Privacy
OVRIDER is built so that you hold your own data, keys and costs. This page says plainly what OVRIDER keeps and where your information goes.
Logging in with Google or GitHub
OVRIDER is used logged in: your API keys and settings are kept with your login, so they follow you to any computer, and nothing of yours is kept by the browser alone. When you log in, Google or GitHub tells OVRIDER an account number that identifies you, your name and your email address, and nothing else is asked for. OVRIDER uses these only to recognise you when you come back, and for your login request.
New logins are approved by OVRIDER's administration. Your first login sends a request with your name, email address and which login you used; once it's approved, you're emailed at that address, and from then on you log in as usual. Your email is used for nothing else.
While you're logged in, OVRIDER saves your API keys (AssemblyAI, ElevenLabs, OpenRouter), your voice and model choices and your spend history to its database, encrypted, so only OVRIDER's server can read them, and only to give them back to you. They're never sold, shared or used for advertising. You can delete them at any time from the login menu ("Delete my saved settings").
"Remember login on this computer" is off unless you switch it on. Off, you're logged out when you close the browser (or after a day). Logging out removes your keys and settings from that computer.
OVRIDER's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
Your API keys: yours alone
You can use OVRIDER at no cost. Free, open-source models running on your own computer turn your speech into text, read answers aloud and power Intel, without any API key and without any bill.
The premium services are entirely your choice: AssemblyAI for speech to text, ElevenLabs for voices, OpenRouter for AI, search and the agents' resources. Only if you choose one do you add your own API key for it, and only then is anything billed: to your own account with that service, and to no one else. OVRIDER has no shared API keys, AssemblyAI included. Your key is unique to you and used only for you: nobody else's use goes through it, and yours never goes through anyone else's.
Neuron's storage (Google Drive or Dropbox)
If you connect Google Drive or Dropbox in the Neuron menu, Neuron keeps its memory in your own storage, not with OVRIDER. OVRIDER can only use its own folder there (on Google Drive, only the files it creates itself; on Dropbox, its app folder, Apps/OVRIDER) and nothing else in your account. The permission you give is kept with your OVRIDER account, encrypted, so the connection works on any computer you log in on. Disconnect in the Neuron menu, or remove OVRIDER's access in your Google or Dropbox account, at any time; what's in the folder stays yours.
YouTube
OVRIDER uses YouTube API Services. By using its YouTube features you agree to be bound by the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy.
Searching YouTube and playing videos in OVRIDER uses your own YouTube Data API key, and YouTube's own player. OVRIDER doesn't ask for access to your YouTube account, and can't see, post, comment, like, subscribe, upload or change anything in it. If you connected your YouTube account to OVRIDER before October 2026, that connection has been removed and its permission withdrawn at Google; you can check in your Google account's third-party connections.
OVRIDER's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
How your data is protected
Sensitive data is everything OVRIDER keeps for you that could be misused: your API keys, the permissions you give it to your Google Drive and Dropbox, your settings, and your calls' logs. It is protected as follows.
- Encrypted in transit. Everything between your browser, OVRIDER's servers, its database and Google's APIs travels only over HTTPS (TLS). Nothing is sent unencrypted.
- Encrypted at rest. Your API keys, settings, call logs and the permissions (OAuth tokens) from Google and Dropbox are encrypted with AES-256-GCM on OVRIDER's server before they are written to its database. The encryption key is held only in the server's protected configuration, never in the database and never in your browser, so the stored data can't be read on its own.
- Google tokens kept on the server. The lasting permission Google gives OVRIDER for your Google Drive (a refresh token) never leaves OVRIDER's server except as a short-lived access token (valid for an hour), given to your own browser only to reach OVRIDER's own files in your Drive.
- Least privilege. OVRIDER asks Google only for the narrowest permissions its features need: your name and email address to log you in, and on Google Drive only the files OVRIDER creates itself.
- Secure logins. Your login is kept in a signed cookie (HMAC-SHA256) that is HttpOnly (out of reach of the page's scripts), Secure (sent only over HTTPS) and SameSite, so it can't be forged or taken by another site. Each connection to Google is checked against a random, single-use state value, so it can't be hijacked.
- Separated by account. Everything is kept under your own account, and OVRIDER's server only ever gives it back to you, once you're logged in.
- Your data, under your control. Nothing is sold, shared or used for advertising or for training AI models. You can disconnect Google Drive or Dropbox at any time (which also withdraws the permission at Google or Dropbox), delete your saved settings and permissions from the login menu, or email us to have everything OVRIDER holds about you deleted.
Calls and messages
Calls between you and your contacts go directly between your two computers (WebRTC), encrypted end to end; OVRIDER's server only passes the two computers' details to connect them, and never sees or hears the call. Each call answered is listed in your address book's Log, with what was written in it, so you can read it back; that log is kept with your account, encrypted as above, and seen only by you.
Messages you send a contact in the address book's Messages are kept by OVRIDER, encrypted as above, so you and they can read them on any computer; only the two of you can see them, and only contacts in each other's address books can message each other.
Your voice
OVRIDER only listens after you press Engage, and stops when you press or say Disengage. While it listens, your speech is turned into text either by the free model on your own computer (it never leaves your computer) or by AssemblyAI on your own AssemblyAI key, which, like your other API keys, is yours alone: there's no shared AssemblyAI key. OVRIDER doesn't record, keep or listen to your audio.
Intel, voices and AI
Intel (OVRIDER's proprietary LLM engine) and its read-aloud voices each come in two kinds, and you choose which.
Free: Intel answers with an open-source model running on your own computer, and reads its answers aloud with a free voice on your computer. What you send to it (text, or a picture of a window) stays on your computer, and nothing is charged.
Premium, if you choose it: Intel's answers, and anything you send to it, go from your browser straight to OpenRouter on your own OpenRouter key, and read-aloud voices go from your browser straight to ElevenLabs on your own ElevenLabs key. Only then is anything billed, and only to your own accounts with them.
Either way, OVRIDER doesn't see or keep what you send to Intel or what it says.
The plugin
The mouse and keyboard plugin runs only on your own computer, and only answers the OVRIDER website. It doesn't send anything anywhere else.
OVRIDER Remote and OVRIDER Relay
OVRIDER Remote, on a Garmin watch, and OVRIDER Relay, on a phone, let the watch move your computer's mouse. What you do on the watch (moves, clicks, scrolls and keys) goes over Bluetooth to your phone, either directly or through Garmin Connect, and from your phone over Bluetooth to the OVRIDER plugin on your computer. Nothing is sent to the internet, to OVRIDER or to anyone else, and nothing is stored: each command is passed on and forgotten.
OVRIDER Relay asks for Bluetooth (Nearby devices) to find your watch and your computer, and to show a notification while it's running. It has no account, no advertising and no analytics, and it collects no personal data.
Cookies and counting
OVRIDER sets cookies only for logging in. It counts how many times the website is opened, as a single number, with nothing about who opened it. It also uses Vercel Web Analytics, which counts visits by page and country without cookies and without identifying you.
Contact
Questions about your data or this policy, or a request to delete what OVRIDER holds about you: email support@ovrider.com.