Over Yonder Privacy Policy
Last updated: 29 September 2026
Over Yonder helps you save places from wherever you find them, plan a trip with the people you travel with, and keep it afterwards. This page says what we collect, why, who else sees it, how long we keep it, and how to delete it. "We" is Cameron Schorg, who makes Over Yonder. Questions: support@overyonderapp.com.
What stays on your phone
Most of your trip never leaves your phone except to sync with the people you share it with.
- Your trips (places, notes, days, stops, stars, visits) are stored on your phone.
- Photos you add stay in your photo library and on your phone. We keep small previews to show them in the app. The small previews (not the originals) are shared with the people on the trip, through our service; see Syncing and sharing trips.
- Screenshots and saved videos you share to Over Yonder are read on your phone: the text in them, and the words spoken in a video, are recognised on the device. Only that text is sent on (see "Asking the assistant" below). The images and video never leave your phone.
- Translation of menus and signs happens on your phone.
Your account
When you first open Over Yonder, it creates an account for you without asking for anything: a random ID, and when it was created and last used. This lets you keep your trips and share them.
If you choose to name your account, with Sign in with Apple, Google, or an emailed code, we also keep:
If you ask Over Yonder to remember something about you — that you're vegetarian, say — we keep that line with your account until you delete it or your account, and send it with your questions to the assistant. To keep the service from being abused, each copy of Over Yonder proves it's genuine with Apple's App Attest; we keep that copy's key with your account. Each copy also keeps a random install ID in its keychain, which our server uses to count requests fairly.
- your email address (with Apple, this can be Apple's private relay address if you choose to hide yours),
- the ID Apple or Google gives us for you, and the name and email they send,
- your name, if Apple provides it the first time you sign in,
- whether you've allowed the assistant (see below).
Our account provider, Supabase, records the IP address and device type of each sign-in in its own security logs, for its standard log retention.
Syncing and sharing trips
Trips sync through our own service, hosted by Supabase: the trip's content, small previews of its photos, and who is on it are stored there so everyone on the trip sees the same thing. Only the people you've invited to a trip can see it.
Asking the assistant
The assistant plans with you: it suggests places, answers questions about your trip, and proposes changes you can accept or undo. Before your first question, Over Yonder asks your permission.
When you ask, we send your question, the conversation so far, and the facts of your trip it needs (places, days, cities, dates) to Anthropic, which runs the Claude model that writes the answer. Anthropic handles it under its commercial API terms, which do not allow using it to train their models. We send the names the people on the trip go by, so it can say who starred what, but not your email or account ID.
Our server passes the question through and does not keep it. It keeps the answer only long enough for the app to collect it, under your account so only you can, then deletes it within 24 hours. We keep a record of each request's size and cost, linked to your account, with no text in it, to keep the service free and fair. When you share a link or a post to Over Yonder, we send the link (and any text you shared) to our server, which reads the page for places, and to Anthropic to pick them out. The result is kept up to 24 hours for your phone to collect.
Helping improve the assistant
Unless you turn it off (Settings → Help improve Over Yonder), we keep a copy of your questions to the assistant, its answers, and which suggested changes you accepted or undid, so we can test and improve it. This copy is not linked to your account: it has no name, email or account ID, only a random ID per conversation, and the trip details the question needed. It is deleted after 90 days. It comes from conversations with the assistant only, never from links you share. It can contain the names the people on the trip go by, and anything typed in a question.
Places, maps and photos
centre, never your phone's location.
- Google Maps draws the map, and Google Places tells us where a place is, its hours, rating, reviews and photos. We send Google the name of the place and the city it's in; we don't send who you are. Google's own privacy policy applies to its maps: https://policies.google.com/privacy.
- Apple Weather gives the forecast for where your trip is.
- "Near you": when you ask about places near where you are, and you've allowed location, your phone's location is sent with that question to Anthropic to answer it. Google is sent only a city's It isn't sent otherwise, and our server doesn't keep it.
- Google Maps itself collects crash and performance data and a device identifier for its own analytics, as described in Google's privacy policy.
- We keep a count of Google requests per day for each install, with no content, so the service stays within its limits.
Forwarded booking emails
You'll get your own address to forward booking confirmations to. We store the email until the app collects it and turns it into a booking, then delete it. Anything not collected is deleted after 30 days.
What we don't do
- We don't sell your data or share it for advertising.
- We don't track you across other apps or websites.
- We don't use analytics or advertising SDKs.
- Your trip content is never used to train AI models.
Who we share data with
Only the services that make Over Yonder work, each for the purpose above:
| Service | What it sees | Why |
|---|---|---|
| Supabase | your account; your trips and their photo previews | accounts, sign-in, sync |
| Anthropic | your questions and the trip facts they need | the assistant |
| Google (Maps, Places) | place names, cities, map views | maps, places, photos |
| Apple (Weather, Sign in with Apple, App Attest) | your trip's location for weather; sign-in | sync, forecasts, sign-in, protecting the service |
| Resend | forwarded booking emails; the emails we send you | bookings by email, sign-in codes |
| Netlify | requests passing through our server | hosting our server |
How long we keep it
- Your account and trips: until you delete your account.
- Unused accounts: an account that has never been named and hasn't been used for 30 days is deleted (180 days if it holds trips, and only when every trip it's on is unused too).
- Assistant answers on our server: deleted within 24 hours.
- Forwarded emails: deleted when collected, or after 30 days.
- Abuse and cost limits: counts per account, and a scrambled form of your network address, kept up to two days. We never keep the address itself.
- Usage and cost records: kept for accounting; when you delete your account, they are unlinked from you.
Deleting your account
At the very bottom of Settings, Delete account. This deletes your account, email, name, and sign-in links; any trip only you are on; your place on trips you share (the trip stays with the others); and your forwarding address and any mail waiting in it. If you signed in with Apple, we also revoke Over Yonder's access in your Apple ID. It also deletes anything you asked Over Yonder to remember, any answers waiting for your phone, and the counts our limits keep for you. What you added to a shared trip stays with it for the others, but no longer shows who added it. It can't be undone.
Children
Over Yonder isn't directed at children under 13, and we don't knowingly collect their data.
Changes
If this policy changes in a way that matters, we'll say so in the app before it takes effect.
Contact
support@overyonderapp.com · privacy@overyonderapp.com · Cameron Schorg