Privacy Policy

O Overclock Mobile conecta o iPhone diretamente ao desktop Overclock que você pareou. O app não exige uma conta Overclock e, conforme o código revisado, não inclui analytics, publicidade, rastreadores ou telemetria para servidores do desenvolvedor.

Para parear, o app recebe os dados de conexão e uma credencial do desktop escolhido. O endpoint, a credencial e a impressão digital do pareamento ficam no Keychain do iOS. Apelidos de hosts e preferências, como comandos rápidos e opções de alertas, ficam no armazenamento local do app.

Suas mensagens e os dados exibidos pelo terminal trafegam por WSS diretamente entre o iPhone e o desktop pareado. O desenvolvedor não recebe esse conteúdo por um serviço intermediário do Overclock Mobile. O desktop e as ferramentas de terceiros que você configurou nele podem tratar os dados sob as próprias condições.

O app não implementa push remoto. Alertas são notificações locais geradas a partir de eventos recebidos enquanto conectado ou após uma atualização de estado quando você volta ao app. A conexão é encerrada em segundo plano e retomada quando você retorna.

Em Ajustes do app, você pode remover um host pareado; isso apaga a credencial local e remove o host da lista. Você também pode desativar notificações nos Ajustes do iOS. O app não mantém conta nem cópia de mensagens em servidores do desenvolvedor.

Em produção, a conexão usa WSS/TLS fornecido pelo sistema operacional e as credenciais ficam no Keychain. O app não implementa pinning de certificado nem criptografia ponta a ponta. Esta política será atualizada se o comportamento ou os dados tratados mudarem.

Overclock Mobile connects your iPhone directly to the Overclock desktop you paired with. The app does not require an Overclock account and, according to the code reviewed, includes no analytics, advertising, tracking, or telemetry to the developer’s servers.

To pair, the app receives connection details and a credential from the desktop you choose. The endpoint, credential, and pairing fingerprint are stored in iOS Keychain. Host nicknames and preferences, such as quick commands and alert settings, stay in the app’s local storage.

Your messages and terminal data travel over WSS directly between your iPhone and the paired desktop. The developer does not receive this content through an Overclock Mobile intermediary service. Your desktop and third-party tools configured on it may handle the data under their own terms.

The app does not implement remote push. Alerts are local notifications generated from events received while connected or after a state refresh when you return to the app. The connection closes in the background and resumes when you return.

In the app’s Settings, you can remove a paired host; this deletes its local credential and removes the host from the list. You can also disable notifications in iOS Settings. The app does not keep an account or a copy of messages on developer servers.

In production, the connection uses WSS/TLS provided by the operating system, and credentials are stored in Keychain. The app does not implement certificate pinning or end-to-end encryption. This policy will be updated if the app’s behavior or data handling changes.

The controller responsible for operating the platform is GL Estrategias Digitais Ltda. (Overclock), CNPJ 29.231.457/0001-99.

Overclock is the controller of the data necessary to operate its own platform, account, subscription, payments, support, security, community, Discord/Founders, and communications.

Overclock's Data Protection Officer (DPO) is Guilherme Laschuk.

The official channel for privacy, LGPD, personal data, exercising data subject rights, and communications with the ANPD (Brazil's data protection authority) is [email protected]. The community and moderation channel is [email protected].

When you create an account, sign in to the dashboard, or use Google OAuth login, we may process data necessary to authenticate you, maintain your session, identify your account, and unlock access to contracted features.

• Data: email, user identifier, authentication provider, basic account metadata, session, and authentication status.
• Google OAuth: when you choose to sign in with Google, we may receive your Google account identifier, email, name, and profile picture, according to the scopes you authorize.
• Purpose: create an account, authenticate, maintain a session, prevent abuse, recover access, and unlock features.
• Legal basis: performance of a contract or pre-contractual steps; legitimate interest for security and abuse prevention.

When you start checkout, subscribe, cancel, or change your plan, we process data necessary for billing, unlocking access, financial support, fraud prevention, and compliance with legal obligations.

