Privacy policy

• Your account: your email address, your password (stored only as a one-way scrypt hash, never readable), and when you agreed to this policy.
• Your documents: the policy wording, rejection letter and any medical document you upload. The file itself is read once and discarded. We keep its text, split into passages; a numeric search index of each passage; the file name and page count; and the key terms read from it (insurer, claim and policy numbers, amounts, dates, the stated reason). These usually include health information such as a diagnosis or treatment.
• Your conversation: your questions, your answers to Overturn's questions (for example, when your cover started), and its replies, verdicts and citations.
• Usage: how many questions you asked and how much model output they used each day, to enforce the daily limits.
• Security records: your IP address when you sign in, sign up, export your data or delete your account, and request counters used to stop password guessing.

Only to check whether your claim rejection holds up, draft your appeal, keep your account working, and keep the service safe from abuse. We don't sell or share your data for advertising, don't build profiles, and don't use it to train our own models.

• Google (Gemini API) reads your documents and messages to produce each answer. Overturn currently runs on Google's free tier, under which Google may use what is sent to improve its products, and human reviewers may read it. Until that changes, treat Overturn as a demo: use the sample documents, not your own.
• Neon hosts the database, in Singapore. It is encrypted on disk (AES-256) and only accepts encrypted connections.
• Vercel runs the app, in Singapore, over HTTPS only.
• Cloudflare Turnstile checks that sign-ins and sign-ups come from a person, using your IP address and browser signals.

So your data is stored and processed outside India, which the DPDP Act permits except to countries the Government restricts.

• Everything travels over HTTPS, and the database refuses unencrypted connections.
• Your messages, verdicts, case titles, file names and key terms are encrypted again (AES-256-GCM) before they reach the database, with a key the database never holds. The document passages themselves are protected by the database's disk encryption, because they have to be searchable.
• Every query is scoped to your account; no one else's request can reach your cases.
• Uploads are checked and refused if they carry scripts or attached files, and the original file is never stored.
• Sign-in is rate-limited and protected by a bot check.

Until you delete it. Deleting a document or a case removes it immediately; deleting your account removes the account and everything in it immediately. Unused empty draft cases are removed automatically. Security records (the event, time, IP address and account ID) are kept for one year to investigate misuse, as the DPDP Rules require, then deleted. The database provider keeps a short rolling restore history, after which deleted data is gone from it too.

• See and take your data: Your data downloads everything as a file; each case can be saved as a PDF.
• Correct it: delete a document and upload the right one, or write to us.
• Erase it, and withdraw consent: delete a case, or delete your account from Your data. Withdrawing is as easy as agreeing was.
• Nominate someone to exercise these rights if you die or can't: write to us with their details.
• Complain: write to the contact address in the project README. We reply within 90 days. If you're not satisfied, you can complain to the Data Protection Board of India.

If a breach affects your data, we'll tell you and the Data Protection Board without delay: what happened, what it means for you, what we're doing about it, and what you can do, followed by a full report to the Board within 72 hours.

Overturn is for adults (18 and over). If a claim concerns your child or another family member, you upload it as the policyholder, and you confirm you're entitled to share their information.

One: a sign-in cookie that keeps you logged in for up to seven days. Scripts can't read it, and it's only sent over HTTPS. No analytics or advertising cookies.

If this policy changes what we collect or who processes it, the version above changes and we'll ask you to agree again.