Yumankind OÜ ("Yumankind", "we", "us", "our") makes Overblast and 0-0. Yumankind OÜ is registered in Estonia (registry code 16232402, VAT number EE102378229), at Sepapaja 6, 15551 Tallinn, Estonia, and can be reached at support@yumankind.com. We are the controller of the personal data described in this policy.
This policy covers:
the Overblast app for iPhone, iPad and Android;
the 0-0 app for iPhone, iPad and Android;
the Overblast console at console.overblast.app, the website at overblast.app, and the Overblast API, SDK, command-line tool and agent skill.
One account signs you in to all of them. The 00 app for Mac is covered by its own policy at 0-0.chat/privacy.
We have not appointed a data protection officer, because the GDPR does not require one for our processing: we are not a public body, and our core activities involve neither large-scale regular and systematic monitoring of people nor large-scale processing of special categories of data. For any privacy question or request, email support@yumankind.com.
When you use Overblast to talk to your own customers (their messages, comments, reviews, emails, calls and chats), you decide what happens to their data and we process it on your behalf, under our Data Processing Agreement.
2. Information we collect
Account information: your name, email address and sign-in details. You sign in with email and password, Google or Apple, through Firebase Authentication; we never see your Google or Apple password.
Workspace content: the conversations, comments, reviews, emails, website chats, contacts, tasks, posts, files, call recordings and call transcripts in your workspaces, and the business information you give your agent.
Connected accounts: the social accounts you connect, their profile details, and the messages, comments and reviews they receive. Access to those accounts is held by our social-network connector (Zernio). Credentials you give us directly, such as your own SMTP password, are stored encrypted.
Phone calls: the numbers that call you or that you call, call times and durations, and, when the call feature records them, the recording and the transcript.
Payments: what you bought, when, and its status. Card payments are handled by Stripe, and store purchases by Apple or Google. We never see your full card number.
Device and usage data: IP address, device type, operating system, app version and push-notification tokens.
In-app analytics: both apps use Google Analytics for Firebase. It records app opens and sessions, time spent in the app, in-app purchases and app updates, with your device model, operating system, app version, language and approximate country, under a random app-instance ID.
Diagnostics: the Overblast app sends crash reports and error traces to Firebase Crashlytics. The 0-0 app does not use Crashlytics.
Your choice: in the European Union, the European Economic Area, the United Kingdom and Switzerland, analytics and crash reports stay off until you agree on the consent screen the app shows. Elsewhere they are on. Wherever you are, you can turn them on or off at any time in the app's settings.
Website analytics: overblast.app counts visits with Google Analytics for Firebase, on the same terms as the apps: off until you agree in the European Union, the European Economic Area, the United Kingdom and Switzerland, on elsewhere, and yours to switch off at any time. Section 12 says what it records.
3. App permissions
Each permission is asked for only when you first use the feature that needs it, and you can turn it off at any time in your device settings. The apps work without the optional ones.
The Overblast app
Microphone: to record voice messages in conversations. A recording is sent only when you send it.
Camera (iPhone and iPad): to take photos for messages.
Photos (iPhone and iPad): to attach images to messages. On Android you pick files with the system picker, which needs no permission.
Contacts (optional): to show your phone contacts when you pick who an AI call or a new conversation goes to.
Calendar (iPhone and iPad): to add task reminders to your calendar.
Location: to show nearby tasks on the map, while you use the app. On iPhone and iPad the app can also ask for "Always" access, which is optional: it lets a workspace's own staff, such as field workers, choose to share their live location with the workspace's clients, for example for a visit or a delivery. It is off unless you turn it on, and you can stop sharing at any time. On Android the app asks for precise and approximate location while in use and does not ask for background location.
Bluetooth (iPhone, iPad and Android) and NFC (Android): to connect supported card readers and take contactless payments through Stripe Terminal, if you use that feature. On iPhone the app may keep a Bluetooth connection to a reader in the background.
Notifications: for new messages, comments, tasks and reminders.
In-app purchases: to buy and restore subscriptions and credits through the App Store or Google Play.
The 0-0 app
Microphone: to record voice messages.
Speech recognition (iPhone and iPad): meeting mode transcribes what is said, on the phone, into a document you can ask the local AI about.
Camera: to take photos for messages, and to scan the QR code that pairs the phone with your Mac.
Photos: to attach images and videos to messages, and (iPhone and iPad) to save a picture your agent made to your library.
Contacts: so your agent can look someone up when you ask it to write to them or call them.
Calendars and, on iPhone and iPad, Reminders: so your agent can tell you what is on today, and add an event or a reminder when you ask, including a reminder your phone sets off when you arrive somewhere.
