Privacy

The short version: we store what the product needs, encrypt what matters most, and sell nothing. When you buy credits, Stripe handles the card and we handle the receipt.

What we store

Your account (email, display name), your rooms and messages, the AI replies those rooms generate, attachments you upload, files the code sandbox produced, your budget caps, and a per reply ledger with token counts and costs. Rooms are visible to their members, which is the product.

If you buy credits or a subscription we also store your credit balance, every ledger entry that moved it, your receipts, and the customer and payment identifiers Stripe gives us. If you saved a provider API key we store it sealed, in the form described on the Security page.

If you import chats from ChatGPT, Claude or Gemini, your browser opens the export file and sends us only the conversations you pick, as text. The file itself is never uploaded or kept, and images and other files in it are not imported. Imported chats are stored like any other messages and replies, in the room you choose, so that room’s members can read them, and you can delete them like any other chat. When you continue an imported chat, its earlier messages go to the AI you ask, like the rest of a chat’s history.

Your API keys

Keys are sealed with AES-256-GCM under a per-key data key, which is itself wrapped by a key held in a hardware key-management service. They are decrypted only in server memory at the moment a room you fund makes a request, are never written to logs, and are never shown to anyone after saving, including you. A copy of our database alone cannot reveal them.

Where your prompts go

Messages you point at an AI go to the provider of the AI you ask: Anthropic, OpenAI or Google. The most recent asks and replies in that thread go with them, as text, so the model can follow the conversation, and so do the messages posted in the chat since the AI was last asked, as described under “What we actually send”. That includes replies another model gave earlier in the same thread. The provider processes what it receives to produce the reply. Which account it runs on depends on how the room is paying: a member’s own API key, a company key a workspace saved for its rooms, or ours when credits pay. Credits can be your own, a room owner’s when they cover you, or a workspace’s credit balance.

To keep replies affordable, the older part of a long chat is sent as a short summary instead of in full. We write that summary with our own account at the same AI provider that answered the chat, including in rooms that pay with a member’s or a company’s own key. Anyone asking can choose “Use full chat” to send the whole conversation instead. Workspace owners can turn this off.

Message text you choose to translate may be sent to our AI provider account to translate it, when your browser cannot translate it on the device. That can happen to any message or reply you press Translate on, including chat nobody pointed at an AI, and including in rooms that pay with a member’s or a company’s own key. The text goes to a small model the room allows (Gemini Flash-Lite, GPT-6 Luna or Claude Haiku 5.5) on our account, and it costs you nothing. We keep the translation so the next person who asks for it gets it without another request, and we delete it when the message is edited or deleted.

Under all three providers’ API terms, content sent through the API is not used to train their models by default. Google draws that line by tier: free tier Gemini traffic can be used to improve their products, paid tier traffic is not. splitscreen uses paid tier Gemini access. The relevant documents are the Anthropic Commercial Terms of Service, the OpenAI API data usage policy, and the Google Gemini API Additional Terms.

All three may hold content for a short window for abuse monitoring, on their own schedule and under their own policy, typically measured in days rather than months. That is their commitment, not something we can enforce.

We add no third party analytics, ad trackers or data brokers. The other companies that process data for us: Supabase (database, auth, realtime), our hosting provider, Stripe (payments), Resend (email delivery), GitHub (repository access, for rooms that connect one), Google (sign-in, when you choose to sign in with a Google account), Expo (push notifications to the phone app, described below), Cloudflare (our network provider: every request to splitscreen.chat passes through it, encrypted from your device to Cloudflare and from Cloudflare to us, which means it can read what you send and receive while it is in transit; it keeps a copy only of the site’s public code and font files, and it also runs the bot check on sign-up and on the contact form), Amazon Web Services (the key service that wraps the keys sealing saved API keys, which receives a wrapped key and the account id it is bound to, never an API key or a message), and ImprovMX (forwarding mail sent to [email protected] to our inbox).

If you sign in with Google, Google handles that sign-in under its own privacy policy. We keep the email address, the name and the profile picture link Google passes to us, and the name becomes your display name. We ask Google for nothing else from that account. When that picture is shown beside your messages, the browser of each person in the room loads it from Google, so Google sees that request. No Referer is sent with it, so the page you are on is not passed along.

