Privacy Policy

1. Introduction

This Privacy Policy explains how Overkot ("we", "us", "our") collects, uses, and protects information when you use the Overkot desktop application and the overkot.com website (collectively, the "Service"). We are committed to protecting your privacy and being transparent about our data practices.

2. Information We Collect

2.1 Information You Provide

Overkot’s core overlay does not require account creation. The optional Avakot Market integration requires a market account. If you contact us via email or Discord, we may collect the information you provide in your message (such as your name, email address, or Discord username) solely for the purpose of responding to your inquiry.

2.2 Automatically Collected Information (Desktop App)

The Overkot desktop application:

• Reads game data from Soulframe on your local machine to provide gameplay features (boss timers, crafting status, faction standings and inventory tools). Local logs and cached data support these features. Account/session information is used to request your game inventory and profile from Soulframe services; online features below have their own data flows.
• Stores configuration and preferences locally on your computer in an encrypted format.
• Contacts our update server to check for and download application updates. Requests can include the app version, and the hosting provider receives normal connection information such as the IP address. Game data updates also retrieve map, calendar and equipment catalogues.

2.3 Group Finder Data

If you use the Group Finder feature, the following data is transmitted to our Firebase backend:

• A Firebase authentication identifier and account-linked profile identifier
• Your Envoy name, looked up from your connected game profile
• Your selected language, region and activity preferences
• Group listing details you create

This data supports profiles, listings, join requests and group matching. Listing and presence expiry are separate from stored profiles; closing the app does not mean all Group Finder records are immediately deleted. Contact us for data requests.

2.4 Avakot Market

Market uses the Avakot Account connection approved in your browser through Settings → Connections. After you approve Market access, Overkot requests a short-lived, single-use authorization grant and exchanges it for a Market session. Your Avakot Account credential and password are not sent to Market. The Market session stays in memory; restarting Overkot creates a fresh session from your saved account connection. Disconnecting or changing the connected account clears the Market session and attempts to revoke it on the market server.

Market receives catalogue and listing requests, listing details you choose to publish or edit (including item attributes, quantities, prices and notes), and presence updates while Market is enabled and signed in. Your market status remains Online – In game while that integration is active, including when its window is closed. Inventory matching happens in Overkot; your raw game inventory, game account ID and game session nonce are not sent to Market.

Overkot checks the connected character against your verified market Envoy before listing inventory. Disabling Market, signing out or quitting ends automatic presence; it does not delete your market account or listings. Manage those on Avakot Market.

2.5 Avakot Account

If you connect an Avakot Account in Settings, you sign in and approve the connection in your browser. Overkot receives a credential for that connection and your Avakot email and display name; your password does not pass through the overlay. The credential is saved using operating-system protected storage when available, otherwise only for the current app session.

While connected, Overkot sends Avakot your Soulframe account ID, resolved public profile name and live game online status. This is recorded as an Overkot observation. Your inventory and game session nonce are not sent to Avakot Account. Online status expires after two minutes without a renewal. Signing out clears the local credential and attempts to revoke the connection remotely; you can also revoke it in the Avakot Account portal.

Desktop Usage Analytics

The app sends basic usage events through a Firebase Cloud Function to Google Analytics. Events include app launches, active time, feature use and enabled widgets, with app version, operating system, timestamps and a randomly generated installation identifier. This is enabled in the distributed app.

The analytics event payload excludes Envoy names, game account IDs, credentials, inventory contents, screenshots, chat and free-form text. The relay also handles authentication, request limits and duplicate-delivery records. Service providers receive connection information when processing requests.

Build Export

When you choose to export, Overkot opens avakot.build with an import containing your equipped build details, such as equipment, rank, stats and tempers. Review the draft there before saving or sharing it.

The current website does not include an analytics or advertising script. Download hosting may retain access logs for operating the service. External sites linked from Overkot have their own data practices.

3. How We Use Your Information

We use the information described above to:

• Provide and maintain the Service (overlay functionality, group finding, updates)
• Respond to your communications
• Improve the Service through aggregated analytics

4. Data Storage and Security

The app stores configuration and cached data on your computer, with encryption used for its saved JSON data. Online Group Finder records are stored in Firebase, and usage events are processed by Firebase and Google Analytics. Local storage protection does not make all data anonymous or remove the online data flows described above.

5. Third-Party Services

The Service may interact with the following third-party services:

• Avakot Market — market authentication, catalogue access, listings and presence
• Avakot Account — optional account connection, Soulframe profile observations and game online status
• Firebase (Google) — Group Finder authentication and records, plus the app usage relay
• Google Analytics — desktop app usage statistics
• Discord — community communication (external link)

Each of these services operates under its own privacy policy. We encourage you to review their policies.

6. Cookies

The current website does not set analytics or advertising cookies. See the Cookie Policy for the distinction between website cookies, app storage and external sites.

7. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your personal data
• Object to or restrict processing of your data
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us.

9. Data Retention

We retain data only as long as necessary to fulfill the purposes outlined in this policy. Group Finder profiles, listings, requests and presence records have different lifetimes; they are not all removed on exit. Contact inquiries are retained for up to 12 months. Analytics data is retained according to the respective analytics provider's policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy, please reach out via our contact page or join our Discord server.