Overmerge beta · last updated 15 October 2026
What Overmerge connects to, which ports it uses, which files it reads and writes, and how to report a security problem. Overmerge is made by ZAYC LTD, London, United Kingdom. For what happens to your data, see the privacy page.
Email security@overmerge.app with what you found and how to reproduce it. Please give us a chance to fix it before telling others. We answer within a few working days.
Overmerge does not listen on any port: it runs no server, in the browser or on the desktop. The desktop app only makes outgoing connections that you start:
| What | Connects to | Code |
|---|---|---|
| Live telemetry (Live → Connect) |
The host and port you enter: by default localhost:42674, the simulator's
real-time telemetry. Plain TCP, read-only; an optional password if the recorder asks for one.
|
electron/tcp/acmi-client.ts |
| Commander (Research add-on) |
The same host, port 42675, to send commands to a training environment you
run. Only while connected to live telemetry.
|
electron/tcp/cmd-client.ts |
Use these only with simulators on your own computer or network: the telemetry stream is not encrypted.
| When | Request | Code |
|---|---|---|
| Opening the web app | The app's own files from overmerge.app (HTML, scripts, fonts, 3D models). | — |
| You open a recording from a link (Open link, or a share link) | One HTTPS download of that file, from your browser to the site that hosts it. Only https:// links (or files on the same site) are accepted. | src/app/open-url.ts |
| You open About → Third-party notices | The app's own licence notices file: from overmerge.app in the web app, from inside the installed app on desktop (no network). | src/ui/third-party-notices.ts |
| The map or terrain view shows an area (Settings → Map) |
Map and elevation tiles, fetched by your browser. A new install uses Esri satellite
imagery (server.arcgisonline.com) and the AWS open-data terrain tiles
(s3.amazonaws.com); if you choose another provider or enter your own
address and key, tiles come from there instead. The provider sees which area you look
at. The built-in basemap is bundled and needs no network.
|
src/world/tile-source.ts |
| You choose Download for this recording (Settings → Terrain height, desktop app) | Elevation tiles for the open recording's area, from the https:// source shown in the dialog (the AWS open-data terrain tiles unless you change it), into the folder you chose. The dialog says how many tiles first; nothing is fetched until you start it. The source sees which area you asked for. | electron/ipc/main.ts, electron/elevation/download.ts |
| The map or terrain view needs a tile from an online provider (desktop app) | The tile from that provider's https:// address, once; it is kept on this computer and asked for again after 30 days. Offline, the kept copy is used. The provider sees which tiles you load. | electron/ipc/main.ts, electron/tiles/tile-disk-cache.ts |
| You click a link in the app | https links open in your system browser; any other link is refused. | electron/external-links.ts |
Recordings are never uploaded. There are no analytics, crash reports, update checks or licence check-ins today; if any are added, they will be opt-in and listed here first.
The desktop app reads the recordings you open through an internal lcde-file:
address, so they can be streamed to the parser without copying them. It never leaves your
computer and is only allowed for files you chose (electron/main.ts,
electron/file-stream.ts, src/acmi/zip.ts,
src/app/controllers/file-controller.ts).
Terrain heights from a local folder are read the same way, through an internal
lcde-dem: address that serves only the tiles in the folder you chose
(electron/elevation/local-tiles.ts).
Map and elevation tiles from your provider reach the page through an internal
lcde-tiles: address: the desktop app fetches each tile once and serves the
copy it keeps (electron/tiles/tile-disk-cache.ts,
src/world/tile-cache-url.ts).
| File | What and when |
|---|---|
opened-files.json (app data folder) |
The paths of the recordings you opened, so the recent files list can reopen them. |
elevation-folder.json (app data folder) |
The folder you chose for terrain heights, after you choose one. |
tile-cache/ (app data folder) |
Map and elevation tiles from the providers you set, one folder per provider; at most 1 GB, the tiles used longest ago removed first. |
Documents/Overmerge/Live/ |
Each live session, as a recording, written while it streams (BUG-34). Delete them whenever you like. |
| The terrain heights folder you chose |
Elevation tiles ({z}/{x}/{y}.png) and overmerge-elevation.json,
only when you download tiles into it; tiles already there are kept.
|
license.json (app data folder) |
Your licence key, after you enter one. |
| A temporary folder | A 7z recording is unpacked there to read it (with your own 7-Zip: the app doesn't include it, and runs it only when you open a .7z), and a report is written there to print it to PDF; both are deleted straight after. |
Saved Games/DCS…/Scripts/Export.lua and the recorder script next to it |
Only when you choose Set up DCS recording: one line is added to Export.lua and the recorder script is copied in; Export.lua is first saved as Export.lua.overmerge-backup. Removing the setup takes both out again. |
| Wherever you choose | Reports (HTML, PDF), CSV, screenshots, .debrief files and exported recordings. |
Settings (lcde.settings) and bookmarks in local storage; squadron statistics in
IndexedDB. They stay on your device; clearing the site data removes them.