Privacy Policy

1Who we are

PalaFilm Movie Management ("the Application") is provided by Catchwave SRL, a company registered in Romania ("we", "us", "the Operator").

2The short version

3What data the Application processes

Everything you put into the Application - imported screenplays (.fountain, .fdx, PDF), Movie Magic files (.msd), project files (.pala), scene breakdowns, shooting schedules, cast and crew records (which may include names, phone numbers and email addresses), locations, availability, budgets, expenses, vendor records, daily production reports, story outline cards, notes and character and location profiles - is processed locally in your browser, except when you deliberately share or process selected content through a paired peer, authorised mailbox/backup node, optional sync endpoint or configured AI provider.

Peer Sync, QR pairing and camera access

• WebRTC Peer Sync exchanges CRDT operations and project snapshots directly between devices you pair. PalaFilm additionally encrypts every application message with AES-GCM.
• Each peer session derives a new key through ephemeral ECDH. Device ECDSA private signing keys are non-extractable and remain in local IndexedDB.
• Signed handshakes and CRDT operation signatures identify the authoring device. Trusted public-key fingerprints are stored locally and can be revoked by the user.
• Multi-operation project changes are exchanged as signed transaction bundles. The receiving device verifies the bundle digest, device signature, operation signatures and access scope before applying the complete change, then returns a signed acknowledgement.
• Production Mesh invitations and membership certificates are signed by the project's local authority and bind a role, scope and department access to one device. Selective sync filters CRDT fields for both sender and recipient.
• An authorised permanent node may offer a recipient-only encrypted mailbox. It stores ciphertext, recipient/project identifiers, timestamps and delivery state; only the destination device has the private key needed to decrypt content.
• A computer you explicitly enable as a Permanent Backup Node may retain signed project replicas. Transfers use the authenticated encrypted peer channel, and each replica is encrypted again at rest with a non-exportable AES-GCM vault key held by that node.
• Recovery requires QR pairing with the node and explicit approval by the backup-node operator. PalaFilm does not operate or access these nodes.
• STUN may process network addresses to help devices discover a route, but it does not receive project content.
• The optional Secure Collaboration Gateway processes room identifiers, device routing identifiers, presence timestamps, signed WebRTC signaling and encrypted relay envelopes. Its rooms are held in memory only and expire; it receives no project decryption key.
• QR invitation and offer/answer codes contain signed membership or temporary connection metadata. The QR generator runs locally and uses no external QR service.
• Camera access is requested only when you choose Scan with camera. Frames are decoded locally, are not recorded and are not stored by the Application.