• Data: email, plan, subscription status, customer and subscription IDs in the payment processor, checkout events, billing status, and operational metadata.
• Payment methods: sensitive financial data, such as card details, is processed by Stripe or an equivalent processor, under that provider's own terms and policies.
• Purpose: unlock access, bill, cancel, reconcile payment, prevent fraud, provide support, and comply with tax, accounting, or legal obligations.
• Legal basis: performance of a contract, compliance with a legal obligation, fraud prevention, and regular exercise of rights.

When you join the community, connect Discord to Overclock, or use Founders benefits, we process the minimum data needed to operate the community, sync roles, and enforce security and moderation rules.

• Data: Discord ID linked to your account, subscription status calculated from your subscription, transient role-sync results, community messages, reports, and moderation records where applicable.
• Purpose: administer the community, sync roles, enforce rules, protect members, respond to reports, and preserve evidence of abuse or incidents.
• Legal basis: performance of a contract when a paid benefit is involved; legitimate interest for moderation, security, and abuse prevention; regular exercise of rights when necessary.
• Independent third party: Discord also applies its own terms, policies, logs, and data-handling practices.
• Next app improvement vote, data: your account and the improvements you vote for on /app/votar, one row per vote and round. Your first name, taken from your account name, is shown to other members beside the vote, only for votes cast after the notice on the page, up to eight names per improvement followed by “and N more.” We do not store an IP address or browser identifier for this feature.
• Next app improvement vote, retention and removal: the vote is kept while your account exists, and your first name is shown while the round is displayed. You can remove your vote on the page until the round closes, and deleting your account deletes your votes. Your name stops appearing when you remove your vote or delete your account.
• Members WhatsApp group — data: the phone number you enter and verify on the /whatsapp/membros page, linked to your account, along with the verification state (the code is stored only as a hash and expires), your status in the group, and the result of the subscription check.
• Members WhatsApp group — purpose: manage access to the members WhatsApp group, confirm the number belongs to the subscriber, and remove from the group any number whose subscription is no longer active. The number is stored without hashing because removing someone from the group requires the real number; access to it is restricted to your own account and to internal server-side routines.
• Members WhatsApp group — legal basis: performance of the subscription contract.
• Members WhatsApp group — retention and removal: the number is kept while your account exists or until you unlink it. To remove it, use the unlink button on the /whatsapp/membros page or delete your account. WhatsApp also applies its own terms and policies to the group and the messages exchanged in it.
• Members invitation and updates via WhatsApp — data: the phone number you provided at subscription checkout and your first name. Purpose: to send, from the official Overclock number on the WhatsApp API, the invitation to the members group and member updates and offers, such as immersions and events. Legal basis: legitimate interest, tied to the subscription benefit. We store only a non-reversible code of the number, to avoid sending twice and to respect your refusal. To stop receiving these, tap "Não quero receber" in the message itself or write to [email protected].
• Invitation for former subscribers via WhatsApp. Data: the phone number you provided at subscription checkout, your first name and the fact that your subscription ended. Purpose: to send, from the official Overclock number on the WhatsApp API, a message inviting you to come back. Legal basis: legitimate interest, based on the relationship you already had with Overclock. We store only a non-reversible code of the number, to avoid sending twice and to respect your refusal. To stop receiving these, tap "Não quero receber" in the message itself (opting out takes effect immediately, in 1 tap) or write to [email protected].
• Reminder of an unfinished subscription via WhatsApp. Data: your name and the WhatsApp number you gave during onboarding, stored in ActiveCampaign, our CRM provider, and linked by email to the subscription you started and did not complete at checkout. Source of the phone number: the onboarding form, not the checkout. Purpose: to remind you the subscription was left halfway and help you finish it. Legal basis: preliminary procedures related to the contract you started and legitimate interest. We store only a non-reversible code of the number, to avoid sending twice and to respect your refusal. To stop receiving these, tap "Não quero receber" in the message itself (opting out takes effect immediately, in 1 tap) or write to [email protected].
• Welcome call (subscription bonus). Data: the day and time you choose for the 30-minute call, the WhatsApp number you confirm, so the team can send you the link or reach you if needed (the screen comes filled with the phone number you gave at checkout or, without it, the number verified in the members group, and you can change it), your answers to the quick questionnaire shown when you book (level with AI and code, main goal and biggest difficulty) and the optional message you write for the specialist, linked to your account. When you book, the team that runs the calls receives, in a private channel of the community Discord, a message with your account name and email, that WhatsApp number, your plan, the booked time, those answers and your message. Do not write passwords, API keys or client data in the message: the screen and the server reject text that looks like a key. We also create the call event in the Google Calendar (Google Workspace) of the team, with a Google Meet link: your name, your email, that WhatsApp number, your plan, the questionnaire answers and your message go to Google Calendar to create the invite and the call link, and the invite with the link arrives at your account email. If Google does not create the link, the team sends it over the WhatsApp number you confirmed. In this processing Google acts as a processor, on our behalf and following our instructions.
• Welcome call. Purpose: organize and prepare the call (your answers tell the specialist where you are), run it and send you the link (through the email invite or, if it does not go out, over WhatsApp). Legal basis: performance of the subscription contract.
• Welcome call. Retention and removal: the booking is kept while your account exists, and deleting the account deletes the booking. Messages in the moderation channel are deleted within 90 days after the call. The event in Google Calendar stays in the calendar of the team and is deleted if you ask, at [email protected]. The call cannot be rescheduled: if you miss it, it does not come back. To cancel, write to [email protected].

