, Google Analytics, so that we can tell which campaigns bring people here. These set cookies in your browser and send Google your IP address, the pages you view and an identifier for your browser. They stay switched off until you accept them on the banner, your choice is remembered, and declining is final — we do not ask again. Google’s handling of that data is governed by Google’s own privacy policy.

Separately, and whether or not you accept that banner, we count downloads on our own server. A download records which campaign or link sent you, and the country Cloudflare reports for the request. It sets no cookie and needs nothing in your browser to work.

So that ten downloads by one person are not reported as ten people, that record also carries a short code standing in for the visitor. The code is what comes out of hashing your IP address and browser user agent together with a secret and the current date; the address itself is never written down. Because the date is part of it, the code changes every day and cannot be followed from one day to the next — including by us. It is used for counting and nothing else: it identifies no one, is never matched against anything, and is not combined with the website analytics above.

If you arrive from a campaign link, the utm_ parameters it carries are kept in your browser’s sessionStorage for that tab, so a download you start after reading the page is still credited to the campaign that brought you. It is discarded when you close the tab, and it leaves your browser only as part of the download address.

We also watch the site in real time. When someone browses a page, our server sends a notification to a private Telegram channel that only we can read. It describes the visit: the page, where you came from — a search engine, a link, an advertising campaign — your IP address, the approximate location and postal code that address resolves to, the company or internet provider that owns it, your device, browser and screen size, your language and time zone, and roughly how long you stayed, how far you scrolled and how many times you clicked.

Your browser also keeps a count of your visits and the date of the last one in localStorage, so that we are notified at most once every twelve hours rather than once per page you read. Nothing is sent at all until you move, scroll, click or type, which is how automated crawlers are kept out of it.

We do this because we are a small company and we like knowing when someone is looking at what we built. Nobody is scored and nothing is decided about you by it, and the notification is not matched against the download count or against Google Analytics. Messages stay in that channel until we delete them, and we will delete the ones that concern you if you ask.

The Site is served through Cloudflare, which processes standard request information such as your IP address, the time of the request, the page requested and your browser’s user agent in order to deliver the page and protect against abuse. Cloudflare’s own logs of that are short-lived and operational; the notification described above is the one place where we ourselves look at any of it.

The Site loads the Archivo typeface from Google Fonts. That request goes to a Google server and, like any web request, discloses your IP address to Google. Google’s handling of it is governed by Google’s own privacy policy.

The Site has one form that asks for an email address, so that we can write to you when OverlayCam does something you said you were waiting for. Filling it in is entirely up to you: nothing on the Site requires it, and the App never asks for it.

We store the address you typed, the date, which page the form was on, and the optional sentence you may have written about what you want the app to do. That is all. We do not store your IP address with it, set any cookie for it, or buy or append anything to it from elsewhere.

We use it to write to you about OverlayCam: new versions, and the thing you asked about. We do not sell it, rent it, share it, or hand it to an advertising network. If we later use an email delivery provider to send those messages, that provider will process your address on our instructions and for no other purpose, and this page will name it.

Our lawful basis is your consent, which you give by submitting the form. You can withdraw it at any time by replying to any message we send or writing to the address below, and we will delete your entry. We keep addresses until you ask us to remove yours, or until it becomes clear the list is not being used, whichever comes first.

Because an email address is personal data, the rights described below apply to it in full — including the right to ask what we hold, to correct it, and to have it deleted.

The App is a professional tool and is not directed at children. The setup report described above is off unless switched on, contains no personal data, and is not directed at or designed to identify anyone, children included.

Colombian law (Law 1581 of 2012 and its implementing decrees) and regimes such as the GDPR give you rights to access, correct, delete and port your personal data, and to object to its processing.

If you gave us your email address through the form on the Site, that is personal data we hold, and these rights apply to it in full: write to us and we will tell you what the entry contains, correct it, or delete it.

The visit notifications described above are the other place your data appears: they sit in a private channel and carry your IP address and the location it resolves to. Write to us and we will find the ones that concern you and delete them, and stop sending them for your address if you would rather we did not.

Beyond those two, there is nothing tied to you. There is no account. The setup report, if you switched it on in the App, carries a random per-installation identifier that is not linked to you, your device or your address, and switching the setting off deletes it on your machine. Everything else the App creates is in your own user folder and entirely under your control.

If you nonetheless want to exercise a right or ask a question about this policy, write to us and we will answer within the periods the applicable law sets.

If a future version of the App gains a feature that does touch the network — optional licensing or sync, for example — we will update this page before that version ships, change the date below, and keep any such feature something you opt into rather than something turned on for you.

The date at the top of this page always marks the current version.

Write to overlaycam@elepea.co with any question about privacy or this policy. elepea, Colombia.