overspill

Privacy Policy

Last updated 28 August 2026

Overspill measures what AI coding tools cost. This policy explains what the hosted service stores, why, and what it deliberately does not store. It is written to be read rather than to be survived — if anything here is unclear, ask and we will fix the wording.

Overspill is operated under the trading name Overspill from the United Kingdom, and is the data controller for the information described below. Contact: privacy@overspill.dev.

The short version

  • Overspill records how much your coding sessions used and cost. It does not record what you wrote or what the model said.
  • Prompts, responses, file contents and tool arguments are discarded by the server before they are read. That is a property of the build, not a setting somebody could get wrong.
  • Your organisation's data lives in a database file used by no other customer.
  • Nothing is sold, shared with third parties, or used to train machine-learning models.

What is stored

Account information

  • The email address of each member, used to sign them in and to attribute usage to them.
  • A display name and a role (member or admin).
  • Sign-in links and browser sessions. Sign-in links are single-use and expire; both are stored hashed rather than in a readable form.
  • One ingest token per machine, so that a lost laptop can be revoked on its own. Tokens are stored hashed and cannot be recovered — only replaced.

Usage measurements, sent by the agent

  • Token counts: input, output, and cache reads and writes.
  • Model names, timestamps, response latency, and stop reasons.
  • Opaque session, message and event identifiers.
  • The names of tools used — for example Bash or Read — whether each one errored, how long it took, and how many bytes it returned. Never what the tool was asked to do.
  • Counts of web searches and page fetches.
  • Cost, calculated from the above.

Context about each session — the part worth reading carefully

Alongside the measurements, each session record carries:

  • the hostname of the machine the agent ran on;
  • the working-directory path of the project — for example /home/you/work/acme-migration;
  • the git branch name;
  • the Claude Code version and how it was launched.

We store these because a cost figure is not much use without knowing which project it belongs to. But a directory path or a branch name can carry meaning — a client's name, an unannounced codename, sometimes a person's name. These are the only fields where text you chose reaches the service, so they are the ones to weigh. If that is a problem for your work, the self-hosted edition keeps everything on your own machines and is free for small teams.

What is never stored

Your prompts. The model's responses. Its reasoning. The contents of your files. Shell commands, tool arguments, or anything else you typed into a tool.

This is enforced twice, and the second time is the one that counts. The agent on your machine defaults to sending measurements only — that is a promise. The hosted server is fixed to accept measurements only, in the build itself, with no setting that widens it — that is the guarantee. The limit is applied to an incoming request before its body is read, so an agent configured to send more does not result in more being stored: the surplus is discarded on arrival rather than kept and filtered later.

Cookies

One, called overspill_session. It identifies your signed-in browser and does nothing else. It cannot be read by scripts, is sent only over HTTPS, and expires after 30 days. There is no analytics, no advertising, and no third-party tracking of any kind.

Where the data lives, and who can reach it

  • One database file per customer, on hardware we operate in the United Kingdom. Not a shared table with a customer column — a separate file, so a query cannot cross from one customer to another even if it is written incorrectly.
  • No third-party processors. No analytics provider, no external database, no cloud vendor holding a copy.

Overspill is run by one person, who necessarily has administrative access to the server it runs on. There is no technical control that prevents that, and it would be dishonest to imply otherwise. What we can say is what the database contains: measurements and the session context described above, and nothing that reveals what you wrote.

How long it is kept

There is no automatic deletion at present. Data is kept until you ask for it to be removed, or the account is closed. Ask, and it is done.

Backups

Backups of the hosted service are not currently guaranteed. Please do not treat Overspill as a system of record. The good news is that this matters less than it normally would: everything here is derived from transcripts that remain on your own machines, so if data were lost it can be re-imported by running overspill backfill again.

Your rights

Under UK data protection law you may ask for a copy of your personal data, ask for it to be corrected or erased, object to or restrict how it is used, and ask for it in a portable form. Write to privacy@overspill.dev and we will respond within one month. If you are unhappy with the response you can complain to the Information Commissioner's Office at ico.org.uk.

On erasure specifically. Every usage record refers to an opaque identifier rather than to your email address, so erasing a person clears the address while leaving historical totals intact — a year of spend figures does not silently change because somebody left the company. If you want the underlying records gone as well, say so, and the account's entire database is deleted.

We process this data to provide the service to your organisation under our agreement with it, and in our legitimate interests in operating and securing it.

Security

The service is served over HTTPS only. Ingest tokens and session identifiers are stored hashed. Each machine has its own token, revocable on its own. The strongest protection is the design itself: there is very little here worth stealing, because the conversations never arrive.

If a breach affects personal data we will tell affected customers, and the Information Commissioner's Office where required, within 72 hours of becoming aware of it.

Changes to this policy

Overspill is currently a free, invite-only preview, and this policy may change as it develops. Material changes will be sent to account admins rather than quietly published.