Draft for legal review before public launch. Details in [brackets] are still to be filled in.

Privacy policy

Version 2026-11-10, 11 November 2026.

This policy explains what personal data Overheard holds about you, why, who else handles it, how long we keep it, and your rights. Overheard is listening practice for adults with YouTube videos.

1. Who we are

Abyl Applications Limited (registered in England and Wales, company number 09519157) runs Overheard and is the controller of your personal data. Address: Taudinn, Tunstall, Richmond, North Yorkshire, DL10 7QL, United Kingdom. Email: hello@overheard.it.com. We’re registered with the UK Information Commissioner’s Office: [ICO registration number].

2. Adults only

Overheard is for people aged 18 and over. You confirm your age when you sign up; we don’t ask for your date of birth. We don’t knowingly hold data about anyone under 18, and we delete it if we find it.

3. What we hold, why, and our legal basis

Your account

  • Your email address and how you sign in (Google, an emailed link, or a password). If you set a password, Google’s sign-in service stores it in scrambled (hashed) form; we never see it.
  • Your display name, the languages you’re learning, your level, and settings such as playback speed.
  • The date you confirmed you’re 18 or over, which version of our terms you accepted and when, and whether you’re in or on the waiting list.

Why: to run your account. Basis: our contract with you. The age and terms records are also kept to show we checked (legitimate interests).

Your learning

  • The sections you practise, your answers and scores, playback speed and rewinds, and which videos you’re part-way through.
  • Words you save or mark as known, and when each saved word is next due for practice.
  • Favourites, how many practice sessions you’ve used this week, and questions you report to us.
  • Homework your teacher sets you, if you link to one.

Why: to give you the service and show your progress. Basis: contract. We also look at answers and reports across all users, without identifying anyone, to improve questions (legitimate interests).

Plans and payments

  • Your plan, its status and dates, and any free months you were given.
  • If you joined through a teacher’s or creator’s link or code: which one, and when. We use it to pay them a share of what you pay us. They never see your name or email through it.
  • For each payment: the amount, VAT, fees and refunds, so we can pay that commission and keep our accounts. Your card details are held by our payment provider, never by us.

Why: to provide Plus and pay partners. Basis: contract, and our legal obligation to keep financial records.

If you’re a teacher or a creator partner

  • Your name as shown to others, your links and codes, your commission rate, when you accepted your terms, and the commission and payouts we’ve recorded.
  • We don’t hold your bank details: we pay through Wise or PayPal, who hold them.

Basis: our contract with you, and our legal obligation to keep financial records.

When you contact us

  • Requests about your data (with the date we got them and how we answered), and creator opt-out requests (channel, name, email and message).

Basis: our legal obligations, and legitimate interests (honouring creators’ wishes).

Technical data

Our servers log requests (including IP addresses) to keep Overheard secure and working. Basis: legitimate interests. These logs are deleted after 30 days.

We don’t sell your data, show you adverts, use advertising or tracking cookies, or make decisions about you by automated means that have legal or similarly significant effects.

4. Teachers

You can link your account to a teacher, through their link or code, or in Settings. Before you link, we show you what they’ll see, and they only see it if you choose to share. While you share, your teacher sees: your display name (not your email address), whether you finished the homework they set, your section scores (your first attempt at each), the questions you missed (so they can replay those moments), words you saved in the past week and how many you know, and when you last practised and your listening minutes.

They never see your email address, your plan, payments or billing details, or your account settings. You can stop sharing any time in Settings: from then on your teacher sees none of your learning. We keep the record that you joined through them (with no learning data) because it decides who is paid commission.

Your teacher is responsible for how they use what they see; our teacher terms require them to keep it confidential and use it only to teach you.

5. Who else handles your data

  • Google (Google Cloud and Firebase): hosting, sign-in (including sending sign-in and password emails), our database, files and logs. Our database is in London (europe-west2). Google may handle sign-in data in other countries, including the US.
  • Google’s Gemini API: we use it to write questions, transcribe and translate lines, and voice example sentences, from public videos and our own text. We don’t send it your personal data.
  • YouTube: Overheard uses YouTube API Services. Videos play in YouTube’s embedded player, and video pictures (thumbnails) load from YouTube, so YouTube receives your IP address and its own cookies when they load, under the YouTube Terms of Service and the Google Privacy Policy. We get video details (title, channel, length) from YouTube’s Data API and refresh or delete them within 30 days. We send no information about you to the Data API.
  • Our payment provider (Stripe, once payments are switched on): takes payments and holds your card details, under its own privacy policy.
  • Wise or PayPal: pay teachers and creator partners.
  • Professional advisers (such as accountants and lawyers), and authorities where the law requires it.

Where your data goes outside the UK, it’s protected by the safeguards UK law requires, such as the UK’s approved contract clauses or adequacy decisions. Ask us for details.

6. How long we keep it

  • Your account and learning data: until you delete your account. Deletion removes them straight away, and always within 7 days.
  • Payment and commission records: six years, as UK tax law requires. They’re kept against an internal ID, not your name or email, and stay after you delete your account.
  • Invitations: until used, then 12 months. Requests about your data: three years after we answer. Creator opt-outs: for as long as the opt-out applies.
  • Server logs: 30 days.

Deleting your Overheard account doesn’t affect anything YouTube or Google hold about you as a YouTube or Google user. Manage that in your Google account.

7. Cookies and storage on your device

We don’t use cookies of our own. We use your browser’s storage only for things Overheard needs:

  • keeping you signed in (Google’s sign-in service);
  • your email address while you finish signing in with an emailed link;
  • a teacher’s or creator’s code from their link, for up to 30 days until you sign up;
  • the speed you chose for example sentences.

YouTube’s player and thumbnails set YouTube’s own cookies when they load. See the Google Privacy Policy.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. You can download your data or delete your account yourself in Settings. For anything else, use “Other requests about your data” in Settings or email hello@overheard.it.com. We log every request with its date and reply within one month.

If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office.

9. Security

Your data is held in Google Cloud, encrypted in storage and in transit. Only our servers read the database; your browser never does directly. Access is limited to the people who run Overheard.

10. Changes

If we change how we use your data, we’ll update this policy and ask you to accept the new version when you next sign in. The version and date are at the top of this page.