Privacy Policy

This Privacy Policy describes how CrunchFocus LLC ("we," "us," or "our") collects, uses, shares, and protects your information when you use the OverMox application, our realtime 3D effects and overlay engine for content creators, your OverMox account, or overmox.com (together, the "Service").

For how the Service uses information from your Google account when you sign in with Google, see Google user data. For details about browsing this website, see website services and cookies and browser storage below.

1. Information We Collect

Information You Provide to Us

• Account Information: To create an OverMox account you sign in through Kinde, our sign-in provider, either with your email address and a password or with your Google account. We receive your email address and, if you sign in with Google, the profile information described in Google user data. If you use a password, Kinde stores it in protected (hashed) form; we never see it.
• Subscription and Payment Information: OverMox subscriptions are sold through Link, a service of Stripe, which acts as the merchant of record (see payments below). Link collects your payment details, billing address, and any tax identification number at checkout. Link shares order information with us, such as your name, email address, billing address, limited payment information (for example card brand and last four digits), and order details. We never receive or store your full card number.
• Communications: Our contact form collects your name, email address, subject, and message. If you contact us through the form, Discord, or other support channels, we may retain those communications for customer service purposes.
• Email Updates: If you sign up for product updates, we collect your email address to send the updates you request. Our contact and signup forms use Web3Forms to process submissions.

Information Created When You Use Your Account

• Account and Subscription Records: Our servers keep a record for your account: an internal account ID, your Kinde user ID, your Stripe customer ID, the status and dates of your subscription and any free trial, the amounts and status of your payments, refunds, and disputes, and copies of the billing notifications Stripe sends us about your subscription. Those notifications can include the order information Link shares with us, described above.
• One-Trial Check: To apply our one free trial per person rule, we store a keyed cryptographic hash of your email address (not the address itself), and a card fingerprint, a code from Stripe that identifies a payment card without revealing its number, or, if you pay with Cash App Pay, your Cash App buyer ID, an identifier that Cash App assigns to each of its customers and Stripe passes to us.
• Complimentary Access: If we give you complimentary access, we add your email address and an end date to a private list. Your account receives that access only when you sign in with that email address by a method that verifies it.
• Access Checks: The OverMox application regularly asks our servers whether your account has access. Each check sends your sign-in token and a random identifier that the application creates for its installation, and returns a signed access record that works only for that installation.

Information Collected Automatically

• Server Logs: Our servers record technical logs (requests, errors, and timing) in Microsoft Azure Application Insights to operate, secure, and troubleshoot the Service. These logs refer to your account by an internal identifier, not by your email address or name. Application Insights may derive an approximate location from your IP address but does not keep the address. Our servers also use your IP address briefly to limit request rates and protect the Service from abuse.
• Error Reports: The OverMox application can send error reports to help us fix problems. This is off unless you turn on Help improve OverMox (optional error reports) in the app's settings, and the choice is saved on your computer for each account. When it is on and the app is online, each error sends a report to Microsoft Azure Application Insights. A report contains the error message and where in the app it happened, the last few lines of the app's log, the name of the open scene, the app version, your operating system, computer model, graphics hardware, memory and screen size, and a random ID that changes each time the app starts. Before sending, the app removes your email address, name, account ID, and your computer's user name and computer name. Reports do not include your IP address or your location. The application does not send usage analytics.
• Authentication Tokens: The OverMox application stores your sign-in tokens and access record locally on your device, protected by Windows, to keep you signed in.
• Website Requests and Security: Our website providers receive technical information such as your IP address, browser information, and requested URLs to deliver the site and protect it from abuse. hCaptcha also analyzes browser interactions on the contact page to distinguish people from bots. The OverMox application also connects to servers in the same way: it downloads help content from overmox.com, checks dl.overmox.com for updates each time it starts and downloads an update from there only when you choose to, checks GitHub for MoxRelay releases and downloads them from there if you use MoxRelay, and, when you import an ambientCG material, HDRI, or skybox from the Asset Catalog, downloads it from ambientCG. These requests carry your IP address and standard request information but no account information.
• Website Analytics: We use Cloudflare Web Analytics to understand website traffic and performance, including page visits, referring URLs, browser and device characteristics, and page load timings. This analytics service does not use cookies or browser storage. See the website services section below.

2. Google User Data

You can sign in to OverMox with your Google account. Sign-in runs through Kinde, which uses OverMox's Google sign-in client and requests only Google's basic profile and email permissions (the userinfo.email and userinfo.profile scopes). OverMox does not request access to your Gmail, Google Drive, contacts, calendar, YouTube account, or any other Google data.

