Privacy Notice

Last updated: 21 October 2026

This notice explains how OverBox s.r.o. (“we”, “us”) processes personal data collected through the Enuva early-access waitlist at enuva.app and through the Enuva iOS app. Where the two differ, each section says so. It applies to everyone who uses them. We are based in Slovakia and follow the General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 on Personal Data Protection; the rights in section 6 are the ones the GDPR gives EU/EEA residents, and we apply them to everyone.

1. Controller

OverBox s.r.o.
Slovakia
Company ID (IČO): 53938461
VAT ID (IČ DPH): SK2121532721
Contact: hello@enuva.app

2. What data we collect and why

When you join the waitlist we collect:

• Email address — to confirm your signup and contact you when your early-access spot opens. This is the primary purpose.
• Hear-from answer (optional) — the option you select on the waitlist form, if you choose to answer it, so we can understand where people find Enuva.
• Where the visit came from (optional) — campaign or referrer information such as UTM source and medium, when it is available. This is not stored on your waitlist record; it goes to our analytics as part of the signup event described in section 3.
• Consent timestamp and version — to demonstrate that you gave valid informed consent (GDPR Art. 7(1)).

Lawful basis: consent (GDPR Art. 6(1)(a)). You give consent by ticking the checkbox on the form. Your email is used only for Enuva early access contact. If you provide a hear-from answer, we use it only for audience attribution — not for newsletters, advertising, or third-party offers.

When you use the Enuva app we collect:

• An account — created for you automatically when you first open the app. It holds no name or email, but it is pseudonymous, not anonymous: it ties together your settings, your feedback and your usage, so it still counts as personal data. If you choose Sign in with Apple, we also receive the email address Apple gives us (which may be Apple’s private relay address) and the name you approve, so your account works across devices and we can recognise you as an early-access participant.
• Your settings — country, language and the sources you follow, because there is nothing to generate without them. Your time zone is read from the phone so briefings arrive at a sensible hour, and updated when it changes.
• What you type when adding a source — if you search for a publication by name, we look it up in public reference databases run by the Wikimedia Foundation, which never sees your IP address. We record that an attempt happened, not what you typed.
• Your feedback — the “more like this” and “less like this” ratings you give on briefings and segments, and what topics they imply, to steer what you get next. There is no free-text field.
• Story skip activity, once switched on — when you skip a story before its halfway point, we record which story it was, when, how far into it you were and which subjects it covered, as a gentle “less like this”. These records are linked to your account across devices and kept apart from your ratings and from beta measurement. They are not sent to PostHog.
• A device identifier — a random identifier held on your device and sent with each request, so we can apply per-device limits. It is not an advertising identifier, and it goes no further than the providers in section 4.
• Push token — the address iOS gives us for your device, stored with a flag recording whether you allowed alerts. It is registered when the app starts, so we hold one even if you refuse; nothing is ever sent to it unless you allowed alerts.
• Usage and cost records — counts, durations and costs of the AI and speech requests your briefings need, to keep the service affordable. These contain no article or script text.
• Fault reports — sent when the app crashes or a briefing fails, with user and device identifiers stripped before they leave your phone. Our servers send their own fault reports to the same provider.
• Beta measurement (beta accounts only) — a random analytics identifier, usage events, and account-linked playback and personalization evidence, as described in section 3.

Lawful basis, by purpose: your account, your settings and the sources you follow are processed to deliver the service you asked for, which is our agreement with you under Art. 6(1)(b) — without them there is nothing to generate. Your feedback is optional: skipping it does not stop Enuva working, it only leaves your briefings less tailored to you, and we rely on the same basis for it because tailoring is what you signed up for. Once story skip activity is switched on, we use it under the same basis, to choose what goes into your future briefings. Push notifications are optional: sending you one rests on your consent (Art. 6(1)(a)) — the iOS permission prompt is where you give it, and you can withdraw it in iOS Settings. Holding the token itself, including the flag that records a refusal, rests on our legitimate interest (Art. 6(1)(f)) in knowing which devices to leave alone. The device identifier, the usage and cost records and the fault reports rest on our legitimate interest (Art. 6(1)(f)) in keeping the service working, affordable and debuggable; refusing them is not possible while using the app, which is why we keep them minimal and free of content. The purpose and lawful basis for beta measurement are described in section 3.

