Last updated: 15 September 2026
This policy describes what MiraiScript actually stores, where it goes, and how long it stays. It is written against the running system rather than from a template, so where the product does not do something, it says so.
MiraiScript is operated by TODO: legal entity name and address. For any privacy question, or to exercise a right described below, contact TODO: contact email.
Your account record holds exactly these fields:
@, and you can change the name yourself in your account settings. We do not ask for your real name; We also keep one row per device you are signed in on, so you can see them and sign any of them out from your account settings. Each row holds a coarse description of the device worked out when you signed in (for example “Chrome on macOS”), when that sign-in happened, and when it was last used. We do not keep the browser's full user-agent string: it is read once to produce that short description and then discarded. A row is removed once it can no longer be used to sign in.
We do not collect or store your phone number, date of birth or card details, and your postal address reaches us only as the billing address on a paid plan's billing records (section 8). Your IP address is not part of your account record. It is recorded only in our server logs, and only against security events such as signing in, changing your password or accepting a share link; section 6 describes those logs and how long they are kept.
When somebody shares a project with you, you can open it and start working without signing up first. We create a guest account with a placeholder email and a random password so your work has somewhere to live. If you later claim the account, it keeps the same identity and all your work carries over.
Scripts, storyboards, cast entries and version history are your content. We store it to provide the service and for no other purpose. We do not sell it, share it with advertisers, or use it to train anything.
Documents, embedded images and collaboration snapshots are stored as content-addressed objects in Cloudflare R2. Canvas artwork, the database records and version history are stored in our PostgreSQL database.
Be aware of the limits of that promise. Content is encrypted in transit (TLS) and at rest to the extent our storage providers do so by default. There is no end-to-end or application-level encryption, which means our operators technically hold the credentials that could read your content. Not reading it is a policy commitment, not a technical impossibility. Please do not treat MiraiScript as a vault for material that would be dangerous in someone else's hands.
There is no generative AI in this product. No model provider receives your work, no part of your script or artwork is used as training data, and there is no AI feature to opt out of. As of the date above, the codebase contains no integration with any AI or machine-learning service whatsoever.
We set two cookies that are strictly necessary to operate the service, and one analytics cookie that is set only with your consent where the law requires it. No advertising network places a cookie on this site.
refresh_token keeps you signed in. It is HttpOnly (unreadable by JavaScript), SameSite=Strict, sent only to our authentication endpoints, and expires after 30 days. media_session proves to our image server that your browser belongs to a signed-in user, so images in your documents load. It is HttpOnly, SameSite=Lax, and expires after 12 hours. ph_… (PostHog) is the analytics cookie described in section 6. It remembers which visitor you are between visits, so that a sign-up can be attributed to the advertisement that brought you and a session recording can be tied to a visit. If you are in the EU, the EEA, the UK or Switzerland it is set only after you accept the analytics prompt, never when you decline; everywhere it is left unset when your browser sends a Global Privacy Control or Do Not Track signal. It lasts a year. You can change your choice at any time from the analytics control in this section or under Account, then Your data. We also use your browser's local storage to remember interface preferences (panel sizes, brush settings, your last session), a copy of your basic account details so the app can render immediately on load, and your analytics choice. Those stay in your browser. The analytics tool keeps a small amount of its own state there as well, for the same purpose as its cookie and under the same choice.
While you are signed in and using the drawing canvas, the app sends diagnostic events to our own servers to find performance faults such as dropped frames and input stalls. This diagnostic channel is first-party: it goes to our own servers and to nobody else.
What those events contain:
It contains no document text, no artwork, and no names or email addresses. Nothing is sent on this channel while you are signed out. Batches are deleted after 14 days.
To turn it off entirely, set ms-telemetry to off in your browser's local storage for this site. There is currently no settings toggle for this, which we intend to add.
We use PostHog to understand how this website and the app are used: which pages people read and for how long, where a sign-up is abandoned, which features are used and which are not, and how long people spend writing against drawing. That is how we decide what to build and what to fix, and it is what tells us whether an advertisement was worth paying for.
What it records:
What is deliberately not there: your email address and name are never sent to the analytics tool; once you sign in it knows you by your account identifier. The query string and fragment of a page address are stripped before it is sent, apart from the campaign tags an advertisement adds, because fragments carry share-link secrets. Your IP address is used to work out a country and a region, then discarded before anything is stored.
If you are in the EU, the EEA, the UK or Switzerland, none of the browser-side collection above starts until you accept the prompt shown on your first visit. Declining means you are counted as an anonymous visit for that day and nothing more: no cookie, no identity, no recording. Everywhere else it is on unless your browser sends a Global Privacy Control or Do Not Track signal, which we honour as a decline. You can change your choice at any time from the analytics control in section 5 or under Account, then Your data. Events are kept for 1 year and recordings for 30 days.
Our servers write a line for each request they answer, so that we can find faults and understand failures after they happen. A line holds the time, the method and path of the request, the response status, how long it took, a random identifier for that one request, and your account identifier when you are signed in. It holds no IP address and no user-agent string.