• What we access: Google provides your Google account identifier, email address, whether Google has verified that address, your name, and a link to your profile picture. Kinde keeps these as your sign-in identity and passes us your email address, name, and profile picture link.
• How we use it: We use your email address to identify your OverMox account, to check whether it has complimentary access, to apply the one free trial per person rule, and, when you subscribe, to create your customer record at Stripe. The application shows your name and email address in its account screens. We do not use your profile picture.
• How we store it: Kinde stores your Google identity in the United States. Our servers, hosted on Microsoft Azure in the United States, store your account ID and Kinde user ID, a keyed hash of your email address, and, only if you have complimentary access, your email address. If you subscribe, the billing notifications from Stripe that we keep also contain your email address. Our servers do not store the name or profile picture that Google provides. The application keeps your sign-in tokens on your device.
• How we share it: We share Google user data only with the service providers that run the Service for us (Kinde, Postmark, and Microsoft Azure), with Stripe and Link when you subscribe, and when the law requires it, as described in Section 4. We do not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence or machine learning models. People at CrunchFocus LLC see it only when needed to support your account, for security, or to comply with the law.
• Your control: You can remove OverMox's access in your Google Account settings and ask us to delete your account as described in Section 7.

OverMox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and secure your account and decide whether it has access
• Start your subscription and free trial and keep your access in step with your payments, cancellations, refunds, and disputes
• Apply the one free trial per person rule and prevent fraud and abuse
• Send you technical notices and support messages
• Deliver website content, respond to enquiries, and protect our forms from spam and abuse
• With your consent, send you marketing communications about OverMox
• With your consent, receive error reports from the application to find and fix problems
• Comply with legal, tax, and accounting obligations

Legal Bases (European Economic Area and United Kingdom)

We process your information to perform our contract with you (your account and subscription), for our legitimate interests in operating, securing, and improving the Service and preventing fraud, with your consent (marketing emails and error reports from the application), and to comply with legal obligations (for example tax and accounting records).

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties, and we do not use it for advertising. We may share your information only in the following circumstances:

• Kinde: Runs sign-in for OverMox accounts at auth.overmox.com, stores your sign-in identity in the United States, and creates sign-in emails such as verification codes and password resets, which Postmark delivers. Kinde processes this information on our behalf. See Kinde's privacy policy.
• Postmark: Postmark, by ActiveCampaign, delivers our account emails, such as sign-in and verification codes and password resets. It receives your email address and the content of each message to deliver it, and processes them in the United States. Postmark processes this information on our behalf. See Postmark's privacy policy.
• Stripe and Link: When you subscribe, we give Stripe your email address and internal account ID so Link can act as merchant of record for your subscription. Stripe and Link use the information they collect for checkout, payments, tax, fraud prevention, and customer support under their own privacy policies (see payments).
• Microsoft Azure: Hosts our servers, account records, server logs, and error reports from the application in the United States.
• Website Providers: The providers described in website services, for hosting, analytics, security, forms, and fonts.
• Legal Requirements: If required by law, court order, or governmental regulation
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Protection of Rights: To protect the rights, property, or safety of CrunchFocus LLC, our users, or the public
• Aggregated Data: We may share anonymized, aggregated data that does not identify you personally

Payments

OverMox subscriptions are sold through Link. Stripe's affiliate Sold through Link, LLC is the merchant of record: it charges your payment method, calculates and collects sales tax, VAT, or GST, sends your receipts and subscription emails, and handles payment and refund support. Link's handling of your order is governed by the Sold Through Link Terms and Link's privacy policy. Stripe's handling of payment data is described in Stripe's privacy policy. Link shares order information with us, and we handle it under this policy.

5. Data Storage and Security

Our servers, account records, server logs, and error reports are stored on Microsoft Azure in the United States, Kinde stores sign-in identities in the United States, and Postmark processes account emails in the United States. Stripe, Link, and our website providers may process information in other countries where they operate, as described in Section 8 and website services. We implement technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We keep your account information for as long as your account exists. When your account is deleted:

• Records of payments, refunds, and disputes are kept for as long as we need them for accounting, tax, and legal purposes
• A keyed one-way hash of your email address, not the address itself, is kept so that a second free trial can be refused
• Stripe and Link keep the payment records they control under their own retention policies
• Server logs and error reports in Application Insights are kept for up to 90 days and then deleted
• Postmark keeps account emails and their delivery records for 45 days, and keeps addresses that bounced or were reported as spam on a suppression list
• Support communications may be retained as needed for business purposes

Website form submissions are also subject to Web3Forms' retention practices. Its privacy policy states a maximum retention period of three years, unless a shorter period applies to the plan or the data is deleted earlier. We receive submissions to respond to enquiries and manage requested email updates. You can unsubscribe from updates or request deletion using the contact options below.

7. Your Rights and Choices

General Rights

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to legal requirements
• Marketing Opt-Out: Unsubscribe from marketing emails using the link in any marketing message
• Error Reports: Turn off Help improve OverMox in the app's settings at any time. Reports already sent are deleted within 90 days.

