Privacy Policy

In short

• Your scripts and projects are saved on your computer, not on our servers.
• When you use the AI, what it needs goes through our server to Google’s Gemini: your words, and any pictures or recording you give it. That includes what Crosscheck reads a few seconds after you stop typing, while you’re signed in. Our server doesn’t keep it or log it. Under its terms, Google keeps it for up to 55 days, only to catch misuse and meet legal requirements.
• To use the AI you sign in with Google. We keep your email address, a record of your sign-ins, and how much AI you use each month.
• If you apply for the beta, we keep your answers so we can read your application.
• This website sets no cookies unless you accept analytics.
• We don’t sell your data, and we don’t use it for advertising.

What we don’t do

• We don’t keep your writing on our servers or in our logs.
• We don’t use your writing to train AI. Under the terms of the Gemini service we send it to, Google doesn’t either (see Your writing and AI).
• We don’t sell or rent your data, or use it for advertising.
• We don’t look inside the projects on your computer.
• We don’t build a profile of you, and we don’t link website recordings to your application.
• We don’t set cookies on this website without your consent.

Who we are

Tarantula and this website are made by Reelo Labs (Reelolabs Private Limited, registered at SF No. 121/1B, 33, Sri Jayapriya Nagar, Thenkeeranur, Kallakurichi, Villupuram 606213, Tamil Nadu, India). Reelo Labs decides how the personal data described here is used, which makes us its controller.

For anything in this policy, write to privacy@reelolabs.com.

What we collect

When you apply for the beta

Your email address, your answer to “Are you a screenwriter?”, what you tell us you’re working on (up to 2,000 characters), and the date you first applied. We add the state of your application. If you apply again with the same address, your new answers replace the old ones, and we note the date of your latest application too.

To stop the form being flooded, our server also counts submissions per hour by a hashed form of your IP address. It doesn’t store the address itself, but a hash like this can be matched back to an address, so we treat it as personal data.

When you sign in to Tarantula

You sign in with your Google account. Google tells the app your email address, your Google account ID, and usually your name and profile picture. The app shows your name and picture on your computer only. They do pass through our server, inside the sign-in token Google gives the app, but our server reads only your email address and Google account ID from it, and doesn’t keep your name or picture. Our server keeps:

• your email address on the list of beta writers, with the dates your access began or ended;
• a record of each sign-in: your email address, your Google account ID, a short technical label (usually “local:4173”, the same for almost everyone, so it doesn’t identify your computer), the start and end dates, why it ended if it ended early (you signed out, your access ended, or we ended it), and hashed copies of the sign-in codes, never the codes themselves. A sign-in lasts 30 days.

When you use the AI

For each writer and month, our server adds up how many AI requests you made, how much they processed (counted in tokens) and what they cost us. It keeps two totals: one for the Discussion, GoodBot, Ideas, “Format using AI” and dictation, and one for all the other AI work, such as Crosscheck, imports and summaries. These totals contain none of your writing. We read them to keep within our budget, apply the fair-use limit and work out pricing.

When you send feedback

When you tell GoodBot about a bug or an idea, it shows you what it will send, and nothing goes until you confirm it. We keep what you confirm: your own words, your email address, the app’s version, your computer’s operating system, the reference codes of the app’s last few errors (codes, not their contents) and a reference number you can quote to us. None of your script goes with it unless you add some yourself.

Server logs

Our server writes short operational logs. Some lines include your email address next to an AI request’s task, size and cost, a sign-in, or a request we turned away. When the beta form turns a submission away, its line keeps only the start of the hashed form of your IP address. The logs never include your writing. Our hosting provider keeps them for up to 7 days.

When you visit this website

The service that hosts this website receives your IP address and browser details in order to send you the pages, and may keep them briefly in its security logs. Anything beyond that, such as analytics, happens only if you accept it. See Cookies and analytics.

What stays on your computer

Your projects are saved in a folder on your computer: scripts, drafts, your story’s world, research, pictures, chats with the AI, saved versions, and the recovery copies the app makes before an AI edit you approve. We can’t see this folder, and the app doesn’t upload it or back it up. The AI features send what each one needs to help you, including what Crosscheck reads in the background while you’re signed in; Your writing and AI has the details. Deleting a project in the app deletes its folder. Exports are written to your computer too.

