Summary
Your scripts remain on your computer. We do not receive them, read them, or store them, and we do not use anyone's work to train any system.
Two exceptions you should understand before relying on this:
01
When you share a script, the session is encrypted end to end. It travels over Cloudflare's network, but the key that decrypts it is generated on your computer and never leaves it except inside the link you send your collaborator. Because that key sits in the part of a URL that browsers never transmit to a server, Cloudflare relays your script without being able to read it, and neither can we. Comments are the exception: they are protected in transit but not end to end. Section 03 sets out both.
02
Anyone holding a share link can read that session, because the link carries the key. Treat it the way you would treat a password. Turning off sharing revokes every outstanding link immediately.
We hold your email address because you purchased a product or asked to receive updates. We do not sell it, we do not build profiles, and we run no analytics or advertising trackers anywhere.
01
What we collect
Purchase details. Gumroad processes your sale and provides us with your email address and an order record. We never see or store your card details.
Mailing list. If you submit your email address on our site — including on a trial or download page — you are consenting to receive periodic emails from us about product updates, news, and announcements. Nothing else is required or collected with it: no name, no company, no payment details. The address is stored in a private Google Sheet, used only to send those emails, and never sold, rented, or shared with third parties. One-click unsubscribe is included in every email, and you can ask us to delete the address entirely at any time by writing to hello@creative-divergence.com. We keep it until you unsubscribe or ask for its removal.
License activation. When you activate ScreenWrite, the application sends your license key and our product ID to Gumroad's license verification service. It sends nothing else.
Mailing list. If you submit your email address on our site — including on a trial or download page — you are consenting to receive periodic emails from us about product updates, news, and announcements. Nothing else is required or collected with it: no name, no company, no payment details. The address is stored in a private Google Sheet, used only to send those emails, and never sold, rented, or shared with third parties. One-click unsubscribe is included in every email, and you can ask us to delete the address entirely at any time by writing to hello@creative-divergence.com. We keep it until you unsubscribe or ask for its removal.
License activation. When you activate ScreenWrite, the application sends your license key and our product ID to Gumroad's license verification service. It sends nothing else.
ScreenWrite also generates a device identifier from your operating system (the hardware GUID on Windows, the platform UUID on macOS) and writes it to a file on your own computer, so that your activation remains tied to the machine on which it was activated. This identifier is never transmitted to us or to any third party. It exists only on your disk.
Support email. We retain support threads so that we have context if you contact us again.
02
What we do not collect
We do not collect, upload, read, or store the contents of your scripts: not pages, not lining, not shot lists, not file names, not character names. Your work is written to a local database on your own computer and remains there.
We run no analytics, no telemetry, no crash reporting, and no advertising trackers, in the application or on this website. This site sets no cookies. There is no tracking pixel, no session recording, and no third-party script observing your activity.
We do not sell data. We do not build profiles. We do not use your work, or anything derived from it, to train machine learning models.
We run no analytics, no telemetry, no crash reporting, and no advertising trackers, in the application or on this website. This site sets no cookies. There is no tracking pixel, no session recording, and no third-party script observing your activity.
We do not sell data. We do not build profiles. We do not use your work, or anything derived from it, to train machine learning models.
03
Collaboration in full
This section is set out in detail because it is the part that matters most if you work under a non-disclosure agreement.
ScreenWrite runs a small web server on your own computer. When you share a script, collaborators connect to that server through a temporary public address created with Cloudflare Tunnel. Cloudflare assigns a random address that forwards traffic to your machine and expires when the session ends.
Sharing always routes through Cloudflare. There is no local-network sharing link. Two people sitting in the same room still need a working internet connection to Cloudflare in order to collaborate.
The connection between your collaborator and Cloudflare is encrypted in transit. Inside it, the script is encrypted a second time, with a 256-bit AES-GCM key your computer generates when you start sharing. That key is placed in the fragment of the invite link, after the #. Browsers do not send fragments to servers, so the key reaches your collaborator without ever reaching Cloudflare. What passes through Cloudflare's network is ciphertext.