Deleting Your Account

To delete your OverMox account, please contact us. To confirm that the request is yours, we email a one-time code, with a summary of what will be deleted, to the email address on your OverMox account, never to an address typed into the request, and we delete nothing until you reply quoting that code. We then cancel any active subscription, delete your sign-in identity at Kinde, and delete or de-identify your account records, except the records described in Section 6 that we must keep. After deletion, our trial records keep only a keyed one-way hash of your email address, not the address itself, so that a second free trial can be refused. Deleting your account does not delete the order and payment data that Stripe and Link control; you can ask Link to delete that data, as described in Link's privacy policy.

Region-Specific Rights

European Economic Area and United Kingdom (GDPR and UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have additional rights including:

• Right to data portability
• Right to restriction of processing
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with your supervisory authority

California (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt-out of the "sale" of personal information (we do not sell your information)
• Non-discrimination for exercising your privacy rights

To exercise any of these rights, please contact us.

8. International Data Transfers

By using OverMox, you acknowledge that your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

We rely on appropriate safeguards for international transfers, including standard contractual clauses where required.

9. Age Restrictions

OverMox is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete that information promptly.

10. Third-Party Services

The services below have their own privacy policies, and we encourage you to review them.

Sign-In and Payments

Sign-in runs through Kinde, with account emails delivered by Postmark, and signing in with Google is also subject to Google's privacy policy. Payments run through Stripe and Link as described in payments.

Streaming Services

The OverMox application can receive events from StreamElements and Streamlabs. To connect, you paste an access token from that service into the node that uses it. The token is saved with your node graph on your computer and is sent only to that service. Stream events, such as tips, follows, and chat messages and the viewer names that come with them, travel from those services directly to the application on your computer and do not pass through our servers. See StreamElements' privacy policy and Streamlabs' privacy policy.

Website Services

• Cloudflare hosting and security: Cloudflare delivers overmox.com and helps protect it from abuse. It processes network request information, including IP addresses, for those purposes. See Cloudflare's privacy policy.
• Cloudflare Web Analytics: We use Cloudflare's analytics beacon to measure visits and website performance. It does not use cookies, local storage, session storage, or IndexedDB, and does not fingerprint individual visitors for analytics. Cloudflare states that IP addresses received by this analytics service are discarded at its nearest data center and are not stored in its core analytics databases or logs. See Cloudflare's analytics documentation.
• hCaptcha: Our contact page uses hCaptcha, provided by Intuition Machines, Inc., to prevent spam and automated abuse. Analysis begins when hCaptcha loads on that page, before you submit the form. It may evaluate your IP address, browser and device information, time spent on the page, and interactions such as mouse movements. Its security infrastructure can also set the cookie described below. See hCaptcha's privacy policy.
• Web3Forms: Our contact and email signup forms send submitted fields to Web3Forms for processing and delivery to us. Web3Forms also processes technical information for service operation and spam prevention, and may share submitter IP addresses and email addresses with its anti-spam providers. See Web3Forms' privacy policy for its subprocessors, international processing, and retention practices.
• Google Fonts: We load the Geist font from Google's servers. Your browser sends Google your IP address and the request information needed to deliver the font files. See Google's explanation of font privacy and Google's privacy policy.

11. Cookies and Browser Storage

Cookies are small files that a website or its service providers can store in your browser. We do not use advertising tracking cookies. Our contact page uses security cookies through hCaptcha's bot protection. These help protect the form from automated abuse.

Cookie and provider

__cf_bm
Cloudflare bot protection on hcaptcha.com

Purpose

Helps hCaptcha distinguish legitimate visitors from automated traffic.

Lifetime

Expires after 30 minutes of continuous inactivity.

Which security cookies are set can vary with the checks performed and your browser settings. See Cloudflare's cookie documentation and hCaptcha's privacy policy for provider details. Cloudflare Web Analytics does not use cookies or browser storage.

You can delete or block cookies in your browser settings. Blocking security cookies may prevent the contact form's verification from working. You can also reach us through Discord.

Separately, the OverMox application stores your sign-in tokens and access record locally on your device to keep you signed in. Signing in opens Kinde's sign-in page in your web browser, where Kinde and, if you choose it, Google may set their own cookies for that page.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will publish the revised policy here with an updated date and notify you of material changes by email.

13. Contact Information

For support and privacy questions, please use our contact form.

If you are in the European Economic Area or the United Kingdom, you may also contact your local data protection authority with any complaints.

Company Details

CrunchFocus LLC
971 US Highway 202N, Suite N
Branchburg, NJ 08876
United States

This Privacy Policy is between you and CrunchFocus LLC. Kinde, Postmark, Stripe, and Link have their own privacy policies, linked above.