last updated September 3, 2026
The short version: we store what the product needs, encrypt what matters most, and sell nothing. When you buy credits, Stripe handles the card and we handle the receipt.
Your account (email, display name), your projects and messages, the AI replies your rooms generate, attachments you upload, files the code sandbox produced, your budget caps, and a per reply ledger with token counts and costs. Rooms are visible to their members, which is the product.
If you buy credits or a subscription we also store your credit balance, every ledger entry that moved it, your receipts, and the customer and payment identifiers Stripe gives us. If you saved a provider API key we store it sealed, in the form described on the Security page.
Keys are sealed with AES-256-GCM under a per-key data key, which is itself wrapped by a key held in a hardware key-management service. They are decrypted only in server memory at the moment a room you fund makes a request, are never written to logs, and are never shown to anyone after saving — including you. A copy of our database alone cannot reveal them.
Messages sent to an AI go to that thread’s provider: Anthropic, OpenAI or Google. They process it to produce the reply. Which account it runs on depends on how the room is paying: your own API key, or ours when you spend credits.
Under all three providers’ API terms, content sent through the API is not used to train their models by default. Google draws that line by tier: free tier Gemini traffic can be used to improve their products, paid tier traffic is not. splitscreen uses paid tier Gemini access. The relevant documents are the Anthropic Commercial Terms of Service, the OpenAI API data usage policy, and the Google Gemini API Additional Terms.
All three may hold content for a short window for abuse monitoring, on their own schedule and under their own policy, typically measured in days rather than months. That is their commitment, not something we can enforce.
We add no third party analytics, ad trackers or data brokers. The other companies that process data for us: Supabase (database, auth, realtime), our hosting provider, and Stripe (payments).
We do keep our own product analytics, in our own database and nowhere else: counts of things like a page being opened, a room being made, an invitation being accepted and a reply being answered. Each one is recorded as an event name with, depending on the event, an account id, a room id, and the anonymous browser id described under Cookies and storage — and never with message content, names or email addresses.
Only what the reply needs, and only from the thread you are in:
Two specifics worth knowing. When you switch on the code sandbox, that turn’s files are uploaded to the provider’s own file store — Anthropic’s Files API for Claude, OpenAI’s for GPT — so the sandbox can open them off disk, which means they sit in that provider account rather than only passing through. Both are uploaded with a one-hour expiry and are never reused between turns, and the GPT copies are deleted as soon as the reply finishes. A zipped folder can only be sent this way, which is why it needs the sandbox switched on. And files the sandbox writes are copied back into our own private storage so the room can read them, where the same member-only access rules cover them as every other file in the thread.
We never send your API keys, your payment details, or anything from a room you are not asking in.
Stripe processes every payment. Stripe collects your card details directly and holds them. We never receive your card number and never store it.
What we keep is the accounting: your Stripe customer id, the payment and invoice ids, the amount, the date, the tax charged, and the card brand and last four digits as Stripe reports them back. That is what lets us answer “what did I pay for”, issue a refund, and file a tax return.
Stripe is a processor working for us, and also handles that data for its own fraud prevention and legal compliance, under its own privacy policy.
We use cookies for sign-in sessions, and your browser’s local storage for two things: preferences like the theme, and one anonymous id that is created in your browser and used only to count a visit once instead of once per page render. That id is not tied to your account and is not shared with anybody. No advertising cookies.
Revoke API keys any time in the app, and revocation is immediate. To delete your account, email contact@splitscreen.chat. We will confirm and complete it within 30 days.
Deleting your account cancels your subscription and closes your credit balance. We refund your unused balance to the card you paid with, where that card is still open. Credit you have already spent is not refundable, because we have already paid the model provider for those replies.
Two things survive a deletion. Ledger rows that other members’ room accounting depends on are kept in de-identified form. Receipts and tax records are kept for as long as the law requires, with your messages removed.
contact@splitscreen.chat