Experimental features, waitlists, overLabs, and forms may collect additional data you provide voluntarily.

• Data: email, phone number provided, Discord name, YouTube name, open-ended answers, experimental focus, application status, and risk acceptance, sent to a CRM provider when you apply.
• Purpose: select participants, run tests, understand usage profile, get in touch, unlock access, and improve experimental features.
• Legal basis: pre-contractual steps related to a contract, legitimate interest in product improvement, and consent when the collection is optional.
• In-person immersion tickets (such as Escale seu SaaS at /escale) — data: the name, email, and WhatsApp number you enter in the form before payment, the date and time you sent it, and the campaign parameters of the visit (utm, gclid, fbclid). The same data goes to the Guru checkout, where the purchase happens.
• In-person immersion tickets — purpose: if the purchase is not completed, our sales team may contact you by WhatsApp or email to help you finish buying the ticket; and to measure which campaign the interest came from. Legal basis: pre-contractual steps related to the contract you started, and legitimate interest.
• In-person immersion tickets — retention and objection: we keep this data until 30 days after the event ends and then delete it. To stop being contacted or to ask for deletion earlier, reply to the message itself asking us to stop or write to [email protected].
• Online immersions (such as Vibe Coding do Zero at /vibe-coding-do-zero). Data: the name, email, and WhatsApp number you enter in the form before payment and the campaign parameters of the visit (utm, gclid, fbclid). For the subscription, the site also keeps the plan you chose, the first plan you picked, and the date and time you sent it, and payment happens afterwards, in the subscription checkout, with your account. For the standalone ticket, the site neither asks for nor receives this data: you enter it directly in the Guru checkout, where the purchase happens and where it is recorded; the site only passes the campaign parameters of the visit to Guru.
• Online immersions. Purpose: if the subscription or ticket purchase is not completed, our team may contact you by WhatsApp or email to help you finish it and answer questions about the immersion; and to measure which campaign the interest came from. Legal basis: preliminary procedures related to the contract you started and legitimate interest.
• Online immersions. Retention and objection: what the site keeps (for the subscription) stays until 30 days after the immersion date and is then deleted; standalone ticket data stays at Guru for as long as the purchase requires. To stop being contacted or to ask for deletion, reply to the message asking us to stop or write to [email protected].
• Store waitlist (at /loja) — data: the email, the WhatsApp number, the size and your answer on what you would pay, all entered in the form. Purpose: to tell you when the piece goes on sale, to size the batch per size and to set the price of the drop. Answering what you would pay is research and does not grant you that price. Legal basis: your consent, given by ticking the box before you submit. Retention: up to 30 days after the drop ends, then deleted. To leave the list or ask for deletion before that, write to [email protected].

