An unproduced script is the most private thing you own.

Row-level security in the database limits every script — and its comments, versions, breakdown, schedule and storyboard — to its owner and invited collaborators. The rule is enforced by Postgres itself, not only by the interface.

Readers can view and leave notes but never edit. If you start a script from a course assignment, that course’s instructor can read and comment on it, and still cannot change a word. Scriptory’s admin panel has no screen for opening a script, and nothing you write is listed in a public catalogue.

As you write, the editor keeps a copy of your draft in this browser, current to your last keystroke — and encrypts it before storing it: AES-256-GCM, a fresh nonce on every write, under two keys. One is generated in your browser and can be used but never read out by any script; the other comes from our server for your account and only ever lives in the open tab’s memory. Your cut-text stash and your legal-document drafts are sealed the same way. No script text is written to the browser’s storage or caches in readable form.

So a copy of your browser profile — a lost laptop, a backup, a shared computer after you sign out — holds no readable draft, and signing out deletes the copy and its keys. What encryption on the device can’t stop is something running inside the open page, such as a browser extension you’ve allowed to read this site; it sees what you see on screen. Lose signal with a script open and you keep writing; the edits merge into the shared draft when you reconnect. Opening a script needs a connection, because no readable copy is kept to open it from.

Scripty’s writing features run on Groq, whose contract forbids it from using anything we send to train or fine-tune any model. Groq keeps no copy by default; it may hold a request for up to 30 days only while troubleshooting a fault or investigating abuse. No writer’s script is ever sent to a free-tier API whose terms allow training on it.

Only the part of the script a feature needs — a few blocks, a scene, the recent pages — is sent, never your whole library. Our own servers keep no transcript: prompts and model replies are not logged, error logs have any quoted text stripped out, and what is stored is only what a feature makes for you to keep, like margin notes, tags and frames, inside your script.

Storyboard art without a key of yours runs on Cloudflare Workers AI, which neither trains on nor keeps what it renders. Art and scene video on your own OpenAI or Google key go to that provider under your agreement with them — OpenAI doesn’t train on API data and keeps it up to 30 days for abuse monitoring; Google’s paid API, which image and video generation require, doesn’t train on it and keeps it 55 days. Stored keys are encrypted with AES-256-GCM and only their last four characters are ever shown back. Inline suggestions, auto-read notes and image generation each have an off switch.

When you connect Scriptory to ChatGPT, Claude or Cursor, every tool declares whether it reads or writes, so your assistant can ask before it changes anything. Sharing and collaborator management aren’t exposed at all — a line in a script can’t talk an assistant into inviting someone.

Before an assistant’s edits, Scriptory saves a restore point in your version history. Each edit is checked against the document before it is saved and refused if it doesn’t read back exactly. You can disconnect an app from Settings at any time.

Export any script as PDF, Word, Fountain or plain text on every plan, and Final Draft (.fdx) on Pro. Storyboard images and uploads are stored privately and served only through links that expire in five minutes.

Deleting your account from Settings permanently deletes it and its records — scripts, comments, versions, storyboards and subscription. Uploaded files are cleared separately, and backups expire on a rolling cycle, normally within 90 days.