Optional AI connector and sync endpoint

• AI is off until you choose a provider in System → AI Connector and connect it. The Application contacts no AI provider before that, and every core function works without one.
• Direct connection with your own key. You can connect OpenAI (ChatGPT), Claude (Anthropic), Google Gemini, Mistral, xAI (Grok), DeepSeek, Groq, OpenRouter, Perplexity, Cohere or Together AI. Your browser then sends requests straight to that provider; the Operator is not in the path and sees neither the request nor the key. The page's security policy allows connections to these eleven provider addresses only.
• What is sent. Load models sends only your key, to obtain the list of models it may use. Test & connect sends a one-word test with no project data. An AI request you trigger later contains the task, the model, instructions and the limited project context the selected feature needs, which can include names, roles or other personal data held in the project.
• Your key. A pasted key is kept in page memory for the current session only. It is never written to localStorage, IndexedDB, project files or exports, and it is gone when the page closes.
• Sign in with OpenRouter. This sends you to openrouter.ai to approve PalaFilm and returns you with a key (authorization code with PKCE). While you are away, a random one-time verifier is held in this tab's sessionStorage under pala_ai_oauth; it is deleted when you return, and a sign-in older than 15 minutes is refused. The key that results is kept in memory only, like a pasted one. The openrouter.ai page is OpenRouter's own website and its own privacy and cookie practices apply there.
• Through a gateway. Microsoft 365 Copilot, and any provider your organisation prefers to reach centrally, is used through a gateway operated by you or your organisation. The gateway operator then receives the request and decides how it is logged and retained.
• The provider's own terms. Each provider processes what it receives under its own terms, privacy policy and retention rules, which may include storing requests for abuse monitoring and, depending on your account settings, using them to improve its models. Usage is billed to your account with that provider. Review those terms, and your organisation's rules, before sending production or personal data.
• Plans in Intelligent Command. When you choose Ask AI for a plan, the request you typed is sent to the connected provider together with the schedule: shooting days and their dates, and for each scene its number, heading, page count and cast names, plus the department list and asset names. The screenplay text, notes, contacts, rates and budget are not sent. The page says what will be sent before you ask, and the feature can be switched off in AI Connector. The schedule includes, once enough daily reports are filed, how long each day is forecast to run. If PalaFilm refuses the answer, the same request is sent again with the AI's previous answer and the reasons, at most three requests in all, each billed by the provider. The same applies when you choose Ask AI to fix Day N from the overrun forecast. An approved plan is recorded in the local operation journal with the provider and model that proposed it.
• Breakdown suggestions. This is the only AI feature that sends screenplay text, and it is off until you switch it on in AI Connector. When you choose Ask AI about this scene in Breakdown, the heading and full text of that one scene, dialogue included, are sent to the connected provider; the page states the scene and its length before you ask. No other scene, note or project data is sent. The provider's suggestions are kept with the scene until its text changes, and an accepted one is recorded with the provider and model that suggested it.
• The optional Offline Sync endpoint is disabled by default. If enabled, queued project snapshots are sent to the endpoint you enter; that endpoint's operator determines its storage and retention practices.

Integration Hub

• Platform webhook URLs are configured on your gateway and are not returned to the browser or stored in project files.
• The browser holds the integration access token in memory for the current page session only.
• Only the production event you select is sent. Status payloads omit crew contacts, budgets and screenplay content unless explicitly represented by the selected controlled package metadata.
• Microsoft Teams, Slack, Discord or automation providers process delivered events under their own terms.

Language, reminders and your record of use

• Language. On a first visit the Application opens in your browser's language when it offers it (English, Romanian or German), read from the browser itself; nothing is sent. Choosing a flag stores your choice in this browser.
• Reminders. Off until you turn them on in More. They are worked out in this browser from the open project (tomorrow's call sheet, today's daily report) and shown in the window. System notifications are asked for only when you turn reminders on, and only if your browser offers them; no server sends them, so nothing arrives while the Application is closed.
• Your record of use. UX Self-assessment shows the days the Application was opened with a project and when the main steps first happened. It holds counts and dates, no project content, stays in this browser and is never sent. You can export it, for example to share it in a pilot, or clear it.
• Build my production. The guided path and its sample film work in this browser with the local breakdown engine; no screenplay text is sent and no AI is used.

Where it is stored

What is not collected

• No centrally hosted registration or account database. Optional project accounts, role data and salted PIN hashes stay inside the local project replicas.
• No analytics, telemetry, usage tracking or crash reporting.
• No advertising and no advertising identifiers.
• No tracking cookies and no third-party scripts loaded from external servers.
• No plaintext copy of your screenplays, schedules or contact lists is automatically transmitted to us. A paired peer, backup node, sync endpoint or AI service receives only data involved in an operation you deliberately enable; a collaboration relay receives encrypted envelopes and routing metadata.

Production Twin and Intelligent Command

Digital Production Twin stores scenario inputs, forecast assumptions, board proposals and signed approval history within the local project. These records follow the existing backup and CRDT rules; raw scenarios and decisions use the finance scope. Selected distribution recipients receive the explicitly prepared decision and cost report. No new external AI or analytics service is required.

Intelligent Command interprets supported natural-language commands locally. Command plans, approvals and automation history remain in the project replica and operation journal. They are not sent to an AI provider unless the user explicitly asks the AI for a plan, as described above.