When you request support, report an error, access pages, or interact with protected flows, we may process technical information proportional to resolving the issue, protecting the platform, and complying with legal obligations.

• Data: support messages, error descriptions, screenshots you send, masked logs, technical events, reports, abuse records, and security metadata.
• IP and user-agent: may appear in infrastructure or security logs. For acceptance evidence controlled by Overclock, we prefer ip_hash and user_agent_hash instead of raw IP or full user-agent.
• Error monitoring: when Sentry or an equivalent tool is active, we may send minimized error events, stack traces, and technical metadata for diagnostics, without sending cookies, authentication headers, request bodies, email, user ID, or IP, by intentional configuration.
• Purpose: support, auditing, security, fraud prevention, rate limiting, incident investigation, defense of rights, and compliance with legal obligations.
• Legal basis: legitimate interest, performance of a contract, compliance with a legal obligation, and regular exercise of rights.

We use cookies and local storage necessary for authentication, security, login redirection, handoff with the desktop app, consent preferences, and basic site operation.

Optional analytics, affiliate, advertising, or attribution scripts, such as Google Analytics, FirstPromoter, and the OpenAI advertising pixel, only load after you accept the cookie banner. If you decline, the site keeps working, but analytics metrics, referrals, and commercial attribution may not be recorded. The exception is paid campaign pages (currently /boost, /offers, /vibe-coding-do-zero, and /escale): there, the Meta advertising pixel loads when the page opens, to measure whether the ad brought the visit and the start of the purchase.

• Session and authentication: Supabase/Auth session storage/cookies or equivalents, necessary for login and security.
• Temporary redirection: cookies such as auth_next, desktop, desktop_qa, desktop_dev, desktop_state, and desktop_flow may be used for a few minutes to complete login, callback, and handoff with the desktop app.
• Consent preference: overclock:cookie-consent:v1 records in the browser whether you accepted or declined optional scripts.
• Analytics: _ga and _ga_* may be used by Google Analytics after acceptance to measure aggregate site usage.
• Affiliates and attribution: overclock:fpr, overclock:fpr-param, and overclock:fpr-test-mode may be used after acceptance to preserve referral codes; the attribution provider may also use its own cookies.
• Advertising: the OpenAI advertising pixel may load after acceptance to measure visits, registrations, checkout starts, and purchases coming from campaigns; the provider may use its own cookies. These events only send the signal that the action happened and, for purchases, the transaction amount and currency — never a name, email, account identifier, tax ID, or payment data.
• Meta ads (Facebook and Instagram): on the rest of the site, the Meta advertising pixel only loads after acceptance. On paid campaign pages (/boost, /offers, /vibe-coding-do-zero, and /escale), it loads when the page opens to measure visits, checkout starts, and purchases coming from those ads. The site sends the action marker and, for a purchase, the amount and currency. If you fill in a form on those pages, the pixel may also send Meta, encrypted (hashed), data you typed, such as name, email, and phone number, to match the visit to the ad. Meta may use its own cookies, such as _fbp, and technical browser data, under its own policy. To avoid being measured, use the tracking protection in your browser or a blocker, and adjust your ad preferences at Meta.
• Media attribution: first-party cookies oc_gclid, oc_touch, and oc_touch_last store technical ad-click identifiers (gclid/fbclid), utm parameters, landing page, and referrer, with no personal data. On purchase, these identifiers and the pseudonymous analytics identifier may be linked to the transaction to measure which campaign drove the sale.
• Legal basis: performance of a contract or legitimate interest for necessary cookies; consent for optional affiliate, analytics, or marketing cookies; and legitimate interest to measure, on paid campaign pages, whether the ad brought the visit and the purchase.

To protect you, your clients, and the community, do not send data that isn't necessary for support or participation.

• API keys, bearer tokens, refresh tokens, passwords, cookies, .env files, secrets, private keys, and signed URLs.
• Database dumps, full logs, OAuth callbacks, unmasked screenshots, or confidential client data.
• Sensitive personal data, financial data, documents, health data, or data belonging to children/teenagers.
• Material protected by NDA, contract, trade secret, copyright, or professional confidentiality without authorization.

• Perform a contract and deliver account, subscription, benefits, downloads, licenses, Discord roles, and contracted features.
• Comply with legal, tax, accounting, regulatory, and rights-defense obligations.
• Protect the platform, prevent fraud, abuse, improper chargebacks, incidents, malicious use, and security violations.
• Respond to support, reports, privacy requests, and the exercise of data subject rights.
• Operate the community, moderation, overLabs, participant selection, and experimental features.
• Send necessary communications about account, billing, security, terms, privacy, and relevant changes.

We may share data with vendors necessary to operate the platform, always proportionally to the purpose.

• Supabase/Auth/database for authentication, account, and operational storage.
• Guru (Digital Manager Guru) for checkout, billing, and ticket delivery of in-person and online immersions.
• Stripe or an equivalent processor for checkout, billing, subscription, taxes, and fraud prevention.
• Discord for community, OAuth, identification, and role syncing when you connect your account.
• Google Calendar and Google Meet (Google Workspace), as a processor, to create the welcome call event and link and send the invite by email, with your name, email, WhatsApp number, plan, questionnaire answers and message.
• WhatsApp (Meta), through the official WhatsApp Business API and the automation service used by the Overclock number, to verify your number, administer the members WhatsApp group, and send the members invitation and updates, the invitation for former subscribers and the unfinished-subscription reminder.
• ActiveCampaign or an equivalent CRM to receive overLabs form submissions, organize participant selection, store the contact and WhatsApp number given during onboarding, and related operational communications.
• Google OAuth for login/sign-up when you choose that option.
• Google Analytics for aggregate site usage analysis, only after optional cookie acceptance when configured.
• Cloudflare Turnstile or an equivalent mechanism for abuse protection where applicable.
• FirstPromoter or an equivalent tool for affiliates/attribution, only when the feature is active and there is acceptance for optional scripts.
• OpenAI, as an advertising platform, to measure visits and registrations coming from campaigns, only after optional cookie acceptance.
• Sentry or an equivalent tool for error and security monitoring, with minimization and filters to avoid sending PII, cookies, sensitive headers, or request bodies, by intentional configuration.
• AI providers you configure; in that case, your requests also follow those providers' own terms and policies.

Overclock is designed to be local-first. Code, files, prompts, workspace, and terminal should not leave your machine to reach Overclock, except when a feature, support request, integration, or your own action requires sending it.

When you use an AI provider you configured, the request may be sent to the provider you chose, according to your settings, terms, policies, and keys.

We keep data for as long as necessary to operate the account, perform the contract, deliver benefits, comply with legal obligations, prevent fraud, protect the platform, respond to requests, preserve acceptance evidence, and exercise rights.

Billing data may be retained for the period required by legal, tax, accounting, and rights-defense obligations. Community/moderation data may be kept when necessary for security, investigation, abuse, incidents, or defense. Cookie preferences stay in your browser until you clear local data or we change the consent version.

The phone number linked to the members WhatsApp group is kept while your account exists or until you unlink it on the /whatsapp/membros page; deleting your account also deletes the link.

The name, email, and WhatsApp number entered in the ticket form of an in-person immersion are kept until 30 days after the event ends.

You may request confirmation of processing, access, correction, portability where applicable, deletion, information about sharing, objection, and other rights under the LGPD, through the [email protected] channel.

Some requests may depend on identity verification and may be limited by legal obligations, fraud prevention, security, defense of rights, or proportional technical impossibility.

We adopt reasonable security and minimization measures, including a preference for technical hashes for acceptance evidence instead of raw IP and full user-agent.

If we identify a security incident involving personal data under Overclock's responsibility, we will assess the risk, adopt appropriate measures, and make the communications required by applicable law.

This Policy may change to reflect changes in the product, vendors, legal obligations, or security practices. Material changes may require new acceptance or a highlighted notice.

This Policy was originally written in Portuguese and translated into English for convenience. In case of any conflict, ambiguity, or divergence between the Portuguese and English versions, the Portuguese version prevails.