When your briefing is built, the publishers you follow see your device’s IP address and browser details, as they would if you visited them yourself. They are not our processors, and we tell them nothing about you. Article text and the summaries made from it pass through our AI provider, and the briefing you keep lives on your device rather than on our servers. The text to be spoken goes to our speech provider, and the audio is stored briefly before it reaches you.

3. Analytics

Website. We use PostHog (EU region) to count privacy-preserving usage events (e.g. a custom landing_page_viewed event, referral/UTM source, “form submitted” and “form completed”). PostHog is configured with no cookies, no localStorage, and project-side IP discard. Automatic pageview capture is disabled. We use site and environment labels to keep production reports separate from development and preview visits. Full URL and full referrer values are stripped before events are sent. In this cookieless mode PostHog does not store anything in your browser; instead its servers derive an identifier by hashing a salt that rotates daily together with technical signals of the request. Visits from the same browser can therefore be counted together within one day, and the link breaks when the salt rotates. Session recording is disabled. We do not send your email address, your name, or the full URL of the page you are on. We do send the path, the hear-from answer if you gave one, and where the visit came from.

Lawful basis: our legitimate interest (GDPR Art. 6(1)(f)) in knowing whether the site works and where our audience comes from. We rely on it because the measurement is cookieless, its identifier lasts a day at most, and it cannot be tied back to you. You can object to it (Art. 21). Because the measurement holds nothing that identifies you, we cannot exclude one browser on request — blocking eu.i.posthog.com, or using a browser or extension that blocks analytics, stops the measurement your browser sends. One event is sent from our server rather than your browser: when a new waitlist record is created we record that it happened, with the answer you gave and where the visit came from, and blocking cannot prevent that one. This event has its own random identifier and is not linked to your browser's identifier. Browser form-completion counts also include repeat submissions; the separate server count includes only new waitlist records.

Internal and closed beta app. For every beta (TestFlight) account, analytics is enabled by default, without an in-app analytics switch. It helps us evaluate the beta: whether people return to listen, how much of a briefing they hear, which player view they use, and whether source controls and personalization work for them. Collection is limited to the enrollment period. The app rechecks eligibility; removing an account from measurement takes effect there within at most 15 minutes. This measurement does not automatically extend to public users. To object, contact hello@enuva.app; once you object, your account stays excluded from beta measurement until it is deleted. We may need information to identify your account before we can check or act on the request. For Apple-linked accounts, “Request data export” in Account & data prepares an email containing your Account ID.

We send PostHog screen visits and active time, Player or Spine selections, playback actions and short listening totals, and categories of source and feedback actions and their outcomes. These events also include the app version and build, environment and beta channel, a timestamp, and random event and source-attempt identifiers. PostHog is configured to discard IP addresses, and app events disable IP-based location enrichment. A random identifier stored on the phone connects these events across visits; it is replaced when the app account changes. This is pseudonymous data, not anonymous data. We do not send PostHog your account or device identifier, email, selected source or topic names, article or transcript text, submitted URLs, or search text. Screen recording and automatic interaction capture are disabled. The app does not track you across other companies’ apps or websites.

Separately, our Supabase database holds beta enrollment and account-linked playback records: episode and version identifiers, actual listening time, played ranges and natural endings. It also holds records of successful feedback and source changes: their identifiers, kind and time, and a fingerprint of the selected source list where applicable. For each recorded briefing version, we keep its identifier, availability and generation timestamps, duration and essential-listening boundary, generation method and reason, whether the evidence came from the app or server, and identifiers of the changes it used. These measurement records contain no article or transcript text or source names. These let us count returning testers and listening coverage without sending account identities to PostHog. Retention for the two stores differs, as described in section 5.

Lawful basis for beta measurement: our legitimate interest (GDPR Art. 6(1)(f)) in evaluating and improving the limited beta. Measurement is restricted to beta accounts and the categories above. Your right to object and our contact details are in section 6.