Story workspace

Outline cards, notes, to-dos, questions and character and location profiles are project content. They are stored in the local project like the screenplay, follow the same backup, export and CRDT rules, and leave your device only through the same deliberate channels (a paired peer, a backup or mailbox node, a sync endpoint). Peers who may edit the screenplay receive them under the script scope; other roles do not. The analysis is computed locally from the screenplay and is not sent anywhere.

Folder backup

If you choose a backup folder in Storage, the Application writes copies of the open project (.pala files, with a history of the last ten versions) into that folder through the browser. The copies go from the page to your folder and nowhere else; they are not encrypted, so keep the folder where only you can read it, or use the encrypted export instead. The browser keeps a reference to the folder in its local storage and asks your permission again after it has been closed. You can stop at any time, and the files stay where they are until you delete them. Printing the outline, the bible or the notes, and exporting a Fountain file with the outline, produce documents on your device in the same way as the other exports.

Installed app and files opened from your system

If you install PalaFilm from your browser, it is the same Application with the same local storage. When you open a project or screenplay file with it, the browser lets the Application read that file once; it is processed locally through the import checks and is not uploaded. The Application stores no permanent handle to the file. The install dialog may show screenshots, which your browser fetches from this site like any other image; the Application does not track whether you install it. Checking for a new release asks this site for one small file (release.json) and for the new program files; no project data or identifier is sent.

Where each kind of data lives

Large project mirrors, CRDT and Sync queues, transaction recovery and receipts are encrypted in the IndexedDB runtime store. Existing localStorage copies are removed only after a verified migration. Small preferences remain in localStorage. When IndexedDB is unavailable, the encrypted localStorage fallback is bounded to 512 KiB across managed app keys and may be unavailable if other data fills the quota. Device vault keys remain necessary to decrypt local records; password-protected PALAX exports provide portable recovery. Production Cockpit day packets and decisions are saved with the project. Exported HTML packets are fixed copies and do not update automatically.

4Legal basis and our role under the GDPR

Because project data does not reach our systems during normal local or direct peer operation, we do not act as a controller or processor of that data in those workflows. If the Operator later supplies an optional hosted gateway, its separate service information must identify the applicable role and processing terms. You - or the production company you work for - remain the controller of any personal data you enter (for example, cast and crew contact details), and you are responsible for handling it lawfully, including informing those people and honouring their rights.

The same applies when you connect an AI provider or another service yourself: you, or your organisation, decide that data is sent to it, so you need a lawful basis for sending any personal data, and, where the provider acts on your behalf, the data processing terms that provider offers. The Operator is not a party to that relationship.

If you contact us by email, we process your email address and the content of your message under our legitimate interest in responding to you (Article 6(1)(f) GDPR). We keep such correspondence only as long as needed to deal with your request.

5Hosting and server logs

The Application is delivered as static files from a web server. Like virtually all web servers, the hosting provider may automatically record technical connection data (IP address, timestamp, requested file, browser user agent) in its own logs for security and troubleshooting. These logs are generated by the hosting infrastructure, not by the Application, and they never contain your project content.

6Sharing with third parties

We do not sell, rent or share your project data, because we do not receive it. The Application contains no third-party analytics, advertising or social media components. All code it needs - including the PDF reading libraries used for screenplay import and QR generation - is served from the same server as the Application. If you enable STUN during Peer Sync, the configured STUN service is contacted only for route discovery. A configured collaboration gateway can process presence, signed signaling and opaque encrypted relay traffic. If you configure an AI or sync endpoint, that endpoint and any downstream provider receive the request you initiate. Review their terms before sending production or personal data.

Transfers outside the European Economic Area

Several of the AI providers listed above, the hosting network and some integration platforms are established or process data outside the European Economic Area, for example in the United States. The Operator makes no such transfer of project data, because it does not receive it. When you connect such a service, the transfer happens at your request, and the safeguards are those the provider offers (for example an adequacy decision such as the EU-U.S. Data Privacy Framework, where the provider participates, or standard contractual clauses in its data processing terms). Check them before sending personal data of cast or crew.

