Privacy Policy

If you buy a placement:

• The name, destination URL and plot you chose — all of it public by design.
• The amount paid, a payment reference from our provider, and the email address you gave at checkout, which the provider passes to us. Your receipt comes from the provider, not from us.
• We never receive your card details. They go directly to our payment provider and never touch our servers.

If you only visit:

• A random identifier stored in your browser's local storage. It is not derived from anything about you — it exists so that clicking the same listing twice counts once, and so the visitor counter is not nonsense.
• A timestamp of when that identifier was last active, for the live count.
• Which listings that identifier clicked through to.

We do not use cookies for advertising, we do not build profiles, and we do not sell or share data with advertisers or data brokers. Our analytics are cookieless. Clearing your browser storage resets your identifier completely.

• To publish and display the placement you paid for.
• So we can reach you about your listing or a payment problem.
• To tell advertisers how many unique people clicked through to them, which is the thing they are paying for.
• To show a live visitor count, and to understand whether the site is working.

Where the law requires a basis: contract, for anything needed to deliver a placement you bought; legitimate interests, for the aggregate counting; legal obligation, for financial records.

Names, site icons, amounts, positions and destination links on the board are public. Anyone can see them, including search engines. Don't list a destination if you don't want that shown.

We fetch public information about a destination so visitors can recognise the listing. That request may reveal to the destination that Overbuild asked for the page.

• Dodo Payments — merchant of record. They process the payment and hold the payment data. Their privacy policy governs it.
• Supabase — our database and hosting for listing and counting data.
• Vercel — application hosting and analytics. They process server logs including IP addresses, and we run Vercel Analytics and Speed Insights, which record page views, referrers, approximate location derived from IP, device type, and performance timings. Vercel Analytics is cookieless and does not track you across other websites.
• Google — we currently load listing marks from Google's public favicon service. That means your browser makes a request to Google when you load the city, and Google can see your IP address. We are moving this behind our own proxy to stop it.

We do not share data with anyone else.

• Listings — for as long as the listing is published. Placements are permanent by design.
• Payment records — as long as required for tax and accounting, typically seven years.
• Visitor identifiers and click records — 24 months, then deleted.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. For a placement, deletion means removing the listing. Payments are non-refundable, so removing a listing at your request does not refund it.

Depending on where you live you may also have the right to object to processing or to complain to a data protection authority.

Email @mustafa_l53 or @husain_j53. We aim to respond within 30 days.

Overbuild is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.

If we change this policy we will update the date at the top of this page. The date shown is always the current version.