4. Processors and international transfers

We use the following sub-processors for the website:

• Cloudflare, Inc. (USA) — web hosting, CDN, and Turnstile CAPTCHA. Data processed under Cloudflare’s Standard Contractual Clauses (SCCs). Turnstile processes limited technical signals to detect bots and abuse. We do not use Turnstile for advertising or behavioural profiling.
• Supabase, Inc. — email database. We use the EU (Ireland) region, so the database itself is in the EU. Supabase may still involve support or sub-processors elsewhere under its data processing terms, so we do not claim that every operation happens inside the EU.
• PostHog, Inc. — usage analytics for the website, with no browser identifier that persists past the day. We use the EU (Frankfurt) region at eu.i.posthog.com. We do not send waitlist email addresses to PostHog (see section 3).
• Plus Five Five, Inc. (Resend) (USA) — delivery of the transactional email confirming a new waitlist signup. Resend receives the recipient address and email content and processes them primarily in the USA. The transfer is covered by Resend’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses. We do not add waitlist addresses to Resend marketing contacts and do not request open or click tracking for this message.

The app additionally uses:

• PostHog, Inc. — pseudonymous product usage for internal and closed beta accounts, in the EU (Frankfurt) region. This uses the app identifier described in section 3, separately from the website’s daily browser identifier.
• Supabase, Inc. — accounts, settings, feedback and usage records, including the account-linked beta measurement described in section 3. The same EU (Ireland) project as the waitlist above.
• Cloudflare, Inc. (USA) — Turnstile bot and abuse prevention when a guest account is created, plus generation of your audio and its short-lived private storage, under SCCs. Turnstile receives the request IP address, browser and device properties, challenge outcome, and timing and abuse signals. We use these signals only to protect account creation, not for advertising or behavioural profiling, and we do not set how long Cloudflare keeps them. Audio is stored in a European location, which Cloudflare treats as a preference rather than a guarantee, so we do not claim EU-only storage for audio.
• OpenAI (USA) — turns article text into the text of your briefing, under Standard Contractual Clauses. We ask it not to store requests; it may still keep their content for a limited period under its own terms, currently up to 30 days, to detect abuse. It does not use API content to train its models.
• ElevenLabs (USA) — turns scripts into speech, under Standard Contractual Clauses. It may keep the text and audio for a limited period under its own terms; it does not use them to train its models.
• Functional Software, Inc. (Sentry) (USA) — fault reports, under Standard Contractual Clauses, with user and device identifiers removed before sending.

Apple delivers the notifications you turn on and handles Sign in with Apple. For those, Apple decides on its own account how it processes the data, so it acts as an independent controller rather than as our processor; Apple’s own privacy policy governs it.

Each provider in the two lists above processes data for us under its own data processing terms, which form the Art. 28 arrangement between us. Ask us at hello@enuva.app for the position on any one of them, or for a copy of a transfer safeguard.

One image in the homepage footer is loaded from ElevenLabs’ content network, so opening the page tells them your IP address and browser, as any image loaded from another site would. We are moving it onto our own domain.

No data is sold or shared with advertisers.

5. Retention

We keep your email until whichever of the following happens first:

• You withdraw your consent (see section 7).
• Enuva launches publicly and we migrate active waitlist contacts to the production email service with a fresh consent flow.
• 18 months have passed since you joined and Enuva has not launched.

In the app:

• First-party beta measurement — detailed playback, personalization evidence and tester linkage are retained for 180 days, then removed by scheduled hourly cleanup, or earlier when the account is deleted. If you object, we keep a record that your account is excluded, without any measurement, until the account is deleted. Pending records on the phone expire after 24 hours and are cleared on an account change or when collection is disabled.
• Beta events in PostHog — there is currently no enforced time-based deletion period. The analytics identifier is replaced when the app account changes; the app has no control to display or reset it. Changing accounts or deleting an Enuva account does not erase earlier PostHog events. We keep no server-side lookup from accounts to PostHog identifiers, so we cannot locate those events from your account details alone.
• Your account and its settings — until you delete it. A guest account with no activity for 90 days is deleted for you.
• Briefings on your phone — 30 days, apart from the one you are playing. Article text is not kept on your phone at all.
• Story skip activity — used for 90 days from the skip, then left out of new preference calculations and deleted by the next hourly cleanup, or earlier when you delete your account. Copies still waiting on your phone expire after 24 hours and are cleared when the account changes, when it is deleted or when the feature is switched off. The interest weights a briefing was built from can outlive the skips they came from: on our servers they are removed by routine cleanup 24 hours after that briefing finished, or once its date is more than seven days old; on your phone they expire 24 hours after the briefing finished or was last worked on, and are removed at the app’s next cleanup. Account export includes any skip records still held, and account deletion clears both the records and the weights.
• Article text on our servers — 48 hours. Audio in transport storage — 24 hours. What our AI and speech providers keep is in section 4.
• Push token and device identifier — as long as the account; the identifier on your phone stays until you erase the device.
• Fault reports — as long as our error-reporting provider keeps them; ask us for the current setting.
• Usage and cost records — these outlast the account, so the accounting stays whole. They hold no article or script text, with the original account and device links removed during account deletion.