When a room connects a repository, the file contents the AI reads go to the AI provider answering that ask, the same way anything else in a room does. What goes to GitHub is what a commit needs: the proposed file contents, a commit message, the name of the branch that repository is pushed to, and the name of the person who asked and the room they asked in. If that branch is protected, the same commit is put on a new branch and opened as a pull request, which adds a title and a body. We do not send GitHub your messages, your attachments, your account email, or anything from another room. We hold no GitHub token: access is minted for each request and thrown away. We do not keep a copy of the files the AI reads.

If a Discord server links a channel to a splitscreen room, our bot reads only the messages that mention it and the commands people send it. It does not read the rest of the channel. What you ask it is posted into that room as a message from you and answered there like any other ask, and the answer, and any image it made, is posted back to the Discord channel, where Discord handles it under its own privacy policy. If someone uses “Ask splitscreen” on a Discord message, that message’s text and its author’s Discord display name are copied into the room with the question. When you link your Discord account, we ask Discord only for your Discord user id and keep nothing else from it: no Discord password, token, username or email. We store the link between the two accounts, which channel goes with which room, and the ids of asks made from Discord so we can limit how often a person or a server can ask. You can unlink at any time, and the bot does not answer in age-restricted channels.

We do keep our own product analytics, in our own database and nowhere else: counts of things like a page being opened, a room being made, an invitation being accepted and a reply being answered. Each one is recorded as an event name with, depending on the event, an account id, a room id, and the anonymous browser id described under Cookies and storage, and never with message content, names or email addresses.

We also note each day you open the app, as your account id and a date. The people who run splitscreen can see each account’s activity: its name and email address, when it signed up and was last active, and how many rooms, messages and AI replies it has and what they cost. They see those counts, never what anyone wrote.

We also measure how fast the app loads: each visit, signed in or not, can send the type of page (never which room or chat), whether the device is a phone or a computer, and a few load timings, which we keep only as daily counts for 30 days, with no account, browser id or content attached.

What we actually send

Only what the reply needs, and only from the thread you are in:

• The messages someone pointed at an AI, whoever wrote them, and the earlier asks and replies in that thread. When someone asks an AI, the recent messages posted in that chat since the AI was last asked (up to a limit) are sent with the question so the AI has the context. Links in them are reduced to the site’s name and attachments to their file names, and messages aimed at someone’s agent are left out. A room’s owner can turn this off in the room’s settings. Other chat that nobody pointed at an AI is not sent to a model provider by us, except when someone asks us to translate it as described above. Posting a message never costs anything; the context goes with the asker’s question and is covered by their free reply, credit or key. Earlier replies from Claude, GPT and Gemini all go along, whichever one you ask next, so each model sees what the others said.
• The display names of the people in the room, and the first eight characters of each person’s account id, so the model can tell apart two people with the same name. Not your email address, and not your full account id.
• Attachments on those messages: images, PDFs, code and text files, each up to 5 MB, and zipped folders up to 25 MB, three per message. They go as file bytes with the request, except a zip, which is never put in a prompt and only ever goes to a code sandbox.
• Files the code sandbox produced earlier in the thread, when a later reply needs them.

A member can connect their own agent to a room. It signs in as them, so it can read the messages they can read, including ones nobody pointed at an AI. That agent runs on its operator’s own account and its own provider, not through us. An agent reads the room it is in, and it reads it again whenever something wakes it, so what other people wrote there reaches that operator’s own provider at the moment of the wake rather than at a moment its operator picked. It can also write a message attributed to that member and aim it at that member’s other agents.

A member can turn on receiving work from the other members of a room. While it is on, another member of that room, or one of their agents, can aim a post at that member’s agents. The post is visible to the whole room like any other post, and we still send it to no model. The people it covers are whoever is in that room at the time, and the room’s owner decides who that is. It is off until the member turns it on, that member is the one who turns it on, and they can turn it off again; the messages already in the room stay where they are.

Two specifics worth knowing. When you switch on the code sandbox, that turn’s files are uploaded to the provider’s own file store (Anthropic’s Files API for Claude, OpenAI’s for GPT) so the sandbox can open them off disk, which means they sit in that provider account rather than only passing through. Both are uploaded with a one-hour expiry and are never reused between turns, and the GPT copies are deleted as soon as the reply finishes. A zipped folder can only be sent this way, which is why it needs the sandbox switched on. And files the sandbox writes are copied back into our own private storage so the room can read them, where the same member-only access rules cover them as every other file in the thread.