ScreenWrite runs a small web server on your own computer. When you share a script, collaborators connect to that server through a temporary public address created with Cloudflare Tunnel. Cloudflare assigns a random address that forwards traffic to your machine and expires when the session ends.
Sharing always routes through Cloudflare. There is no local-network sharing link. Two people sitting in the same room still need a working internet connection to Cloudflare in order to collaborate.
The connection between your collaborator and Cloudflare is encrypted in transit. Inside it, the script is encrypted a second time, with a 256-bit AES-GCM key your computer generates when you start sharing. That key is placed in the fragment of the invite link, after the #. Browsers do not send fragments to servers, so the key reaches your collaborator without ever reaching Cloudflare. What passes through Cloudflare's network is ciphertext.
What we are and are not claiming
We never receive your script. It does not pass through any server operated by Creative Divergence, because we operate none.
Cloudflare cannot read your script. This is a property of the design rather than a promise about their conduct: they do not hold the key, and they never see it.
The link is the credential. Anyone who obtains a share link obtains the key inside it. End-to-end encryption protects a session from the network carrying it; it cannot protect a link forwarded to the wrong person. Turning off sharing revokes every outstanding link immediately, and is the fastest way to cut off access.
The key changes every session. It is generated when you start sharing and discarded when you stop, so a link from an earlier session cannot decrypt a later one.
Comments are not end-to-end encrypted. Notes written on a script travel as ordinary requests over the same tunnel. They are protected in transit, but not sealed against Cloudflare the way the script is. If a comment would itself be sensitive, treat it with the caution this section describes for scripts.
We keep no copy of a session. The public address is temporary and expires with the session. The only copies are on the machines of the people in it.
Who can join, and for how long
Only the person hosting a session needs a license. Collaborators you invite can join and work without buying anything.
Invite links are valid for 48 hours, and they are not single-use. Anyone holding the link can join within that window. We tried making them one-time and it did not survive contact with how links actually travel: iOS Safari pre-fetches them and messaging apps request them to build previews, either of which consumed the link before the intended recipient ever opened it. Treat an invite link as a password with a two-day life. Turning off sharing immediately revokes every outstanding invite for that project, used or unused, and is the fastest way to cut off access.
Trusted device links are different and last much longer. A trusted device token is issued per project, capped at three per project, and remains valid for ten years unless you revoke it. It is intended for a device that rejoins the same project repeatedly, such as a script supervisor's tablet. You can see the devices issued for a project and revoke any of them individually at any time.
Invite links are valid for 48 hours, and they are not single-use. Anyone holding the link can join within that window. We tried making them one-time and it did not survive contact with how links actually travel: iOS Safari pre-fetches them and messaging apps request them to build previews, either of which consumed the link before the intended recipient ever opened it. Treat an invite link as a password with a two-day life. Turning off sharing immediately revokes every outstanding invite for that project, used or unused, and is the fastest way to cut off access.
Trusted device links are different and last much longer. A trusted device token is issued per project, capped at three per project, and remains valid for ten years unless you revoke it. It is intended for a device that rejoins the same project repeatedly, such as a script supervisor's tablet. You can see the devices issued for a project and revoke any of them individually at any time.
Two practical limits worth knowing
A trusted device link stops working when you restart ScreenWrite, for two reasons: the public address is newly generated each launch, and the encryption key is new each session. The device token itself remains valid; the device needs a current link.
Revoking a device token cuts off access immediately, and it is the correct action if a device is lost or a person leaves the production.
Your local network
ScreenWrite's server listens on your local network from the moment the application opens, on port 10450 where available. On a trusted home or office network that is unremarkable. On a shared network, such as a hotel or a public venue, other people on that network can reach that port. Reaching it is not the same as getting in, since access requires a valid invitation or device token, but if you are working somewhere untrusted you should know the port is open.