Separately, we record an entry for each security-relevant action, and these do include the IP address the request came from. They are the acts worth being able to account for later, whether or not they succeeded:
An entry holds the action, whether it worked, the address, your account identifier, and a short reason when something was refused. It never holds an email address, a password, a token or a share-link secret, and a refused sign-in deliberately does not record which account it was aimed at. We keep this because being able to answer “who did this, and from where” is what makes a compromised account recoverable, and because it is the ordinary standard for security logging. Our basis for it is our legitimate interest in keeping the service secure. Both kinds of line are deleted after 30 days.
We send only transactional email: things you asked for, or need to know about your account. A password reset, confirming an address change, a notice that an unfamiliar device signed in, an invitation to a project, and warnings before something is deleted or a limit is reached. There is no marketing list and nothing to unsubscribe from.
We do not track whether you open these messages, or which links you follow. There is no invisible image in them, and the links are not rewritten to pass through a redirect first: they go where they say they go.
That is a deliberate choice rather than an oversight, and the reason is worth stating. Several of these links carry a single-use secret in the part of the address after the #, which your browser never sends to any server. Click tracking works by replacing every link with one that passes through the email provider, which would hand that secret to them. Your password reset is not worth a statistic.
What we do learn is what the delivery itself tells us: whether the provider accepted the message, and whether it bounced or was reported as spam. We use bounces and spam reports to stop mailing an address that does not work, which is the whole of what that record is for.
We rely on these providers, and no others, to run the service:
No advertising network's code runs on this site, and we use no hosted error-tracking service. We do advertise elsewhere: when you arrive from an advertisement on Meta, TikTok or Reddit and later create an account, start a trial or subscribe, we send that platform a conversion signal so that we can tell which advertisements work. It carries the click identifier the advertisement put into the address you arrived on, and never your name or email address. We do not send marketing email: everything we send is about your account or a project someone has shared with you, and there is nothing to unsubscribe from because there is no mailing list to be on.
Paid plans are sold through Link, part of Stripe. Stripe, through Link, is the merchant of record: it sells you the subscription and processes the payment, under Stripe's privacy policy, which also covers Link. When you subscribe to a paid plan, you enter your card details on the checkout and billing pages Stripe runs: they go to Stripe and never touch our servers. Stripe also asks for the name and billing address it needs to work out tax. What we store on our side is the link to your Stripe customer record, the state of your subscription, and a log of the billing events Stripe sends us about it, including any refund or dispute of a payment and how it ended. That log includes the name, email address and billing address Stripe reports, but never your card details. Beside those events it keeps a record of what we did with them: which Stripe customer record your account is linked to, and each change to your plan they caused. We keep that log as the record of what happened to your subscription. If you delete your account, any subscription is set to end with the period already paid for, and when the account is purged we ask Stripe to delete your customer record; the log of billing events stays, because tax and accounting law require us to keep it. You can also ask Stripe directly to delete what it holds about your purchases and your Link account; Stripe then cancels your subscription as well.
A share link lets you invite someone into a project as a viewer or an editor. The secret in the link is held only as a hash on our servers and travels in the part of the URL that browsers never send to a server. Anyone holding the link can join, so treat it as the key it is. You can revoke a link at any time, which also removes the people it admitted.
Collaborators on a project can see each other's display names and email addresses. If you would rather not reveal your address to a collaborator, use an account whose email you are comfortable sharing.
Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to processing. Export and deletion are buttons in the app, under Account, then Your data.
Export gives you one zip of everything you own: each document as a Word file and in the app's own format, your worldbuilding, members, share links and fonts as JSON, and, if you choose, every canvas as a layered Photoshop file, with a manifest that lists what is inside. Projects shared with you are named, not copied.
Delete schedules your account for deletion 30 days out. Nothing is removed before then, signing in cancels it, and a project you share can be handed to one of its collaborators as part of the request. If you cannot sign in, email TODO: contact email and we will carry out either request by hand and confirm when it is done.
You can change your password yourself in your account settings, and reset one you have forgotten from the sign-in page: we email you a single-use link that works for an hour. You can also change the address on your account, which sends a confirmation to the new one and a warning to the old one, so it cannot happen quietly.
MiraiScript is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
Our providers store and process data in the United States and other countries. PostHog, which holds the analytics events and recordings, does so in the United States under its data processing agreement, which incorporates the EU standard contractual clauses and the UK addendum. If you are in the UK, EEA or Switzerland, the rest of your data is transferred outside your home jurisdiction on the basis of TODO: transfer mechanism, e.g. Standard Contractual Clauses.
If we change this policy in a way that materially affects you, we will update the date at the top and, where we can, tell you in the app. Continuing to use MiraiScript after a change means the updated policy applies.
This policy is governed by the laws of TODO: governing jurisdiction.
See also our Terms of Service, our plans, or who builds this.