Location (while in use): so your agent can answer questions about where you are. Your location is never followed in the background.
Health (iPhone only, read-only): used only when you turn on the Health tool for an agent, so it can answer questions about your steps, sleep and workouts. It reads only the types you allow and never writes to Health. Health data reaches an AI model provider only if that agent uses a cloud model, and then under the no-retention, no-training rule in section 4. For sensitive data such as health, we recommend a local, on-device model. Health data is never used for advertising and never sold.
Local network (iPhone and iPad): to reach the 00 app on your Mac when both are on the same Wi-Fi.
Notifications and background work: to tell you when your agent replies. On Android the app may run a short foreground service to finish a sync, and restarts its notifications after the phone reboots.
On-device AI models. The 0-0 app can download AI models to your phone (for example from Hugging Face, which sees the download request). Questions you ask a model on the phone are processed on the phone and are not sent to us.
The relay to your Mac. What passes between the 0-0 app and the 00 app on your Mac goes through our relay. Messages between the 0-0 app and your Mac are end-to-end encrypted when both apps are up to date, with keys only your Mac and your phone hold, so we cannot read them. Every message is also signed by the device that sends it, so we cannot forge or change it. If one side runs an older version, messages are still signed end to end but not end-to-end encrypted; they are then protected by encryption in transit (TLS) and at rest in our database, like the rest of your workspace's data.
To route messages, the relay keeps device identifiers and their public keys, the pairing, session start and end times, the push token used to notify your phone, and the relayed messages themselves. Relayed messages and ended relay sessions are deleted after 30 days. Files sent through a QR pairing are deleted three days after they are uploaded, and a QR pairing whose Mac has not been seen for 90 days is forgotten.
We do not use your data for advertising or cross-app tracking. Both the Overblast and 0-0 apps remove Android's advertising-ID permission, so no advertising identifier is collected.
4. AI processing
Overblast's auto-reply is off until you turn it on, per channel or per chat, in the Overblast app. When it is on, the incoming message, the conversation's history and the business information you gave it are sent to an AI model to write the reply. It is paid from your AI credits. Workspace owners can choose to keep auto-reply AI processing in the EU or the US.
Your own agent reads and answers through the Overblast API or skill with the key you give it. What it does with that data is up to you and the provider you run it with.
AI phone calls are carried by Twilio and LiveKit, and the voice is produced by a realtime AI model: xAI's, unless the workspace owner chooses OpenAI's. Calls return a transcript and, where enabled, a recording.
Other AI features, such as call summaries, drafting help, and image, video, voice or music generation, run only when you use them.
AI requests from our servers go either through OpenRouter to the provider of the model in use (for example Anthropic, OpenAI, Google or xAI), or directly to Google: the Gemini API for search and maps grounding, and Vertex AI for reading business details, websites, branding, supplier profiles and files, for the knowledge agent, and for transcription.
No retention and no training by model providers. Every request we send through OpenRouter requires providers that do not retain prompts or completions (zero data retention) and do not use them for training. This is enforced on every request sent through OpenRouter.
Google's AI. Requests we send directly to Google are not zero data retention. We use Google's paid services, under whose terms Google does not use the data we send to the Gemini API or Vertex AI to train its models. Google keeps some of it for limited periods under its own terms: on the Gemini API, prompts and responses for 55 days to detect abuse, and search-grounded requests for 30 days; on Vertex AI, prompts that Google's automated safety checks flag may be logged for up to 90 days for abuse review, searches grounded with Google Search leave logs for up to 3 days, and inputs and outputs may be cached in memory for up to 24 hours to speed up responses.
OpenAI's voice model. Calls on a workspace that chooses OpenAI's voice model are sent directly to OpenAI and are not zero data retention. OpenAI does not use data sent through its API to train its models. It keeps logs for abuse monitoring, which can contain what was said on the call, for up to 30 days, and the requests its voice model passes to its backend model to run the agent's tools may also be kept for up to 30 days. We do not ask OpenAI to store call recordings.
We do not keep AI prompts: requests to AI models are processed to produce the answer and are not stored by us.
We do not train AI models on your content.
5. Payments
Web purchases are paid by card through Stripe, which also calculates VAT where it applies. Purchases in the apps are made through the Apple App Store or Google Play, under their terms and privacy policies, and those subscriptions are managed in your store account. If you take card payments from your own customers with the Overblast app, Stripe Terminal processes them. We keep payment records as described in section 9.
6. How we use your information, and why
To provide the service you signed up for: your inbox, calls, posts, tasks, agents and billing (to perform our contract with you).
To keep the service secure, prevent fraud and abuse, and fix problems (our legitimate interests).
