Privacy Policy

Last updated: October 13, 2026

This policy describes how Spotsheet handles your information. Spotsheet is operated by J. Murphy Ryan. It goes with our Terms of Service and Data Use.

Your projects stay yours

Film and TV work is confidential. Cue sheets, notes, stem filenames and library folder paths often name unreleased titles.

• We don't access, review or use the content of your projects except to run and secure the Service, to provide support you ask for, or to meet a legal requirement.
• We never use the content of your private projects to train AI models or to build datasets, and we have not agreed to let our providers do so. That content includes notes, cue text, comments, filenames, folder paths, picture and audio.

1. Information we collect

• Account information: your username, your email address (required, and verified), your password and, if you set one, a display name. Passwords are stored only as salted hashes (bcrypt), so we cannot read them. We keep a record of which version of our terms applied when you signed up or signed in, and when. If your account already existed when we updated the terms, you accept the new terms by continuing to use Spotsheet, and the record is made the next time you use it. We use your email to sign you in, recover your account, send security notices, and match project invites sent to that address. An invite sent to your email address attaches to your account only after you verify that address.
• Project data: the spotting sheets, notes, cues, comments, assignments, picture versions and revision history you and your collaborators create. So that mistakes can be undone and failed saves recovered, we also keep a history of changes to notes (including their text) and a log of who changed what in each project, and when. If you use the paid sound-effect features, we also keep descriptive metadata about the sound effects you place (category, source library, license information, timecode). If an owner or admin uses the budget feature, we also keep the budget figures they enter and, for each editor, the display name, role and pay amount they enter.
• Files that stay on your computer:
  • When you link a stem from your own computer, we store the name of the file you picked, so a re-link doesn't create a duplicate entry. The audio itself is read on your computer to draw waveforms and to play back. It is never sent to us.
  • Picture and video you link from your computer stay on your computer. The link to them is kept in your browser's storage, or in the Mac app.
  • If you clear your browser's data, those picture and stem links are dropped and you will need to link the files again.
• Files you upload to us: Spotsheet doesn't store your picture, your stems or your sound libraries. You link them from your computer or from storage you host. The only files you can upload to us are listed here, and Section 6 says what happens when you delete one.
  • Change lists (project owners and admins only): when you attach a change list from picture editorial to a picture version, or add one in the New version dialog, we read it once on our server. It can be an EDL or an AAF; any other file name is read as a plain-text list. We keep only its list of edits (timecodes and frame changes) and its file name in our database, with a history of changes to the list; the file itself is not stored. Lists attached before October 14, 2026 were stored in our object storage at Vultr; removing one in the app detaches it from the project, and its stored file stays until you ask us to erase it.
• Sound-effect library index (paid sound-effect features only): if you index a library on your computer, we store each file's name and its folder path within the folder you picked, its category, tags, keywords, duration, format and any description already written into the file, plus a hash of the first part of the file and a coarse waveform summary. We never store the sound itself.
• Collaboration data: invitations (including the email address an inviter gave us for you), project memberships and permissions.
• People without an account: a project owner can give someone a seat, or send a share link or a portal link, so that they can use part of a project without signing up. For a seat we keep a label (a name), an optional email address, a colour and, if one is set, a password (stored only as a salted hash). For a share link we keep its label, the tabs it opens and, if one is set, a password (stored only as a salted hash). When someone accepts the terms on a portal page, we record their IP address, their browser type, the terms version and the time. Removing a seat or a share link deletes it; the portal record stays until we erase it (Section 6).
• Usage and device data: our web server logs the IP address, browser and device type, pages requested and timestamps of every visit, including visits by people without an account; we keep those logs for about 14 days. When you create an account or sign in, we also record a hash of your IP address, your browser type and a device ID, to limit abuse and to keep a record of security events such as sign-ins, failed sign-ins and sign-outs. We use this to run and secure the Service.

2. How we use information

• To provide, operate, secure and maintain the Service and your account.
• To make collaboration and the features you use work.
• To troubleshoot, prevent abuse and protect the Service and its users.
• To tell you about the Service: invitations, security and service notices, and changes to this policy.
• To comply with the law and enforce our Terms.

3. Statistics

• We keep simple operational statistics about how the Service is used, for example how many projects are active and, for the AI features, how many requests are made and what they cost. These statistics contain no project content.
• We don't attempt to re-identify anyone from them. If we ever share de-identified data, the recipient must agree in writing not to re-identify it.
• Anything beyond this, for example contributing anonymous cue or category statistics to an industry standard such as UCS, is opt-in, per account or per project, and off by default.

4. AI features (not part of Spot)

• Spot (free) has no AI features. The features below are part of the paid plans.
• Sift suggests search terms for your own sound library. When you use it, the text of the note you're searching for (up to 2,000 bytes) is sent to our AI provider, OpenAI, to produce suggestions. We ask OpenAI not to store the response. Nothing else is sent: no audio, no file names and no library data. Sift asks for your agreement, project by project, before it is used. Notes written by collaborators are included when Sift runs on them. We keep the suggestions Sift returns for each note, together with a hash of the note's text (not the text itself).
• STACK is an assistant that answers questions about your project and can propose changes. Every change needs your confirmation. When you use it, what you type, the notes it needs to answer (their text, timecodes, categories, status, assignee and comments) and the project's name, reel and frame rate are sent to our AI provider, Anthropic. The last few messages of your conversation go with each request. Audio, picture and library data are not sent, and we replace file paths in the text before sending it. We keep your STACK conversation, and a record of what it proposed and what you confirmed. Your messages and its proposals note which project they were about.
• Providers: OpenAI (Sift) and Anthropic (STACK). We use each provider's business API, not its consumer apps. How long a provider keeps API data, and what it may use it for, is set by that provider's own terms. We have not agreed to let either provider train its models on your content.
• When AI runs: STACK runs only when you send it a message. Sift runs when someone asks it to and, if a project's owner has switched on Auto Sift for that project, on notes as they are saved (at most 500 notes per project per day).