ScreenWrite opens the Cloudflare tunnel only when you first press Share. Until then the application makes no outbound connection to Cloudflare.
04
Updates
ScreenWrite checks GitHub for a new version when it launches. This transmits your IP address to GitHub, as any web request does. It sends no other information about you, your machine, or your work. Installer downloads are likewise served by GitHub. GitHub's privacy practices govern their handling of that information.
05
Third parties involved
Gumroad
Payments, license verification, license delivery, and receipts. Merchant of record.
Cloudflare
The tunnel used for remote collaboration sessions, as described in section 03. See Cloudflare's privacy policy.
GitHub
Update checks and installer downloads.
Vercel
Hosts this website. Their server logs include IP addresses and browser user agents, as all web hosting does.
Google
The mailing list form submits to a Google Apps Script endpoint, and addresses are stored in a Google Sheet.
ImprovMX
Forwards email sent to our addresses to the mailbox we read it in.
This is the complete list. There are no advertising partners, data brokers, or analytics vendors, because we use none.
06
Retention
Purchase and license records: seven years. Tax and accounting law requires us to retain transaction records, and seven years covers the longest period in which we could reasonably be asked to produce them. Our legal basis for retaining this data is compliance with a legal obligation.
Mailing list: until you unsubscribe. One click, in every email.
Support email: until it is no longer useful, which in practice means several years, as earlier threads are often the fastest route to resolving a recurring problem.
Collaboration sessions: nothing is kept by us. We hold no session data because none of it reaches us.
Trusted device tokens: up to ten years, on your own computer. These are stored in ScreenWrite's local database on the host machine, never on ours. They persist until they expire or until you revoke them, whichever comes first. Invite tokens in the same database expire after 48 hours. Notes written by collaborators are also saved to the host's local database and stay there until deleted, in the same way the rest of the project does.
Removing your email address from our records does not invalidate your license. Your license resides in your key and on your machine.
Mailing list: until you unsubscribe. One click, in every email.
Support email: until it is no longer useful, which in practice means several years, as earlier threads are often the fastest route to resolving a recurring problem.
Collaboration sessions: nothing is kept by us. We hold no session data because none of it reaches us.
Trusted device tokens: up to ten years, on your own computer. These are stored in ScreenWrite's local database on the host machine, never on ours. They persist until they expire or until you revoke them, whichever comes first. Invite tokens in the same database expire after 48 hours. Notes written by collaborators are also saved to the host's local database and stay there until deleted, in the same way the rest of the project does.
Removing your email address from our records does not invalidate your license. Your license resides in your key and on your machine.
07
Your rights
You may ask us to disclose what we hold about you, to correct it, or to delete it. Email {{ privacyEmail }} and we will act on the request.
If you are in the EU or the UK, the GDPR grants you these rights formally, along with the right to object to processing, to request your data in a portable format, and to lodge a complaint with your national data protection authority. If you are in California, the CCPA grants you comparable rights. We honor these requests from anyone, anywhere, regardless of whether the law in your jurisdiction requires it.
If you are in the EU or the UK, the GDPR grants you these rights formally, along with the right to object to processing, to request your data in a portable format, and to lodge a complaint with your national data protection authority. If you are in California, the CCPA grants you comparable rights. We honor these requests from anyone, anywhere, regardless of whether the law in your jurisdiction requires it.
On data portability. Your work is already yours, already stored on your own disk, and already in open formats. There is nothing for us to export, because we never held it. You can move everything to another application at any time using the Fountain or Final Draft export.
08
Security
If you identify a security vulnerability in ScreenWrite or on this website, email {{ securityEmail }}. We will acknowledge the report, and we will not take legal action against anyone who reports a genuine issue in good faith.
09
Changes
New versions of this policy are posted here with a new effective date. If we begin collecting something new, or add a third party to section 05, we will state so in the release notes and to the mailing list rather than amending this page silently.
10
Contact
Creative Divergence LLC · North Carolina, United States
{{ privacyEmail }}
{{ privacyEmail }}