Security

You own every word of your script. We don't claim rights to any of it. We don't use your script to train AI models. We don't sell it. We don't share it. We don't analyze it for patterns we sell to someone else.

The AI we use — Anthropic's Claude — is contractually prohibited from training on API data under their Commercial Terms. Their default API data retention is 7 days. Zero Data Retention is on our roadmap.

If a producer, executive, or industry reader uploaded your script through the Service without your authorization, you still own your work, and our confidentiality obligations run to the script itself — not solely to the person who pressed the upload button. See our DMCA Policy for how to file a takedown notice.

Here's the path your script takes, end to end:

Your browser → scriptcoverage.ai (HTTPS, TLS 1.2+) → Vercel (US regions) → Supabase (Postgres, AWS us-east-1) → Anthropic's API (HTTPS) → back to you.

• Every hop is encrypted in transit (TLS).
• Data at rest is encrypted (AES-256) on both Supabase and Vercel.
• Your password is never stored in plaintext. It's hashed with bcrypt by Supabase Auth before it ever touches the database.
• Your uploaded PDF is stored in encrypted blob storage, scoped to your user account, and accessible only through authenticated requests on your behalf.

When the analytical pipeline runs, we send your script and the relevant pass-specific context to Anthropic's API in a series of requests — one per pass. Claude responds. We stream the response back to you and save it to your coverage record. When you chat with dAIvid in the Q&A, we send your message, the coverage context, and your conversation history in a single request. Claude responds. We stream the response back and save it to your Q&A transcript.

Anthropic's track record matters here: SOC 2 Type II, ISO 27001, ISO 42001. Their Commercial Terms prohibit training on API data. Default 7-day retention on their side.

On our side, we log request metadata — token counts, model used, timestamps — so we can bill accurately and catch abuse. We do not maintain a separate observability log of the content of your messages or your coverage. Your Q&A transcripts and coverage outputs live in your account so you can return to them. See section 7 below for the narrow human-review exception.

Only you can see your scripts, coverage, and Q&A. Period.

The technical mechanism is Row-Level Security (RLS), enforced inside Postgres — not at the application layer. Every query that touches your data is scoped to your user ID by the database itself. We don't let the app code be the only gatekeeper; the database refuses to serve data that isn't yours.

Our internal admin dashboard requires an explicit is_admin flag on a user record. Access is logged.

When an industry user uploads a script for evaluation, their coverage outputs are scoped to their account in the same way — visible only to them. The Service does not share coverage between accounts, including between a producer who evaluated a script and the writer who wrote it. If you want to share your coverage with someone, you can — but the Service won't do it for you.

Your data belongs to you. You can download or delete it at any time.

• Download My Data — in Settings → Account. One click. Every script you uploaded, every coverage you received, every Q&A transcript, every revision roadmap, delivered as a ZIP file.
• Delete My Account — removes every row of your data, cancels any active credit packs in accordance with our refund policy, and confirms by email. No soft-delete games. Gone means gone.

When you leave, we don't keep shadow copies for analytics. We don't keep "anonymized" training sets. Your work leaves when you leave.

No system is bulletproof. We harden ours, but we also tell you the truth: if a breach happens, we notify affected users within 72 hours. Not 72 days. Not in a class-action letter a year later.

We use industry-standard security headers — Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

We don't ship third-party analytics trackers or cookies that follow you around the web. The only tracking we do is what's needed to run the product — authentication, session state, billing.

Here's something I want to be explicit about, because the rest of this page is about machines and infrastructure, and this part is about me.

I read a small sample of coverage outputs and Q&A transcripts on an occasional basis. This is quality control. I'm checking that the methodology is being applied accurately, that dAIvid is responding well in conversation, and that the product is doing what I built it to do. No one else has this access — not a contractor, not a team, not Anthropic, not anyone at Every Story LLC except me.

This review is rare, it's never used to evaluate you as a writer, and it's never used to make a decision about your account. If you contact me about a problem with your coverage, I may also read the content involved to resolve your request — that's the other circumstance.

If you want to opt out of quality control sampling entirely, email privacy@scriptcoverage.ai and we'll exclude your account. Issue resolution is handled case by case at your initiation.

This disclosure is in the Privacy Policy too, but I wanted it on this page because disclosure is how you earn the right to handle someone's work.

— David

Found a vulnerability? Email security@scriptcoverage.ai.

We won't sue you for reporting in good faith. We'll thank you. If the finding is material, we'll credit you on this page (with your permission).

Please don't disclose before we've had a reasonable chance to fix it — the standard 90-day window works for us.