Privacy

What we hold

Your scripts and their comments, your email address, the plan you are on, and any feedback you send us. That is the whole list.

There is no advertising inside Scriptroom. We never sell your scripts, and no advertiser ever sees one. On our home and pricing pages we run Google’s tag, so we can tell whether an ad we paid for brought you here, and show our ads again to people who have visited. What it receives is listed below.

Where your script goes

Running the product means sending parts of your work to a small number of services. Here is every one of them, and exactly what reaches it.

• Neon — the database. Your script, title page, comments, feedback and email live here.
• Vercel — hosting. Requests pass through it.
• Clerk — sign-in. Receives your email address to keep you signed in.
• Slack — where we read feedback. If you send some, your message, your email address, and the page, screen width and browser you sent it from are posted to our team’s Slack. Your script is not.
• xAI (Grok) — when you render a premium voice, the text of those lines is sent to be spoken. When you run an assist pass, the excerpt it reads is sent. Nothing is sent unless you ask for it.
• Cloudflare R2 — stores the rendered audio.
• Resend — receives your email address, to send your sign-in link.
• Stripe — payments, if you subscribe. Receives your email address. Your card details go to Stripe, never to us.
• Sentry — error reports. Script content is stripped before anything is sent.
• PostHog — product analytics.
• Google (ad tag) — on our home and pricing pages, and on the short page you pass through right after you create an account or subscribe. It receives the page address, the site that sent you, your IP address, and your browser and device details. If you came from a Google ad, it also gets that ad’s click id. It is told when you create an account, and when you subscribe, the amount and a payment reference. It never receives a script, a script’s title, your name or your email. The tag is not loaded in the editor, the reader or a shared script.

What our analytics cannot see

Session recording is off. We do not record your screen, and we never will — on this product your screen is your unproduced script.

We count page visits and the steps you take, like importing a script or starting a read. Our own analytics don’t record the page addresses. We remember this browser between visits. With each visit we note the kind of page, browser type, device type, the site that sent you, and whether you are signed out, on Free or on Paid.

If you arrive from one of our ads, we also note which one and, for a search ad, which of our keywords it was shown for, when you open the editor or start a read. On our home, pricing, and legal pages we count which links and buttons you click, with their labels. Nowhere else — never in the editor, the reader, or shared scripts. We also pass on the description your browser sends with every request, which names the browser, its version and your operating system, and your time zone.

Once you sign in, we connect your earlier visits on this browser to your account. We use an internal id, never your name or email. Our events have no field a line of your script could end up in. Error reports pass through a filter that removes screenplay text, email addresses and tokens before they leave the server.

These are properties of the code, not settings we intend to honour. If you want to check, the relevant files are lib/observability/redact.ts, lib/observability/analytics.ts and lib/observability/analytics-client.ts.

Google, on our marketing pages

We pay Google to show ads for Scriptroom. On our home and pricing pages we load Google’s tag, so we can tell whether an ad that brought you here was worth the money. It also runs for a moment on the page you pass through right after you create an account or subscribe, so Google can count that.

Google receives the page address, the site that sent you, your IP address, and your browser and device details. If you came from a Google ad, it receives the ad’s click id. When you create an account it is told that someone did. When you subscribe it is told that, the amount and a payment reference. It never receives a script, a script’s title, your name or your email. The tag is not loaded in the editor, the reader, a shared script, or on this page.

Google sets advertising cookies and shows our ads to past visitors on other sites. You can opt out at adssettings.google.com. If you are in the EU, the UK or Switzerland, we tell Google not to set cookies, and it receives a cookieless ping instead. What Google keeps is covered by Google’s own privacy policy.

Cookies

Cookies, to keep you signed in. If you hear studio voices without an account, we set one more cookie. It holds a random number, so we can count that browser’s daily allowance. It isn’t linked to you, and it lasts a year.

Our analytics store an id in your browser’s local storage (not a cookie). It stays until you clear your storage.

On our home and pricing pages, and on the short page you pass through after you create an account or subscribe, Google’s tag sets advertising cookies, unless you are in the EU, the UK or Switzerland. _gcl_au holds a random id, so a later sign-up can be matched to the visit. If you came from a Google ad, _gcl_aw holds that ad’s click id, and Google keeps a copy, GCL_AW_P, on its own domains. Each lasts 90 days. Google also sets test_cookie on doubleclick.net, to check that your browser accepts cookies. The tag keeps these ids in your browser’s local storage too.

We use remarketing. Google shows our ads, on other sites, to people who have visited these pages. It does this with its cookies. You can opt out at adssettings.google.com. In the EU, the UK and Switzerland we tell Google not to set any cookies, so nobody there is remarketed to. None of this runs in the editor, the reader or a shared script.

Your choices

You can export everything you have written at any time, in PDF, Final Draft, Fountain or plain text. Fountain and plain text are open formats that no company controls, so leaving is always possible.

You can delete any script, or your entire account, from the app. To ask what we hold about you, or to have it removed, write to privacy@scriptroom.app.