The app also keeps your sign-in, your name and picture, and display preferences in its own storage on your computer. Signing out removes the sign-in.

When you paste a link into Research, the app fetches that page and its picture straight from the site, the way a browser would, so that site sees your IP address.

Your writing and AI

Writing, saving and exporting work without signing in. The AI features are the only part of Tarantula that sends your writing anywhere. When you use one, it sends what that feature needs. The main ones:

• Discussion: your question, any passage you quote, the conversation so far and pictures you attach, with the context it reads to answer: the latest pages of your script, your story canon and outline, the names of your World Building pages, research summaries and open Crosscheck flags.
• Crosscheck: a few seconds after you pause, while you’re signed in, what you’ve just changed and the parts of your story it’s checked against. When you change your outline, story canon or World Building pages, it also reads the written scenes that change could affect, and it reads each new or rewritten scene in full to keep that scene’s one-line summary on your outline up to date.
• Outline: when you ask it to draft a structure or pick out the people and places, your story canon and summary, and each scene’s heading, first line and who speaks in it.
• World Building: notes waiting to be sorted into a page’s fields, with the names of your other pages; suggestions you ask for; and, when you rename or remove a character or place, the script, so every mention can be changed with it.
• Ideas, imports and summaries: what you’ve told it about an idea, a script you import (title page included) as it’s sorted into scenes, characters and places, or the text being summarised, such as each PDF or link you add to Research.
• Dictation: your recording, to be turned into text. Neither the recording nor the text is kept or logged on our side.
• GoodBot, the help assistant: your question and the conversation with it. We keep none of the conversation. Feedback you choose to send us through it is kept; see When you send feedback.

Everything goes through our server to Google’s Gemini API. We don’t add your name or email address; if they’re on your script’s title page, an import sends that page too. Our server passes it on and keeps nothing of it.

We use Google’s paid Gemini API service. Under its terms, Google doesn’t use what we send to train or improve its products. It keeps prompts and responses for up to 55 days, only to detect misuse and to meet legal requirements.

Why we use it

Data protection law asks us to name a legal basis for each use. Ours are:

• Reading your beta application and writing to you about it: steps you asked us to take before you join (contract).
• Signing you in and running the AI features you use: providing Tarantula to you (contract).
• Adding up AI use per writer to keep Tarantula affordable, apply the fair-use limit and set prices: our legitimate interest in running the service sustainably and fairly.
• Keeping the feedback you send and reading it to fix and improve Tarantula: our legitimate interest in making it work for the writers using it.
• Rate limits and server logs to keep the service secure and working: our legitimate interest in preventing abuse.
• Website analytics: your consent, which you can withdraw at any time.

You don’t have to give us any of this. Without an application we can’t consider you for the beta, and without signing in the AI features won’t work. Once you have Tarantula, writing in it never needs you to sign in.

A person reads every application. Apart from the monthly fair-use limit on the AI, nothing about you is decided automatically.

Who else handles it

• Cloudflare runs our server and its database, and acts only on our instructions.
• Google answers AI requests through the Gemini API. Google sign-in is Google’s own service, so Google’s Privacy Policy covers your Google account. The app loads Google’s sign-in script when it opens.
• Microsoft provides Clarity, our website analytics, but only if you accept it. Microsoft uses that data as a controller in its own right, under the Microsoft Privacy Statement.

When we email you about the beta, the message goes through our email provider, and the service that hosts this website delivers its pages. We share your data with no one else, unless the law requires it.

Where it is kept

Cloudflare runs our server in data centres around the world, in whichever is nearest to each request. Our database is stored in database region. Google may process Gemini requests in any country where it has facilities.

Reelo Labs is based in India. The people who run Tarantula read what our server holds from there: beta applications, the list of beta writers, monthly AI totals and server logs. Neither the UK nor the EU has recognised India as protecting personal data to its own standard, so for data that reaches us from there we follow UK and EU data protection law ourselves: everything in this policy, your rights included, holds wherever we read it from.

Cloudflare, Google and Microsoft are based in the United States. When your data goes to them from the UK or the European Economic Area, it is protected by the EU-US Data Privacy Framework and its UK Extension where the company is certified, or otherwise by the European Commission’s Standard Contractual Clauses.