5. How we share information

• With collaborators you invite, or whose projects you join, to the extent of the access granted.
• With service providers who process data on our behalf under contract:
  • hosting and object storage: Vultr (our server and our backups, and change-list files attached before October 14, 2026);
  • email delivery: Postmark (your email address and the content of sign-in, verification, password-reset, security and invitation emails);
  • AI providers: OpenAI and Anthropic, as described in Section 4;
  • domain name service (DNS): Cloudflare hosts the DNS records for our domain;
  • payments: none. Spotsheet is free today and we collect no payment details.
• Content loaded from other sites: most of our pages, including the app, our sign-up pages, the blog, the reference library, the Spotsheet Notes page and our free tool pages, load their typeface from Google Fonts, and the app may load its 3-D logo viewer from Google Hosted Libraries, so Google receives your IP address and browser details when such a page opens. Some pages, such as the invitation page, the Spotsheet Notes page that opens from a share link and the video and sound-effects pop-out windows, also load open-source code libraries (React and, on some of them, Babel) from unpkg.com, a public code-delivery network, so unpkg receives your IP address and browser details when you open one of them. We send Google and unpkg nothing else. We don't use third-party analytics or advertising trackers.
• To a notification address a project owner sets: through our API (the app has no screen for this yet), the owner of a project can set a Slack, Microsoft Teams, Discord or other web address (HTTPS) for that project. We then post event messages to that address. To a Slack, Teams or Discord address each one is a short message, for example a new note's text, timecode, status, author and assignee, the start of a comment that mentions someone, a new cut, or a conform or QC result. To any other address (a generic webhook) we post that same short message as JSON, with the project's name, the note's timecode and text, the name of the person involved and a link to Spotsheet, and no internal IDs. Whoever controls that address receives them.
• For legal reasons: to comply with the law, legal process or lawful requests, or to protect rights, safety and the integrity of the Service.
• In a business transfer, such as a merger or acquisition. Any successor must honor this policy.
• From storage you operate: if you point a project at a file on storage you control, your host serves it under your host's rules.
• We don't sell your personal information, and we don't share it for cross-context behavioral advertising.

6. Retention and deletion

This is what deleting does today:

• To have something erased for good (a note, a project, a change list, a portal record, your STACK conversation or your account), email us from the address on your account. If you have no account, email us and tell us what you want erased. We erase it from our live systems, including its change history, within 30 days, except where the law requires us to keep it longer.
• Notes and comments you wrote in someone else's project stay in that project after you leave it or your account is erased, because they are part of that project's record. Once your account is erased, they no longer show your name.
• Project data is erased for everyone when the project's owner asks us to erase the project, on the same terms.

7. Cookies and browser storage

• Cookies: when you sign in we set a session cookie (HttpOnly, secure, same-site) that keeps you signed in until it expires or you sign out, and a second, small cookie that holds only the time your session expires. We set no other cookies. We don't use advertising or third-party analytics cookies.
• Browser storage: your browser's local storage keeps interface settings, such as layout, filters and the last project you opened, and its IndexedDB keeps the picture and stem links described in Section 1. The sign-in library also keeps, in local storage, your sign-in token (removed when you sign out), your device ID and your account recovery secret (both stay after you sign out, so that you can recover your account), and a device fingerprint it computes from details such as your browser type, language, screen size and time zone. The library sends that fingerprint with its sign-in requests; we do not store it. The app also registers a service worker, which does not store or intercept your data.
• We don't track you across other sites, sell your information or share it for advertising, so a Global Privacy Control signal has nothing to switch off.

8. Security, and if something goes wrong

• We use reasonable technical and organizational measures to protect information: traffic is encrypted in transit (HTTPS), passwords are stored as salted hashes, and session and Mac-app device tokens are stored only as hashes. No system is perfectly secure.
• If a breach affects your information, we will tell you without undue delay: what happened, what was affected, and what we're doing about it.

9. Your rights

• What you can ask for: access to, a copy of, correction of or deletion of your personal information, or closing your account.
• How to ask: email us from the address on your account (see Section 14). We may ask you to confirm your identity.
• Our response time: within 30 days (45 days where California law applies; we will tell you if we need an extension).
• If we decline: you can appeal by replying "appeal". We will answer the appeal within 45 days.
• We won't treat you differently for exercising your rights.

10. California

• California residents have the rights in Section 9 under the CCPA / CPRA.
• What we collect: the categories of information are in Section 1 (identifiers, account and usage data, project data, including change lists). We use them as described in Section 2, and we disclose them only as described in Section 5.
• No selling or sharing: we have not sold or "shared" personal information as California law defines those terms, and we don't use third-party trackers.

11. Users outside the United States

• For users in the UK and EU:
  • Who is responsible: we are the controller of your account data.
  • Our legal bases:
    • running the contract with you (providing the Service);
    • our legitimate interests (security, troubleshooting, operational statistics);
    • your consent where we ask for it.
  • Your rights: access, rectification, erasure, restriction, portability, and objection. You may also complain to your data protection authority (in the UK, the ICO).
  • Transfers: our servers, storage and backups are in the United States, so your data is transferred there. Transfers rely on the European Commission's Standard Contractual Clauses with our providers.

12. Children

The Service is for professionals and isn't directed to anyone under 18. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

• We will post every change here, with a new "Last updated" date.
• For material changes, we will also notify you by email and in the app before they take effect.

14. Contact

• Email: info@spotsheetpost.com