To understand how the apps and the website are used and improve them, from analytics and crash reports (your consent in the European Union, the European Economic Area, the United Kingdom and Switzerland; our legitimate interests elsewhere).
To send you service messages, such as receipts, security notices and changes to these terms (our contract, and legitimate interests).
To keep tax and accounting records (a legal obligation).
Device permissions are used only with your consent, which you can withdraw in your device settings.
7. Sharing and sub-processors
We do not sell your personal information. We share it only with the social networks and channels you connect, to do what you ask; when the law requires it; to protect the rights and safety of our users, the public or Yumankind; and with the service providers below, who process it for us. This is the same list as in our Data Processing Agreement.
Cloudflare: hosting, edge compute, databases, file storage, sending and receiving email, real-time audio and video, and the relay between the 0-0 app and your Mac. Location: Global network; our main database (Cloudflare D1) is in Western Europe (region WEUR); files (Cloudflare R2) are in the region the workspace owner chose (the European Union under Cloudflare's EU jurisdiction, or a preferred location in North America or Asia-Pacific), or in Western Europe (region WEUR) for workspaces created without that choice.
Google (Firebase and Google Cloud): sign-in, the Overblast app's database, push notifications, app configuration, app analytics, website analytics, crash reports, maps and place search. Location: United States; the legacy Firestore database is in the US multi-region nam5.
Google (Gemini API and Vertex AI): AI for search and maps grounding (Gemini API), and for reading business details, websites, branding, supplier profiles and files, the knowledge agent, and transcription (Vertex AI). Location: United States (Vertex AI region us-central1); the European Union (Vertex AI region europe-west4) for workspaces that choose the EU region for auto-replies.
Stripe: card payments, subscriptions, invoices and VAT on the web, and card-present payments through Stripe Terminal. Location: United States and Ireland (Stripe Payments Europe for EU customers).
Apple (App Store): in-app purchases and subscriptions on iPhone and iPad. Location: United States / Ireland.
Google Play: in-app purchases and subscriptions on Android. Location: United States / Ireland.
Zernio: the connector to social networks, for connecting accounts, publishing, and reading and answering messages, comments and reviews. Location: Spain, EU (ZERNIO SOFTWARE SL, Girona).
OpenRouter and the AI model providers it routes to (such as Anthropic, OpenAI, Google and xAI): AI for auto-reply, agents, summaries and drafting. Location: United States, with in-region EU or US routing when the agent's model region is set.
xAI: the realtime voice model on AI phone calls. Location: United States.
OpenAI: the realtime voice model on AI phone calls, for workspaces whose owner chooses it. Location: United States.
Twilio: the phone line, call routing and phone numbers. Location: United States.
LiveKit: the audio connection between a phone call and the AI voice agent. Location: United States.
fal.ai: AI image, video, voice (including ElevenLabs models) and music generation, when you use those features. Location: United States.
Replicate: AI media generation, when you use those features. Location: United States.
8. International transfers
Some of these providers process data outside the European Economic Area, mainly in the United States; each one's location is given in section 7. Where personal data is transferred outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Where a workspace's files are stored depends on a choice its owner makes when creating the workspace, where we offer it: the European Union, where Cloudflare's EU jurisdiction guarantees the files are stored and processed only in the EU; or North America or Asia-Pacific, which is a preferred location, not a guarantee. The choice cannot be changed later. It covers the workspace's files only: our main database (Cloudflare D1) is in Western Europe for every workspace. Workspaces created without the choice keep their files in Western Europe (region WEUR), which is also a preferred location rather than a guarantee. A file we pass to another provider to do what you ask, such as a social network or an AI model, is then held where that provider is.
9. Retention and deletion
We keep your data while your account is active, except for the following:
AI prompts: we do not keep them. Requests to AI models are processed to produce the answer and are not stored by us. A reply that was sent stays in the conversation it was sent in, like any other message.
Messaging data (the conversations and messages in a workspace's inbox, from social DMs, email, calls and web chat): kept while the workspace exists. Archiving a conversation hides it but does not delete it, and a message deleted on a social network stays in the workspace's history, marked as deleted. When the workspace or your account is deleted, its messages are removed from our live systems straight away and from our backups within 30 days.
Payment records (invoices, receipts and refunds): kept for as long as tax and accounting law requires, up to 7 years, and used only for accounting, refunds and disputes.
You can delete your account at any time, yourself:
in the Overblast or 0-0 app, under Settings → Delete account;
or as described on our Delete your account page, which also explains what to do if you cannot sign in.
Deleting your account deletes your login, every workspace you own and everything in it, straight away, except the payment records above. Subscriptions bought in the App Store or Google Play must be cancelled in the store. Deleted data can remain for a short time in our systems' recovery history and logs: up to 30 days in the point-in-time recovery of our main database (Cloudflare D1) and in our weekly offline copy of it, up to one hour in the legacy Firestore database, and up to 7 days in our server logs (Cloudflare Workers Logs). After that it is gone.