Keeping it safe

• The app and this website reach our server only over encrypted connections (HTTPS).
• Our server keeps sign-in codes only as one-way hashes, so a copy of its records couldn’t be used to sign in as you.
• The key that pays for the AI lives only on our server, never in the app.
• Your access is checked on every AI request. A sign-in ends after 30 days. Signing out ends it on your computer at once, and on our server too if the app can reach it then; if it can’t, the sign-in runs out by day 30, or sooner if you ask us.
• On your computer, the app’s own server answers only your computer, not the network around it.
• Only the people who run Tarantula can see what our server holds.

If something ever went wrong with your data, we’d tell you, and the authorities where the law requires it, as quickly as we can.

How long we keep it

• Beta applications: while the beta runs, then deleted within 6 months of it ending, whether or not you got a place. Ask, and we’ll delete yours sooner.
• Hashed IP counts for the form: deleted within a day.
• Your beta-writer record, sign-in records, monthly AI totals and the feedback you send: while you’re in the beta, then deleted within 12 months of your access ending, or sooner if you ask.
• Server logs: up to 7 days.
• Website analytics: kept by Microsoft for up to 13 months.
• Everything on your computer: until you delete it.

Your rights

You can ask us for a copy of the data we hold about you, to correct it, to delete it, to limit how we use it, or to send it to you in a format you can take elsewhere. You can object to the uses that rest on our legitimate interests, and withdraw your consent to analytics at any time.

How to ask

Write to privacy@reelolabs.com, ideally from the address you applied or signed in with, so we know the data is yours; otherwise we may ask you to confirm it. It’s free, and we’ll answer within one month. If a request is unusually complicated we may need up to two months more, and we’ll tell you so within the first.

A copy includes everything our server holds about you: your application, your beta-writer record, your sign-in records, your monthly AI totals, the feedback you’ve sent and any log lines still kept, in a common format you can open anywhere.

Closing your account

Ask us and we’ll delete your application, your beta-writer record, your sign-in records, your AI totals and your feedback. Any server log lines clear on their own within 7 days. Your projects stay on your computer, and they’re yours to keep or delete.

Complaints

If you’re unhappy with how we’ve handled your data, tell us first and we’ll put it right if we can. You can also complain to the data protection authority where you live, such as the Information Commissioner’s Office in the UK. In India, once you’ve raised it with us, you can go to the Data Protection Board of India.

Cookies and analytics

Tarantula, the app, sets no cookies of its own. Google’s sign-in, which the app loads, may set cookies of Google’s.

This website sets no cookies of its own. While a tab is open it remembers two things in your browser, and forgets them when you close the tab:

• ta-sound: whether you turned the sound on or off.
• ta-slide: which way the next page should slide in when you follow a link. It’s cleared as soon as that page opens.

If you accept analytics, the page loads Microsoft Clarity, which records how the page is used: clicks, scrolling, mouse movement, the pages you visit and the site that sent you, and your device and browser. We use it to see where the page works and where it doesn’t, through heatmaps and recordings of visits. Anything you type is hidden from the recordings. Clarity sets two cookies on this site, _clck (one year) and _clsk (one day), keeps a short-lived item for the open tab, and Microsoft may set cookies of its own on Microsoft’s domains. Whichever you choose is remembered in your browser as ta-consent for six months, and then we ask again. If you reject analytics, or your browser sends Global Privacy Control, Clarity never loads.

You can change your choice at any time from Cookie settings at the bottom of the home page.

Children

Tarantula isn’t made for children. You need to be 18 or over to join the beta and use the AI. If you think someone under 18 has applied, tell us and we’ll delete their application.

Changes

When what we collect changes, we update this page and the date at the top. Before Tarantula starts collecting anything new, such as usage statistics from the app, we’ll update this policy and, where the law requires it, ask you first. If a change affects beta writers, we’ll tell them by email before it applies.

Contact

Reelolabs Private Limited
SF No. 121/1B, 33, Sri Jayapriya Nagar, Thenkeeranur, Kallakurichi, Villupuram 606213, Tamil Nadu, India
privacy@reelolabs.com