We never send your API keys, your payment details, or anything from a room you are not asking in.

Public transcripts

A room’s owner can ask for one thread to be published as a page anyone can read at splitscreen.chat/c/… without an account. It only happens if every person who posted in that thread, and the room’s owner, approves it individually. One refusal stops it, and nobody can approve on somebody else’s behalf.

A published page carries the text of the messages and the models’ replies, the display name beside each message, which assistant answered, and the receipt under each reply: what it cost, and who paid, by display name (“covered by Ada”) and never by an account identifier.

It never carries attachments, uploaded files, files the code sandbox produced, HTML previews, email addresses, account identifiers or room identifiers. That is not a rule the page is trusted to follow: the published copy of a thread is a separate, frozen table that has no column for any of them, so there is nothing on it to publish.

Only messages posted before the owner asked are included. If you posted in a thread that has been published, you can remove your own messages from that page at any time, permanently. There is a control on the page itself and one in the room. It works whether or not you approved it and whether or not you are still in the room. The replies you asked for go with them, because a reply usually restates the question. They never come back, including if the thread is published again later. Deleting your account removes them too.

Mail about your rooms

Resend delivers our email. They process the recipient address and the message we hand them, as a processor working for us, under their own privacy policy.

There are two kinds of mail and they are treated differently. Mail the product needs to work (invitations, receipts, password resets, and notices about your account) is not something you can switch off, because switching it off would break the thing you asked for. Mail about your rooms, such as a note that a room you were invited to is waiting for you or that yours is still empty, is optional, and every one of those messages carries a one-click unsubscribe link. Using it stops that kind of mail only; it never affects an invitation, a receipt or a password reset.

We only send mail about your rooms to an address that has been confirmed, and the sender reads your address from your account for that purpose and no other. There is no open pixel, no click tracker and no third party list: your address is not shared with anyone except the delivery provider named above, and it is never sold.

Push notifications

Push notifications reach a device only after you allow them on it. Each one carries a line saying what happened, such as who mentioned you and in which room, a short preview of the message for a mention or a reply, and a link back to it. Anything in the preview that looks like a password, a key or a token is hidden before it is sent.

In a browser, the notification is encrypted for your browser before it leaves us, so the browser’s push service (Google, Mozilla, Apple or Microsoft, depending on the browser) delivers it without being able to read it. In the phone app it goes through Expo, which hands it to Apple or Google to deliver, and those companies can read the line and the preview. Turning notifications off on a device stops them there.

Payments

Stripe processes every payment. Stripe collects your card details directly and holds them. We never receive your card number and never store it.

What we keep is the accounting: your Stripe customer id, the payment and invoice ids, the amount, the date, the tax charged, and the card brand and last four digits as Stripe reports them back. That is what lets us answer “what did I pay for”, issue a refund, and file a tax return.

Stripe is a processor working for us, and also handles that data for its own fraud prevention and legal compliance, under its own privacy policy.

How long we keep things

• Messages, replies, attachments and sandbox files: until you or a room owner deletes them, or the room is deleted. Deleting your account deletes the rooms you own; what you posted in other people’s rooms stays, as “What stays” below describes.
• In a workspace’s rooms: a workspace owner can set a retention period of 30, 90, 180 or 365 days, for the workspace or a shorter one for one room. Once a day, messages and their files older than that are deleted, the text of older AI replies is removed (the receipt of what each cost and who paid stays), and notes and docs not edited within it are deleted. A shorter period starts after 7 days. Rooms outside a workspace are never touched by this.
• Legal holds: a workspace owner can place a hold on the workspace, one room or one person. While it lasts, held messages, chats, notes and docs cannot be deleted, by a retention period or by anyone, and neither can a held room, a held person’s account or the account of a held room’s owner. Messages and notes can still be edited, but the text before each edit is kept for the workspace’s owners to read, until the workspace is deleted.
• Summaries of older chat: one per chat, replaced as the chat goes on. Deleted with the chat, and written again without content that a retention rule removes.
• Credit ledger, receipts and tax records: 7 years after the transaction. Tax and accounting rules require us to keep records of what we sold, and those survive account deletion. When an account is deleted we keep the sale - what it was, what it cost, when it happened and the payment reference - with nothing in it that says who you were.
• Sealed API keys: until you revoke them, which takes effect immediately, or delete your account. A company key stays until its workspace removes it.
• Translations: until the message or reply is edited or deleted, or a retention period removes its text. A record of each translation we made (who asked, in which room, the model and the cost, never the text) is kept like the audit log below.
• Server logs: kept by size, not by date. The app and the web server in front of it each keep at most five log files of 20 MB, and the oldest is dropped when a new one starts, so how far back they reach depends on how busy the site is. They carry request metadata, never key material and never message bodies.
• Audit log: kept indefinitely. Each row is an action name, the id of the account that took it, what it was done to, a few details such as a provider name, a token count or a cost, and a time. It never holds message text or key material. Deleting your account clears your id from these rows; the rows stay.
• Product analytics events: 180 days. Deleting your account unlinks your id from them, leaving a count.
• Days you opened the app: 400 days. Deleting your account deletes them.
• A room’s activity record (who joined, left or was removed, and settings changes): 90 days. Deleting your account clears your id from it.
• A workspace’s activity log: 1 year. If the workspace streams it to its own webhook, Splunk or Datadog, each entry waits in a queue for at most 7 days. Deleting your account clears your id from these records.
• What your agents did: one line per action an agent you connected took (which tool, which room, what an ask cost, never a message), for 30 days. Deleting your account deletes them.
• A workspace’s user provisioning (SCIM) requests: the method, the address and the result of each, for 90 days.
• Page speed measurements: daily counts, 30 days.
• Messages sent from the contact form: 1 year.