You can also delete a single workspace, a connected account or a file without deleting your account.
10. How we protect your data
Encryption in transit: data travelling to and from the Service is encrypted with TLS. Messages between the 0-0 app and your Mac are end-to-end encrypted when both apps are up to date (see section 3).
Encryption at rest: Cloudflare D1 and R2, where our main database and files are kept, encrypt all stored data with AES-256 (D1 uses AES-256-GCM), and Google Cloud and Firebase encrypt stored data by default. Credentials you give us directly, such as your own SMTP password, are also encrypted by the application.
Backups: our main database (Cloudflare D1) has point-in-time recovery to any minute within the last 30 days (D1 Time Travel, always on).
Access control: access follows least privilege. Each workspace is isolated, and its data is reachable only by its members and the API keys it issues, according to their role. Administrative functions are restricted to authorised administrators, and administrative access to production systems and source code requires multi-factor authentication.
11. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent. To exercise any of these rights, email support@yumankind.com. You may also complain to the data protection authority where you live, or to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
12. Cookies and similar technologies
There is no advertising on overblast.app or the console, and we do not track you across other sites. The website counts visits with Google Analytics, as described below, and the console has no analytics. This is exactly what the website and the console store or load, and why.
Strictly necessary
Your cookie choice:overblast.cookieConsent in your browser's local storage remembers whether you accepted or declined, so we do not ask on every page.
Your country, for this visit: to know whether to ask, the page asks our host, Cloudflare, which country the visit comes from (/cdn-cgi/trace on our own address) and keeps the two-letter answer in session storage (overblast.country) until you close the browser.
Signing in: the console uses Firebase Authentication, which keeps your session in your browser's storage (IndexedDB), and remembers the workspace you last opened, in local storage. Invitations open in the console, so nothing on overblast.app signs you in.
The spin page: when you choose to spin at overblast.app/spin, a random browser token and the prize you won are kept in local storage so the prize can be claimed.
Payments: paying opens Stripe's own checkout page, which sets its own cookies under Stripe's privacy policy.
Only with your consent
Website analytics: overblast.app uses Google Analytics for Firebase to count visits. It records your visits, the pages you view, how long you stay on them and the buttons you click, with your device type, browser, operating system, screen size, language and approximate country, under a random ID kept in two cookies (_ga and _ga_N9E8ZP8W5R, for overblast.app only) and the Firebase installation ID in your browser's storage (IndexedDB). Page addresses are sent without anything after the "?", and the addresses of invitations, shared links and workspace links are cut to their first part, so no link token, email address or form content is sent. It is not used for advertising: Google signals and ad personalisation are off, and it never runs on the chat and request forms that businesses embed on their own websites. Google works out your approximate location from your IP address and does not store the address in Google Analytics. The legal basis is your consent in the European Union, the European Economic Area, the United Kingdom and Switzerland, and our legitimate interest in understanding how the website is used elsewhere. The cookies expire after 13 months, and Google Analytics deletes the records of your visits after 14 months.
App store links: the Firebase SDK is loaded from Google (gstatic.com) to read one setting, whether the Overblast app is out yet. It keeps a Firebase installation ID and a copy of the setting in your browser's storage (IndexedDB) and sends the installation ID to Google. Without it, the store buttons show "coming soon".
The exit offer: on a computer, the home page may offer a free spin once, when your pointer leaves the window. It keeps a random browser token and a note that the offer was shown in local storage, and asks our server for a prize.
If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or if we cannot tell where you are, a small card asks first, and none of these load until you choose Accept. Elsewhere they load with the page. Wherever you are, you can change your choice at any time, here () or with "Cookies" at the bottom of the home page and these legal pages. If you decline after accepting, analytics stops at once, we delete what these stored (including the _ga cookies) and reload the page.
Loaded from other providers
Fonts come from Google Fonts and icons from jsDelivr. These set no cookies, but like any request they reach those providers with your IP address. Web chats show a map from OpenStreetMap when a location is shared. Our host, Cloudflare, processes the technical data of each request (such as IP address and browser) to deliver and protect the site.
13. Children
Overblast and 0-0 are for people aged 16 or older. We do not knowingly collect personal data from children under the age of 16, and if we learn that we have, we delete it. Buying a plan, AI credits or add-ons, or owning a workspace, requires you to be 18 (the age of majority) or to have the consent of a parent or guardian.
14. Changes to this policy
We may update this policy. We will post the new version here, update the date at the top, and tell you in the app or by email about any material change.