6. Your rights

Under GDPR Arts. 15–22 you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure (“right to be forgotten”) — ask us to delete your data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.

These rights apply as the GDPR grants them, which in some cases attaches conditions — erasure, for example, does not reach records we must keep. We will respond within one month (Art. 12(3)), and will tell you if a request is complex enough to need the extension that article allows.

You have the right to object. Where we rely on our legitimate interest — the website and beta measurement in section 3, and the device identifier, usage records and fault reports in section 2 — you can object at any time under Art. 21, on grounds relating to your situation. Email hello@enuva.app and we will stop unless we can show compelling grounds that override yours.

Account deletion. In Settings → Account & data, choose “Delete account & data”. This starts a resumable deletion request for guest and Apple-linked accounts. The account stays blocked while deletion is pending; the app shows whether cleanup has completed or needs a retry or help from support. After the server confirms deletion, the app clears that account’s local briefings and settings. Deleting the app alone does not submit this server-side deletion request.

For an Apple-linked account, you can reauthorize so Enuva can revoke its Apple credential. If that cannot be completed, Enuva account deletion still proceeds and the app explains how to remove the Apple connection manually. The current account export process requires an Apple-linked account with a confirmed email address; guest users must first use Sign in with Apple to use this process. In Account & data, “Request data export” prepares an email to support containing your Account ID. Support handles the export after ownership verification and sends the copy only to the account’s confirmed email address; it is not an automatic download. You can also contact hello@enuva.app about an access or other rights request, including for a guest account. The retained records in section 5 still apply.

For requests concerning PostHog app events, the identifier limitation in section 5 means we cannot locate the relevant events from your account details alone. Contact hello@enuva.app so we can assess your request and any additional information you can provide.

7. Withdrawing consent

This section is about the waitlist. For the app, see section 6.

Email hello@enuva.app with the subject “Withdraw early access consent”. We will delete your record within one month.

8. Personalization and automated decisions

The app does profile you, in the GDPR’s sense: it works out which topics you are interested in from the sources you pick, the feedback you give and, once it is switched on, the stories you skip early, and uses that to choose what goes into your briefing. That is the product doing what you asked it to.

What it does not do is make a decision about you with legal or similarly significant effects, so the prohibition in GDPR Art. 22 does not apply. We do not profile you for advertising, and we do not sell or share your data. What we store about your interests is a set of weights over subjects and over things in the news — an organisation, a place, a person — which your ratings move up or down and early skips gently move down. It holds no opinions about you and nothing you typed, and we use it only to order your next briefing. Rating something down changes what you get next; it does not undo what was already generated.

9. Right to complain

If you believe we have handled your data unlawfully you can lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava
dataprotection.gov.sk

10. Changes to this notice

If we make material changes we will update the “Last updated” date above and, where required, seek fresh consent. The current version number is stored alongside every waitlist record.

11. How briefings are produced

Briefings are generated by AI from public sources and may contain errors. Verify anything important against the original source.

Public articles are fetched, grouped by story, summarised by a large language model, and read by a synthetic voice. No human editor reviews each briefing before it is published.

Errors can include an article extracted incompletely, two unrelated stories merged into one, a paraphrase that drifts from the source, or an outdated fact repeated. Check the original source, linked from every briefing in the app.