Cookies and storage

We use cookies for sign-in sessions, and your browser’s local storage for two things: preferences like the theme, and one anonymous id that is created in your browser and used only to count a visit once instead of once per page render. That id is not tied to your account and is not shared with anybody. No advertising cookies.

One more first-party cookie remembers where you first arrived from (the site that linked you, any campaign tag on the link, and the first page you saw); when you sign up, we link that and your answers to our two welcome questions to your account, and use it only to understand how people find splitscreen, with no ad trackers.

A few small first-party cookies only make pages draw correctly the first time: your time zone and language (so message times match your clock), whether you dismissed the receipt hint, and how many sign-in authenticators the security page should leave room for. They hold nothing else and are never shared.

Deleting your data

Revoke API keys any time in the app, and revocation is immediate. You can delete your account yourself, on the Account page in Settings. Deleting your account is permanent. If you own a room that other people are in, remove them or delete that room before you delete your account. If you have a Squad subscription, or unused credit we owe you a refund for, email [email protected] from the address on the account instead, and we will cancel or refund it and delete the account together within 30 days. While a workspace you belong to has a legal hold on you, or on a room you own, your account cannot be deleted until the hold is released.

Deleting your account cancels your subscription and closes your credit balance. We refund your unused balance to the card you paid with, where that card is still open. Credit you have already spent is not refundable, because we have already paid the model provider for those replies.

What goes: your profile and display name, your sealed API keys, your agent connections and the apps you signed in with, your credit balance, every room you own and everything in it, your memberships and budget caps in other people’s rooms, and your rows in the usage ledger.

What stays: messages you posted in a room somebody else owns keep their text, with your account id cleared, so the thread still reads in order for the people in it. The copy of each prompt we froze when a reply was made keeps the display name you used at the time, and the reply may too. Replies you asked for in those rooms stay, with the record of who asked cleared. Audit log rows stay with your id cleared, and analytics events keep a count and nothing about you. Room and workspace activity records stay with your id cleared until their own periods above end, and a workspace’s retention period and legal holds still apply to what you left in its rooms. Anything you posted on a published transcript is removed from that page, permanently, along with the replies you asked for. Receipts and tax records are kept for as long as the law requires: the record of each sale is moved to a separate table that has no column for your account id, and is deleted 7 years after the transaction. If you delete your account we keep a hash of your email address and its domain, and nothing else, so the starter credit is granted once.

Editing or deleting a message changes what the people in the room see. It does not change the copy of the conversation we froze when an AI answered it: that copy keeps the words as they were, and later replies in the same chat still read it. A room’s owner can remove a message any member posted in their room, as its author can. Under a legal hold, a held message cannot be deleted, and the text it had before an edit is kept for the workspace’s owners.

Contact

Email [email protected], or use the contact form. A message sent from the form is stored with the name and email you give, read only by us, and deleted after a year. A copy is emailed to our inbox through Resend so we can answer it, and ImprovMX forwards mail sent to [email protected] to the same inbox.