Privacy Policy

Who we are

Overnite is operated by Defo Labs Ltd, a private limited company based in London, United Kingdom. For the personal data described here, Defo Labs Ltd is the controller under the UK General Data Protection Regulation and the Data Protection Act 2018, and under the EU General Data Protection Regulation where it applies to you.

Questions about this policy, or requests about your data: hello@overnite.dev.

What Overnite is, in one paragraph

Overnite runs coding agents - Claude Code, Codex, opencode and Gemini CLI - on isolated machines we operate, against repositories you choose. You sign in with GitHub, start agents in a workspace, and answer their questions from a browser or your phone. The agents call AI model providers with your own API key or subscription, not ours.

The data we collect

When you sign in

• Your GitHub profile: your GitHub user ID, login, avatar URL and the primary verified email address GitHub gives us.
• A GitHub OAuth token with the scopes you approve (read:user, user:email, repo). Our servers use it to list your repositories and to see who you are; it is stored encrypted, is never shown to you or anyone else again, and is never given to a workspace.

When you install the Overnite GitHub App

• The installation: the account it is installed on and the repositories you chose. A workspace clones, pushes and opens pull requests with a token GitHub issues to the App for that one repository, which expires within an hour.
• Webhook deliveries from those repositories, read to do what they ask. A comment or issue mentioning the App starts an agent, and we keep the repository, the issue or pull request number, who asked, and the request. Failed checks and merged pull requests are kept as activity on your workspaces for that repository.
• A record of each sign-in: when it happened and whether it created your account.

When you use workspaces

• Repository contents. The repository you choose is cloned onto your workspace's disk, together with whatever the agents create there. It stays on that disk while the workspace sleeps and is deleted when you delete the workspace.
• Workspace and agent records: the repository URL and branch, workspace status, which agents ran, the task you gave each one, the question an agent is waiting on, pull request links, and timestamps.
• Terminal output is streamed from the workspace to your browser through our realtime service. We do not store it in our database. The agent programs themselves keep their own conversation history on your workspace's disk.
• Schedules you create, and the history of their runs.

Credentials you give us

• API keys you add in Settings → Agents (for example ANTHROPIC_API_KEY), stored encrypted. Only the last four characters are ever shown again.
• Sign-in bundle: when you sign an agent program in inside a workspace (for example /login in Claude Code), the sign-in files it writes - ~/.claude/.credentials.json and ~/.claude.json for Claude Code, ~/.codex/auth.json for Codex, ~/.gemini/oauth_creds.json for Gemini CLI, opencode's auth.json, and ~/.config/gh for the GitHub CLI - are packed when the workspace sleeps, encrypted, and unpacked into your next workspace. Only those files: conversation history and other working state stay behind, and the bundle is capped at 5 MB.
• Connector tokens for services you connect in Settings → Connectors (for example Linear or Sentry), stored encrypted.

Usage data

• Usage metrics: compute minutes per workspace per day, how many agents were started, how long a waiting agent took to be answered, and errors from providers we call. We use these to run and bill the service and to decide what to improve.
• Server logs of requests to our API, which can include IP addresses. They are used for security and debugging.
• Website analytics: page views on overnite.dev and the cockpit, counted by Vercel Web Analytics, which uses no cookies and does not identify you.

If you join the waitlist

• The email address you enter, where you came from on our site, and a keyed hash of your IP address that lets us spot one source flooding the form. We never store the IP address itself.

Notifications

• If you turn notifications on, your browser's push subscription (an endpoint URL and its keys), so we can tell you when an agent needs you.

Cookies

We set two cookies, both strictly necessary, both HttpOnly:

• overnite_session - keeps you signed in, for up to 7 days.
• overnite_oauth - protects a GitHub sign-in in progress, for 10 minutes.

We use no advertising or tracking cookies.

Why we use it, and on what legal basis

• To provide Overnite to you (performance of our contract with you): signing you in, running workspaces and agents, cloning and pushing your code, delivering notifications, storing your credentials so you do not re-enter them.
• Legitimate interests: keeping the service secure and preventing abuse, understanding usage in aggregate to improve the product, and emailing waitlist members about access they asked for.
• Legal obligations: keeping billing and tax records once paid plans exist.
• Consent: push notifications, which you can turn off in your browser at any time.

We do not sell personal data, and we do not use your code, prompts or agent output to train models.

Where your data is stored

Our servers - the database, the workspaces and their disks - run on a dedicated server operated by Hetzner Online GmbH in Finland (EU), in its Helsinki data centre.

Some of the providers below are based in the United States. Where your data is transferred outside the UK or the EEA, we rely on the safeguards the law provides: an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension, where the provider is certified), or the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum.

Who else processes it

• Hetzner Online GmbH (servers in Finland (EU)) - hosting of our servers and your workspaces.
• GitHub, Inc. (USA) - sign-in, and access to the repositories you choose.
• Vercel Inc. (USA) - hosting of overnite.dev and the cockpit, and cookieless page-view analytics.
• Cloudflare, Inc. (USA) - DNS for overnite.dev, and access control for our internal tools.
• Resend (Plus Five Five, Inc., USA) - sending email: sign-in and beta invitations, waitlist confirmations, and notifications.
• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) - payment processing, once paid plans launch. We will not see or store your full card details.
• Anthropic, OpenAI and Google - only through the agents you start, with your own API key or subscription. Your code and prompts go to them under your account and their terms, not ours. Separately, we may send aggregate, non-personal usage counts to Anthropic to draft our own internal reports.
• Services you connect yourself - for example GitHub's MCP server, Context7 (Upstash), Linear, Sentry or Slack - receive requests from your agents with the credentials you connected, under your account with them.

How long we keep it

• Your account, credentials and workspaces: for as long as your account exists. When you ask us to delete your account, we delete them within 30 days.
• A workspace's disk: until you delete the workspace. A sleeping workspace keeps its disk.
• Credential bundles and API keys: until you remove them, or your account is deleted. A new bundle replaces the previous one.
• Connector tokens: until you disconnect the connector, or your account is deleted.
• Sign-in records and usage metrics: up to 24 months, then deleted or reduced to totals that identify no one.
• Server logs: no longer than 30 days.
• Waitlist entries: until you are invited and create an account, or until you ask us to remove you.
• Billing records: six years after the end of the financial year they belong to, as UK tax law requires, once paid plans exist.

Your rights

Under UK and EU data protection law you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong;
• delete your data;
• restrict or object to how we use it;
• send your data to you, or another provider, in a machine-readable format.

Where we rely on consent, you can withdraw it at any time.

To exercise any of these, email hello@overnite.dev from the address on your GitHub account, or tell us your GitHub login. We may ask you to confirm the request comes from you. We answer within one month.

Deleting your account

Email hello@overnite.dev with the subject "Delete my account". We will stop your workspaces, delete their disks, your stored credentials, connector tokens, workspace and agent records, and your account, and confirm when it is done - within 30 days. Records we must keep by law, such as invoices, are kept only for that purpose.

You can also revoke Overnite's access at any time in GitHub under Settings → Applications, which stops us from using your GitHub token immediately.

Complaints

If you are unhappy with how we handle your data, tell us first at hello@overnite.dev. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to the data protection authority in your country.

Children

Overnite is a tool for software developers and is not directed at anyone under 16. We do not knowingly collect data from children.

Changes

When this policy changes, we update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.