TallYarn
← TallYarn

Privacy Policy

Last updated October 9, 2026.

Who we are

TallYarn is a screenwriting board run by Simpler Development LLC · 1425 South 12th St, Side 2, Philadelphia, PA 19147, USA · info@danielpcoyle.com. This policy says what we collect, why, who sees it, and what you can do about it. It covers the website, the iOS app, the connector for AI apps (MCP) and the Claude Code plugin.

What we collect

  • Your account: your name, email address and a password, which is stored hashed, so we can’t read it.
  • What you make: stories, scenes and scripts, beats, story bibles, character arcs, comments, drafts and version history, tags, uploaded pictures and files, workspace names and templates, and title pages, which may hold an author name and contact details you type.
  • Who you work with: workspace membership and roles. An invitation you send carries the invitee’s email address, your name and email, and the workspace name.
  • Your preferences: whether you want notification emails. View settings (zoom, panel widths, the demo board) stay in your browser’s local storage and never reach us.
  • Sessions: when you sign in we record the session’s IP address and browser (user agent), for security. A session lasts seven days.
  • Billing, on the Room plan: a Stripe customer and subscription id, the plan, interval, seat count and renewal date. Card details go straight to Stripe and never reach us.
  • Spotify, if you connect it: an encrypted access token, your Spotify display name, and the tracks you attach to scenes (name, artists, album, artwork link).
  • An AI app, if you connect one: the app that connected, the permissions you granted, and the encrypted tokens that keep it connected.
  • Share links: how many times a link was opened and when it was last opened. Nothing about who opened it.
  • Staff records: when our staff act on an account (a ban, a plan change) the record names the account. We keep these for two years, even after the account is deleted, to answer disputes and abuse reports.

We don’t collect your date of birth, phone number, address, location or contacts, and nothing from your device beyond what a browser sends. We use no analytics, advertising or tracking tools.

How we use it

  • To run the service: to show you your work, let co-writers work on it with you live, play music you attached, and generate pictures you asked for.
  • To email you: password resets; invitations you or others send; a note when someone puts you on a scene or replies to you. Notification emails have an off switch on your Account page. We send no marketing email.
  • To bill you for Room, through Stripe.
  • To keep the service safe: session records, staff records, and refusing abuse.

Where the law asks for a legal basis (the EU, the UK and similar), ours are: performing our contract with you; our legitimate interests in security, preventing abuse and keeping accurate records; and your own instruction, when you connect an AI app or Spotify or ask for a picture.

Who we share it with

These providers help us run TallYarn. Each processes data on our instructions under a data processing agreement, and none may use it for its own purposes.

  • Vercel (United States) hosts the website and the API.
  • Supabase (United States, AWS Oregon) runs the database, where everything above is stored.
  • Object storage in the United States holds uploaded pictures and files, served only through TallYarn’s own access checks.
  • Stripe handles payments. It receives the workspace name and the billing manager’s email, and collects card details itself under its own privacy policy.
  • Resend sends our email. It receives each recipient address and message; a comment notification includes up to 500 characters of the comment.
  • OpenAI generates pictures. When you ask for a portrait or a picture we send the character’s, prop’s or location’s name, summary and notes (the first 2,000 characters), or the scene’s heading, title and action, plus any request you typed. Under its API terms OpenAI doesn’t train on this and keeps it for up to 30 days for abuse monitoring.
  • Spotify, only if you connect it. Your browser talks to Spotify directly to play music; Spotify’s privacy policy covers your Spotify account.
  • The maker of an AI app you connect (for example Anthropic for Claude, or OpenAI for ChatGPT), only if you connect one. The app reads and writes your stories at your request, through your own account with its maker and under that maker’s terms and data settings. TallYarn sends nothing to it on its own.
  • A realtime server of ours relays live cursors, your name and avatar, and which scene you have open to co-writers in the same story. It stores nothing.

We don’t sell personal data or share it with advertisers. Beyond the above we share it only when the law requires, to protect someone’s safety or our rights, or as part of a sale of the business, which we’d tell you about first.

Where it’s kept

Our servers are in the United States. If you’re in the EU, the UK or Switzerland, your data is transferred there. We rely on our providers’ certifications under the EU-US and UK Data Privacy Frameworks where they hold them, and on standard contractual clauses otherwise.

How long we keep it

  • Your account and everything in it: until you delete it.
  • Sessions: seven days.
  • Deleted files: removed from storage shortly after you delete them.
  • Backups: up to 30 days.
  • Billing records: as long as tax law requires, which is seven years.
  • Staff records: two years.

Your rights

Wherever you are, you can:

  • See and download everything. Account → Download your data gives you a JSON file of your profile, workspaces and stories. Scripts also export to PDF, Fountain and Final Draft.
  • Correct it in the app.
  • Delete it. Account → Delete account. Workspaces where you’re the only member are deleted with their stories and files. In workspaces you share, your scenes, comments and drafts stay for your co-writers, without your name. Subscriptions are cancelled and your Stripe customer record is deleted.
  • Turn off notification emails and disconnect Spotify or an AI app on your Account page. Access ends at once.

In the EU and the UK you also have the right to object to or restrict processing, and to complain to your data protection authority. Write to us at the address below for anything you can’t do in the app. We answer within a month.

Children

TallYarn is for people aged 16 and over. We don’t knowingly keep an account of anyone younger; tell us and we’ll delete it.

A share link shows a script to anyone who has the link, without signing in. Links can be set to expire and can be revoked at any time. The pages are marked not to be indexed by search engines.

Security

Passwords are hashed. Spotify and AI app tokens are encrypted. Connections use TLS. Files are served only through access checks. Staff access is logged. If a breach affects you, we’ll tell you and the authorities as the law requires.

Changes and contact

We’ll post changes here with a new date, and email you about any that matter. Questions, requests and complaints: Simpler Development LLC · 1425 South 12th St, Side 2, Philadelphia, PA 19147, USA · info@danielpcoyle.com. Copyright and abuse reports: Copyright and reports.