7Your data, your control

You can inspect, export and erase everything at any time, without asking us:

• Export: use Export .PALA to save a full copy of your project as a file.
• Review: the Storage screen shows what is stored and how much space it uses.
• AI: use Disconnect in AI Connector, or close the page, to drop the key; revoke the key in the provider's console when you no longer need it.
• Peers: use Pair Devices & Sync to inspect trusted device fingerprints and revoke a device.
• Backup nodes: use Backup Nodes to inspect, verify or delete encrypted replicas and approve recovery requests.
• Erase: clear the site data for this website in your browser settings ("Cookies and site data" / "Clear browsing data"). This permanently deletes all projects and recovery points held in IndexedDB and localStorage.

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. For project data those rights are exercised directly in the Application, as described above, because only you hold that data. For email correspondence with us, write to contact@palafilm.com. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or with the supervisory authority of the EU country where you live or work.

8Data retention

We set no retention period for your project data, because we do not hold it. It remains in your browser until you delete it, or until your browser removes it - some browsers clear stored data automatically after a period of inactivity or when disk space runs low. The Application asks your browser for persistent storage to reduce that risk and shows a notice in the sidebar while it has not been granted, but the browser makes the final decision. Permanent backup nodes retain snapshots according to the configured per-project/device limit (3–100) until rotated or manually deleted. This is why we still recommend independent .PALA backups.

9Children

The Application is a professional production tool intended for use by adults in a work context. It is not directed at children and we do not knowingly process children's personal data.

10Security

Because your data stays on your device or on peers you deliberately authorize, its security depends primarily on the security of those devices and browser profile. Team PINs are never stored: each is kept as a PBKDF2-SHA256 hash over a per-member salt, at 310,000 iterations. Failed attempts are counted in browser storage under pala_pin_attempts, so a lockout survives a reload or a new tab, and sign-in is refused outright when that storage is unavailable. This is a local deterrent, not server authentication: whoever controls the browser profile can clear it. We recommend you use device encryption and a screen lock, particularly on shared or portable computers, since anyone who can use a paired browser profile can open its synchronized projects. Exchange QR pairing codes privately and pair only trusted devices. On the server side, the Application is delivered with hardening headers and directory listing disabled. Reinstalling or clearing browser storage destroys the local private signing key and any local backup-vault key; the device must then be re-authorized by its peers, and replicas encrypted under the destroyed vault key cannot be recovered. Maintain at least two backup nodes on physically separate computers for important productions.

11Changes to this policy

Material changes to local storage, camera use, peer-to-peer transmission or the external services the Application can contact (such as the AI providers) will be reflected here, together with a new version and update date.

What changed in version 4.1

• New section on the language chosen from the browser, the optional reminders and system notifications, the record of use kept only in this browser, and Build my production.

What changed in version 4.0

• AI usage record: each AI request is counted in this browser, numbers only, so AI Connector can show what the AI features cost and how often their plans were applied. It is not sent anywhere and can be cleared there.

What changed in version 3.9

• AI plans: a refused answer can be sent back for correction, at most three requests in all, and the schedule sent with a plan includes the overrun forecast.

What changed in version 3.8

• Breakdown suggestions: the one AI feature that sends screenplay text, off by default, one scene at a time and only on request.

What changed in version 3.7

• Intelligent Command can ask the connected AI provider for a plan; the AI section says what that request contains and what it never contains.

What changed in version 3.6

• Published in Romanian and German as well as English. The three versions have the same content; if they differ, the Romanian version prevails.
• You can also complain to the supervisory authority of the EU country where you live or work, not only to ANSPDCP.

What changed in version 3.5

• The AI section describes the eleven providers that can be connected directly with your own key, Sign in with OpenRouter and its temporary sessionStorage entry, and what is sent at each step.
• New paragraphs on your role when you connect a service, and on transfers outside the European Economic Area.
• The storage table lists the interface language and sessionStorage; module names follow the current menu.

12Contact

Questions about this policy: contact@palafilm.com.