What we collect

  • Account details: your email address, and your display name when you sign in with Google.
  • Your projects, comments, uploaded files and generated media.
  • Usage records such as AI requests and credit activity, and product events such as opening the app, importing or exporting a script and writing a project's first scene. These record the event and counts like formats or page totals, never the text of your work.
  • To stop free credits being claimed over and over: a first-party cookie holding a random device id and, for each account, keyed hashes of that device id and of the network it is used from (the first three parts of an IPv4 address, or the first three groups of an IPv6 one). They are used only to hold free credits and referral rewards back; never to block sign-in, and never for ads or analytics.
  • Payment status from our payment processor; we do not store card numbers.
  • If you connect an AI app: the app's name and web address, the permissions and daily credit limit you chose, and a log of what the app did (see Connected AI apps below). Sign-in tokens issued to apps are stored only in hashed form.

How we use it

To run the service, sync your projects with collaborators, apply plan limits and credits, send account emails such as invitations and recovery links, and keep the service secure.

Service providers

Scenaloom runs on a cloud infrastructure provider. Payments are handled by Stripe. We also use the following categories of service providers, which act as our processors and receive only what they need: an email delivery service for account emails, and third-party AI model providers for the writing assistant, for images, video and speech, and for automated safety screening of prompts. AI and media generation requests contain only the scope you choose for each request. A list of our sub-processors is available on request at support@scenaloom.com.

  • Cloud infrastructure provider — hosting, storage of your projects and generated media, live collaboration, email routing for support, and a bot check on sign-in and recovery email requests, which confirms the request comes from a person (it reads signals from your browser and your IP address for that check only).
  • Stripe — payments, invoices and tax.
  • AI model providers for the writing assistant: the text you ask it to work on and the project context it needs.
  • AI model providers for image, video and speech generation and for automated safety screening of prompts: the prompt, settings and any reference image of each request.

AI and your work

Scenaloom does not use your projects, prompts or AI results to train or fine-tune AI models. An AI request carries only the scope you choose and goes to the third-party AI provider that runs it. Each provider also handles it under its own terms, and those terms differ:

  • Safety screening: the provider that checks prompts automatically before a request runs does not use them to train AI models and keeps them only while the check needs them.
  • Retention: some AI providers keep requests and results for a limited period, for example to detect abuse, keep their services safe or deliver a generated file.
  • Service improvement: some AI providers, including the one behind the writing assistant and some image, video and audio services, may use what they receive to operate and improve their own services, in some cases in anonymized form. The terms of some of them offer no setting that would stop this for requests Scenaloom sends.
  • Where it is processed: AI providers may process and store requests outside your country, including in the United States and the People's Republic of China.
  • Overseas transfer notice: if you are in mainland China or South Korea, or use Scenaloom in Simplified Chinese or Korean, the app shows you before your first AI request a notice naming each overseas recipient, its country, what it receives, why and for how long, and asks for your separate consent, which you can withdraw at any time in Settings → General (AI then turns off).
  • Underlying models: some media services pass your prompt to the model they run, whose maker's terms also apply.

If you would rather send your work to none of them, turn AI off in Settings → General. Scenaloom then hides its AI features and refuses AI requests from your account, including generation an app you connected asks for. Your work and anything you made before stay as they are.

Connected AI apps

You can connect third-party AI apps, such as Claude, ChatGPT, Cursor or VS Code, to your account through the Scenaloom MCP server. An app connects only after you sign in to Scenaloom and approve it on a consent screen that names the app and the permissions it asks for.

  • What an app can access: with the permissions you approve, it can read the projects you can open (scripts, novels, characters, locations, beats, outlines and comments), propose and apply edits, and add comments. It never has more access than your role in a project, and it cannot reach your password, payment details, billing, sharing settings or account settings.
  • Your authorization: you can see each connected app and the permissions you granted it, change its spending limit, and disconnect it at any time under Connected apps in your account; disconnecting takes effect immediately. Recovering your account, changing your email address, signing out of all devices or deleting your account disconnects every app. An app's access ends after 90 days at most unless you approve it again.
  • Third-party handling: text an app reads is sent to that app and to the AI provider behind it, at your direction, and is handled under that app's own terms and privacy policy. These apps are not Scenaloom's service providers, and Scenaloom is not responsible for how they process, store or use what you let them read.
  • Spending credits: an app can spend credits only if you granted the separate Spend credits permission, and only after you confirm each cost or within a daily limit you set (0 by default, at most 500 credits per 24 hours). Credits spent this way are charged to your balance and follow the Credits Policy.

Retention

Project data is kept while your account is active. Deleted projects stay in Trash for 30 days before permanent removal.

  • Generated images, videos and audio, and pictures you upload, stay in your project until you delete them. You can delete a single file in Media with Delete file: it is taken out of every place in the project that uses it and, after 30 seconds in which you can undo, the file itself is deleted. Removing a generation from your history only hides it. Whatever is left is deleted when you delete the project (after 30 days in Trash) or your account.
  • Reports about shared content and the decisions on them are kept for 12 months; images removed after a report are remembered only as a fingerprint (a hash) so they can't be uploaded again.
  • Copies of notification emails are deleted 90 days after they are sent. In-app notifications are deleted 180 days after you read them, and all of them after a year.
  • Product usage events are kept for 13 months. The text of an AI request and its result is deleted 30 days after the request; a record that the request was made stays, so it is never run or charged twice.
  • Records that stop a request from being carried out twice (for example a save sent again after a dropped connection) are deleted after 90 days.
  • The activity log of each connected app (when it connected, each tool it used, the project it acted on, the outcome and any credits spent; never the text of your work) is kept for 180 days. The record of a disconnected app is deleted 90 days after it was disconnected. Your account export includes your connected apps and their activity.
  • Server logs never contain the text of your work and are kept for up to 7 days.
  • If someone invites you to a project by email before you have an account, we don't create an account for you: we keep only your email address with that pending invitation, so it can reach you. The invitation email has a link to decline it, which deletes your address at once. If you never sign in with that address, the invitation and your address are deleted 60 days after it was sent; if you sign up with it, the invitation becomes your membership of the project and the pending record is deleted. Placeholder accounts that invitations created before this change are deleted 60 days after they were created if never used, unless you turned off invitation emails, in which case we keep it so your choice stays in effect.
  • Those hashed network and device signals are deleted 90 days after they were last seen, or with your account. A keyed hash of your email inbox stays after your account is deleted, only so that welcome credits aren’t given to the same inbox twice.
  • Payment records are kept as long as tax law requires.

Your choices

You can export your work, change sharing settings, and delete your account at any time. Contact support@scenaloom.com for privacy requests.

You can also turn AI off for your account in Settings → General.