Last updated: 3 August 2026
This policy describes what MiraiScript actually stores, where it goes, and how long it stays. It is written against the running system rather than from a template, so where the product does not do something, it says so.
MiraiScript is operated by TODO: legal entity name and address. For any privacy question, or to exercise a right described below, contact TODO: contact email.
Your account record holds exactly these fields:
@. We do not ask for your real name; We do not collect or store your IP address in the database, phone number, postal address, date of birth, or any payment details.
You can start using MiraiScript without signing up. We create a guest account with a placeholder email and a random password so your work has somewhere to live. If you later claim the account, it keeps the same identity and all your work carries over.
Scripts, storyboards, cast entries and version history are your content. We store it to provide the service and for no other purpose. We do not sell it, share it with advertisers, or use it to train anything.
Documents, embedded images and collaboration snapshots are stored as content-addressed objects in Cloudflare R2. Canvas artwork, the database records and version history are stored in our PostgreSQL database.
Be aware of the limits of that promise. Content is encrypted in transit (TLS) and at rest to the extent our storage providers do so by default. There is no end-to-end or application-level encryption, which means our operators technically hold the credentials that could read your content. Not reading it is a policy commitment, not a technical impossibility. Please do not treat MiraiScript as a vault for material that would be dangerous in someone else's hands.
There is no generative AI in this product. No model provider receives your work, no part of your script or artwork is used as training data, and there is no AI feature to opt out of. As of the date above, the codebase contains no integration with any AI or machine-learning service whatsoever.
We set two cookies. Both are strictly necessary to operate the service, and we use no advertising, analytics or tracking cookies of any kind.
refresh_token keeps you signed in. It is HttpOnly (unreadable by JavaScript), SameSite=Strict, sent only to our authentication endpoints, and expires after 30 days. media_session proves to our image server that your browser belongs to a signed-in user, so images in your documents load. It is HttpOnly, SameSite=Lax, and expires after 12 hours. We also use your browser's local storage to remember interface preferences (panel sizes, brush settings, your last session) and a copy of your basic account details so the app can render immediately on load. That data stays in your browser.
While you are signed in and using the drawing canvas, the app sends diagnostic events to our own servers to find performance faults such as dropped frames and input stalls. This is first-party only; it is never sent to any third party.
What those events contain:
It contains no document text, no artwork, and no names or email addresses. Nothing is sent while you are signed out, so browsing this website sends us no diagnostics at all. Batches are deleted after 14 days.
To turn it off entirely, set ms-telemetry to off in your browser's local storage for this site. There is currently no settings toggle for this, which we intend to add.
We rely on these providers, and no others, to run the service:
We do not use any advertising network, analytics product, session-replay tool or hosted error-tracking service. We do not use a payment processor, because we do not currently take payments. We do not send marketing email.
A share link lets you invite someone into a project as a viewer or an editor. The secret in the link is held only as a hash on our servers and travels in the part of the URL that browsers never send to a server. Anyone holding the link can join, so treat it as the key it is. You can revoke a link at any time, which also removes the people it admitted.
Collaborators on a project can see each other's display names and email addresses. If you would rather not reveal your address to a collaborator, use an account whose email you are comfortable sharing.
Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to processing.
MiraiScript does not yet have a self-service "delete my account" or "export my data" button. We are not going to pretend otherwise. Until it ships, email TODO: contact email and we will carry out the request by hand and confirm when it is done. Building both into the product is on our roadmap.
There is also currently no password reset flow. If you lose your password, contact us rather than assuming the account is gone.
MiraiScript is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
Our providers store and process data in the United States and other countries. If you are in the UK, EEA or Switzerland, your data is transferred outside your home jurisdiction on the basis of TODO: transfer mechanism, e.g. Standard Contractual Clauses.
If we change this policy in a way that materially affects you, we will update the date at the top and, where we can, tell you in the app. Continuing to use MiraiScript after a change means the updated policy applies.
This policy is governed by the laws of TODO: governing jurisdiction.
See also our Terms of Service, our plans, or who builds this.