1. Who we are
Script Flow ("Script Flow", "we", "us") is a screenwriting web app operated by an independent filmmaker based in Australia. This policy explains what personal information we collect, why, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for visitors in the European Union and United Kingdom, the GDPR.
Questions or requests about your data: motion.media.worldwide@gmail.com.
2. What we collect
- Account details: your name, email address and a one-way hash of your password (created with scrypt). We never store or see your actual password.
- Your writing: screenplays, title page details, settings and snapshots you save. This is the content you create in the editor.
- Guest sessions: if you start writing without an account, we create an anonymous guest profile with no name or email.
- Security records: to stop abuse, we briefly record failed sign-in attempts (with the email address used) and the IP address that creates guest sessions. These records delete themselves after 15 minutes.
- Usage and performance data: we use Vercel Web Analytics and Speed Insights to count page views and measure loading speed. This data is aggregated and does not use cookies or build a profile of you.
3. Cookies
We only use cookies that the service needs to work. We do not use advertising or tracking cookies.
- sf_session: keeps you signed in, including as a guest. It holds a random token (we store only its hash) and expires after 30 days or when you sign out.
- NEXT_LOCALE: remembers the language you chose. It expires after one year.
4. How we use your information
- To provide the service: save, display, export and restore your scripts.
- To run your account: sign you in, keep you signed in and recover a guest session into a full account.
- To keep the service secure and to prevent abuse such as password guessing.
- To understand, in aggregate, how the site performs so we can improve it.
- To reply when you contact us.
We do not sell your personal information, use your scripts to train AI models, or show you ads.
5. Where your data is stored
Your account and scripts are stored in a MongoDB Atlas database, and the website is hosted on Vercel. These providers process data on our behalf and may store it outside Australia, including in the United States. We take reasonable steps to make sure they protect it to a standard comparable to Australian law.
6. How long we keep it
We keep your account and scripts for as long as your account exists. If you ask us to delete your account, we delete your scripts and snapshots with it. Guest data stays available while the guest session lasts; we may delete guest data that has not been used for an extended period.
7. Your rights
You can ask to access, correct, export or delete your personal information, and EU and UK visitors can also object to or restrict certain processing. Email motion.media.worldwide@gmail.com and we will respond within 30 days. You can export your scripts at any time as PDF or Fountain from the editor.
If you are unhappy with how we have handled your information, please contact us first. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU and UK, to your local data protection authority.
8. Security
We protect your data with encrypted connections (HTTPS), hashed passwords and session tokens, and access controls that keep each person's scripts private to their account. No system is perfectly secure, so please use a strong, unique password.
9. Children
Script Flow is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the service changes. We will change the date at the top of this page, and tell you about significant changes inside the app or by email.