Privacy Policy
1. Who we are
OVEAL Ltd (“Oveal”, “we”, “us”) is the data controller for the personal data described in this policy. We are registered in England & Wales under company number 17348447, registered office 2nd Floor, College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom.
- Privacy contact: privacy@oveal.com
- Data Protection Officer: not appointed. Privacy queries go to the address above.
This policy applies to the Oveal mobile and web app. It should be read together with our Terms of Service.
2. A quick summary
Oveal lets you send a wrapped photo of a gift to someone, who opens it while their front camera records their reaction (with sound) to send back to you. To do that we handle your email address, your name, the photos and messages you send, and the reaction videos recorded through the app.
- We host your data in the EU. Some service providers (email delivery, push notifications, image safety-scanning) process data outside the EU/UK — see section 8.
- Reaction videos are automatically deleted 30 days after they are recorded.
- We do not run advertising, we do not sell your data, and we do not access your device’s contacts.
3. The personal data we process, and why
| Data | Where it comes from | Why we process it | Lawful basis |
|---|---|---|---|
| Email address | You, at sign-up | Create and secure your account; send you a one-time sign-in code; deliver oveal notifications | Contract (Art. 6(1)(b)); security = legitimate interests (Art. 6(1)(f)) |
| Your name | You | Show the sender/recipient who an oveal is from or to; personalise notifications | Contract |
| Age confirmation | You, at sign-up | Enforce our 16+ minimum age | Legal obligation / legitimate interests |
| Consent record | You | Evidence of your agreement and marketing preference | Legitimate interests; marketing = consent |
| Gift photos | You (sender) | Deliver the oveal; automatically screen for unsafe imagery | Contract; safety screening = legitimate interests |
| Card messages, replies | You | Deliver your message to the other party | Contract |
| Recipient email + name | You (sender) | Deliver the oveal to that person and, if they don’t yet have an account, email them an invitation to open it | Contract with you; delivering to a non-user = legitimate interests |
| Reaction videos (face and voice) | You (recipient), via the front camera when you unwrap | Send your reaction to the person who sent you the oveal | Consent |
| Scratch gestures | You (recipient) | Replay the unwrap animation | Contract |
| Device push tokens | Your device, after you allow notifications | Send you push notifications | Consent (device permission) / contract |
| Block list; abuse reports | You | Let you block people and report content; keep the service safe | Legitimate interests; safety / legal obligation |
| IP address; sign-in records | Your device, at sign-in | Prevent abuse of the sign-in system, and of the launch-list form, by rate-limiting requests | Legitimate interests (security) |
| Launch-list email address | You, if you enter it on oveal.com | Send you one email when Oveal launches. Nothing else | Consent |
The launch list. If you give us your address on our website to be told when we launch, we store only that address, the date, and which wording you agreed to. We do not store your IP address or browser details against it. You can ask us to remove you at any time by emailing privacy@oveal.com — you don’t need an account, and we delete the whole record. If you later create an account, the two are kept separate.
We do not collect your device contacts, location, health data, advertising identifiers, or biometric identifiers derived for identification.
4. Reaction videos — special care
Reaction videos record a person’s face and voice. Because of their sensitivity:
- We ask for camera and microphone permission at the moment you unwrap, and you choose whether to proceed. Proceeding is how you consent to being recorded and to the video being sent to the sender.
- The video is delivered to the sender of that oveal and is automatically deleted 30 days after recording. The oveal record (who sent what, and when) remains in each party’s history after the video is gone.
- You can change your mind. You can delete your own reaction at any time before then — open the oveal and choose “Delete my reaction”. Your video and the replay of how you scratched are erased from our systems and the sender can no longer play them. The gift they sent you stays in your oveals. You don’t have to delete your account to do this.
- We do not analyse, transcribe, profile, or use reaction videos to train any model, and we do not screen them automatically.
- You must only record yourself. Please don’t record other identifiable people without their consent.
5. Children
The app is for users 16 and over and is not directed to children under 16. Age is self-declared at sign-up. If we learn we hold data about someone under 16 without the appropriate basis, we will delete it.
6. Who your data is shared with
- Other users: the person you send an oveal to receives your gift photo, card message, and name; when they react, you receive their reaction video, name, and any reply. That is the purpose of the app.
- Google Firebase — hosting, database, file storage, authentication and push routing (EU).
- Twilio SendGrid — email delivery (United States).
- Apple (APNs) / Google (FCM) — push notifications.
- Google Cloud Vision — automated safety-scanning of gift photos.
We do not sell your personal data or share it with advertisers or data brokers.
7. Automated processing
We use automated screening of gift photos to detect unsafe imagery, which may block an upload. We do not carry out profiling, advertising, or automated decision-making producing legal or similarly significant effects on you, other than that content-safety screening.
8. International transfers
Your data is stored in the EU. Some processors handle data outside the UK/EU — SendGrid (email, United States), Apple APNs and Google FCM (push), and Google Cloud Vision (gift-photo scanning). Where data leaves the UK/EU it is protected by an appropriate transfer mechanism, namely the Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in our processors’ data-processing terms.
9. How long we keep it
| Data | Retention |
|---|---|
| Reaction videos | 30 days from recording, then deleted — or sooner if the person recorded deletes it, or the sender deletes the oveal |
| Account data (email, name, settings, consent, block list) | Until you delete your account |
| Oveal records (who/what/when, card message, reply) | Until deleted by the sender, or your account is deleted |
| Gift photos | Until the oveal is deleted |
| Sign-in codes | 10 minutes |
| Launch-list email address | Until we launch and send that one email, or until you ask to be removed — whichever comes first |
| Sign-in and rate-limiting records (including IP address) | Retained; we are introducing an automatic deletion schedule |
| Notification emails held in our sending queue | Retained; we are introducing an automatic deletion schedule |
10. Your rights
Under UK and EU data-protection law you have the right to access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent at any time (this doesn’t affect processing before withdrawal).
How to exercise them in the app today:
- Access and portability: Settings → “Request a copy of my data”.
- Erasure: Settings → “Delete my account”, which erases your profile, the oveals you sent and their media, and the reaction videos you recorded. You can also delete things individually without closing your account: a reaction you recorded (“Delete my reaction”), or, if you sent an oveal, the whole oveal including its gift photo and the reaction.
- Withdrawing consent to being recorded: deleting your reaction, as above, is the in-app route.
- Or contact us at privacy@oveal.com.
You can also complain to a supervisory authority. In the UK that is the Information Commissioner’s Office (ICO), ico.org.uk.
11. Security
We take steps to protect your data, including hosting in the EU; encryption in transit and at rest; one-time-code sign-in with no stored passwords (sign-in codes are stored only as a hashed value, never in plain text); rate-limiting to prevent abuse; database access rules that restrict each oveal and account to the people involved; and media files (gift photos and reaction videos) that can be read only by the sender and recipient of that oveal, through short-lived signed links issued after a server-side permission check — they cannot be read directly.
Media uploads are attributed to their owner: a file can only be created under the uploader’s own identity and cannot be overwritten by another user, and the server verifies that a reaction was recorded by that oveal’s recipient.
No service is perfectly secure, and we cannot guarantee absolute security.
12. Cookies and local storage
The Oveal website does not use advertising or analytics cookies or tracking pixels. To keep you signed in, the app stores authentication data locally on your device (in browser storage on the web) — this is strictly necessary to provide the service.
13. Changes to this policy
We may update this policy; the version and date are at the top. If changes are material, we’ll take reasonable steps to tell you in-app.
14. Contact
Privacy questions or requests: privacy@oveal.com.
Postal: OVEAL Ltd, 2nd Floor, College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom.