The short version
Three things put data in our hands: you send us a brief through the contact form, you subscribe to the journal newsletter, or you simply load a page. That is it. There are no advertising cookies on this site, no cross-site tracking, no data brokers, and nothing is ever sold or rented. Email hello@overcastly.com and we will tell you what we hold or delete it.
Who we are
This site is operated by Overcastly LLC, a studio based in Birmingham, AL, United States. For anything in this policy — questions, requests, complaints — write to hello@overcastly.com. A person reads that inbox.
What we collect
Contact form
When you submit the form on the contact page, we receive what you typed and selected: your name, your company (optional), your email address, your brief, and the topic, budget, and timing options you picked. That submission is delivered to us as an email through Mailgun, our email provider, and lands in the studio inbox. We use it to answer you and to scope the work you are asking about. We do not add you to a marketing list because you filled out this form.
Spam protection
The contact form is protected by Cloudflare Turnstile. When you submit, your browser completes a challenge and we send the resulting token to Cloudflare to confirm you are not a bot. Cloudflare processes technical signals from your browser (including your IP address) for that check, and may store a short-lived functional token in your browser to run it. Turnstile is used for abuse prevention only — it is not an advertising or profiling tool.
Journal newsletter
If you subscribe on the journal page, your email address is stored with Mailgun on a mailing list and used for one thing: sending you the journal notes. Every email has an unsubscribe link, and unsubscribing removes you from the list. We do not share the list with anyone.
Analytics and performance
We use Vercel Web Analytics and Vercel Speed Insights to see which pages get read and whether the site is fast. Both are cookieless: they do not set tracking cookies, do not build a profile of you, and cannot follow you to other sites. What we get back is aggregated — page views, referrers, rough country, device class, and page-load timings. We cannot use it to identify you.
Server logs
The site is hosted on Vercel. Like any web host, Vercel processes standard request data — IP address, user agent, the URL requested, and a timestamp — in order to serve pages and protect the site from abuse.
Cookies
We do not use advertising cookies, analytics cookies, or any cross-site tracking. The only browser storage this site may involve is functional: the short-lived token Cloudflare Turnstile uses to run the anti-spam challenge on the contact page. There is no cookie banner because there is nothing to consent to.
Who else touches your data
We keep the list of third parties as short as we can. Each of these processes data on our behalf, under their own terms:
- Mailgun — delivers contact-form submissions to us and sends the journal newsletter; stores newsletter subscriber addresses.
- Cloudflare — runs the Turnstile anti-spam check on the contact form.
- Vercel — hosts the site, serves the pages, and provides the cookieless analytics and performance measurements described above.
We do not sell your personal data, we do not rent it, and we do not share it with advertisers or data brokers. The only other situation in which we would hand anything over is a valid legal obligation.
How long we keep it
Contact-form emails stay in our inbox while the conversation is live and for a reasonable period afterwards as an ordinary business record. Newsletter addresses are kept until you unsubscribe or ask us to remove you, after which they are deleted from the list. Analytics data is aggregated and is not tied to you. If you would rather we did not keep any of it, say so and we will delete it.
Your rights
This site is read in the United States and in the European Union. Wherever you are, you can ask us to:
- Access — tell you what personal data we hold about you.
- Correct — fix anything that is wrong or out of date.
- Delete — erase what we hold, subject to any records we are legally required to keep.
- Object or restrict — stop us using your data for a given purpose.
- Withdraw consent — leave the newsletter at any time, via the unsubscribe link or by email.
Send the request to hello@overcastly.com. We will respond within a month. There is no fee and no form to fill in. If you are in the EU or the UK and you think we have handled your data badly, you also have the right to complain to your local data protection authority.
Security and transfers
The site is served over HTTPS, and submissions are encrypted in transit. Because we are a US studio using US-based providers, data you send us is processed in the United States. No method of transmission or storage is perfectly secure, and we do not claim otherwise — we simply keep the amount of data we hold small enough that there is little to lose.
Children
This is a business-to-business site. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us something, email us and we will delete it.
Changes to this policy
If we change what we collect or which providers we use, we will update this page and move the effective date at the top. There is no version history to dig through — the current page is the whole policy.
Contact
Questions, deletion requests, or anything else about this policy: hello@overcastly.com, or use the contact form.