Legal

Privacy Policy

Effective 7 October 2026 · Version 6.4 · Applies to Pure Alacrity on pure.dcalacrity.com and dcalacrity.com/pure, the downloadable single-file app, the Android app and the desktop app.

Contents

1. Who we are
2. What we collect and why
3. Google user data
4. How we use information
5. Sharing and disclosure
6. Cookies and browser storage
7. Retention
8. Security
9. Your choices and rights
10. International transfers
11. Children
12. Changes to this policy
13. Contact

1. Who we are

Pure Alacrity ("the app") is a production management app for film, TV and video. D.C. Alacrity ("we", "us") builds and operates it. D.C. Alacrity is the data controller for the limited personal data described here that reaches our servers. For the work you keep on your own device, you are in control. If you store other people's details in the app, such as cast, crew, clients or contacts, you decide what to keep about them and you answer their requests.

Contact: pure@dcalacrity.com.

2. What we collect and why

2.1 Your work: device storage and optional cloud sync

Scripts, breakdowns, schedules, budgets, call sheets, shot lists, storyboards, contacts, notes and settings are stored in your web browser's storage (localStorage and IndexedDB) on your device. Device-only work is not sent to our servers. Cloud Mode and explicit sharing transmit authorized copies to Firebase as described below. Privileged infrastructure operators can technically access unencrypted cloud content; account administration alone does not authorize content review. Device copies stay until you delete them or clear the site data. Device features work without an account.

To protect against mistakes and device problems, the app also keeps rolling, compressed backups of each production in your browser's storage on your device: the last 20, one a day for 30 days, and one a week for 26 weeks. Offline-workspace work set aside when you switch to Cloud Mode stays on the device for 7 days. Ending a local session removes these backups.

Details you keep about cast and crew

If you record other people's details in the app, you decide what to keep and you answer their requests. These include:

• names, phone numbers and emails;
• emergency contacts;
• dietary, allergy or medical notes;
• clothing sizes and measurements.

The app treats the sensitive ones with extra care:

• Measurements, sizes and allergies in Art Direction are stored only if you switch that on. They stay in your browser's storage on your device and are never synced.
• Emergency contacts and medical/allergy notes for cast and crew are stored on your device and, in Cloud Mode, in your own private cloud space. They are never included in productions you share with others.
• Phone numbers and emails are hidden by default in any list you export to share. In a shared production they are taken out of the cast and crew lists and kept in a separate contact details area, which viewers and commenters cannot read unless the owner opens it. Anyone can be marked "don't publish my phone/email", which keeps that number or address out of the shared copy entirely.
• Confidential lists (emergency contacts, medical/allergy, paperwork status) are exported only after you confirm a warning.

2.2 Account information (only if you use Cloud Mode)

If you choose Cloud Mode, you sign in with Google through Google Firebase Authentication. We receive your name, email address, profile picture URL and a Firebase user ID. We use them only to identify you and give you your own private cloud space. Your productions and workspace are then synced through the Firebase Realtime Database and Firebase Storage, so they follow you across your devices. The app initializes Firebase App Check using reCAPTCHA v3. Its enforcement is configured separately for Firebase services; it does not replace account or production permissions.

2.3 Live rooms and shared productions

When you join or host a live room or a shared production, what people post in it is held in the Firebase Realtime Database for its members. That includes names, departments, notes, takes, votes and who is connected. Rooms without an account use an anonymous Firebase sign-in. Your presence is removed when you disconnect.

Sharing a production works like a shared document. The owner invites people by email or turns on a join code, and gives each person an access level: viewer, commenter or editor. The owner can also close areas such as the budget, contracts or contact details to some levels or people. To make this work, the following is stored for the shared production:

Emergency contacts, allergy and medical notes, and measurements never leave the device that holds them: not to a shared production, presence, comments or the activity log. The Google Calendar cache, Calendar publishing state and Drive file details are never put in a shared production either. When the owner chooses Stop sharing and delete the shared copy, the shared copy is removed from the cloud; copies already on members' devices stay there.

2.4 Optional product analytics (pseudonymous event records)

Only after you explicitly consent in Settings → Privacy or onboarding, the app sends approved usage events to our own server (/api/collect on this site), which stores them in Cloudflare Workers Analytics Engine. The server can also forward the same minimized records to PostHog when that service is configured and enabled. These are pseudonymous records, distinct from the aggregate statistics shown in reports. An event contains:

• a feature or page name;
• approved yes/no values and choices from fixed lists;
• rounded timings, fixed error categories and broad device class;
• the telemetry schema version;
• a random install ID and visit ID.

Our server adds the country derived from the connection. The IP address itself is not stored with the events.

Events never contain:

• script text or titles;
• names, contact details or locations;
• money amounts;
• file names or contents;
• search terms or AI questions;
• keys or passwords;
• anything you type;
• any Google user data.

Usage statistics are off until you choose in the EU, UK, Switzerland, Canada, Brazil, China and South Korea. They are also off when your browser sends Global Privacy Control or Do Not Track. You can switch them off at any time in Settings → Privacy.

PostHog: configured product analytics is sent by our server using a fixed event schema. No PostHog browser SDK, session replay, heatmaps, automatic click capture, advertising cookies, automatic person identification, full URLs, Google user data, raw exceptions, scripts, audio or transcripts are collected. The server does not forward your IP address, browser headers or account identity to PostHog. PostHog still receives connection information from our server. US hosting is the default configuration; enabling a project requires verification of its region, processing terms and retention setting. US hosting alone is not a compliance guarantee.

Retention and deletion: PostHog capture remains disabled until the operator verifies event retention of no more than 90 days and tests deletion procedures. Opt-out stops future optional capture; it cannot recall events already delivered. Before clearing the device record, export the usage record to retain its random usage reference. Contact pure@dcalacrity.com to request deletion of any associated provider records. We cannot match pseudonymous usage references to your Google account automatically. Deletion procedures cover PostHog as well as our other providers; retained backups and aggregate reports require separate review.

2.5 Technical data when you load the site

Like any website, our host Cloudflare receives your IP address and ordinary browser headers when you load the app. The app arrives as a small page plus code files, all from this site (pure.dcalacrity.com, or dcalacrity.com/pure). Some load as the app starts; others load the first time you open the part of the app that needs them. After your first visit, your browser keeps a copy of all of them on your device, so the app opens and works offline. To remove that saved copy, use your browser's site settings for this site (Clear data), or Settings → Privacy → Erase in the app. Our Worker diagnostics record a fixed reason and route category, without raw IP addresses, URLs, user data or request bodies. Cloudflare hosting and security logs can separately include IP addresses, paths, browser headers, security actions and request identifiers. We use this to protect the service from abuse. Fonts load from Google Fonts. Some header photos load from images.unsplash.com. The PDF reader, PDF writer and text recognition are served from this site. Public code CDNs (cdnjs, jsDelivr, unpkg) are used only if that fails, or by the optional Word-document reader and on-device AI, the first time they are used. These requests carry your IP address and ordinary browser headers, but no production data.

2.6 Services you choose to connect

Some features send data to a service you pick. They run only after you turn them on:

• AI providers. The default AI runs on your device with no network. If you connect a provider (Google Gemini, Groq, OpenRouter, OpenAI, Anthropic, a custom endpoint, or Ollama / LM Studio on your own computer), your question goes directly from your device to that provider using your own API key. It goes with your profile summary and, unless you turn it off, a snapshot of the open production. That provider's own privacy policy applies. Calendar events and Drive file details read from Google are never included in these requests.
• AI reference images (Lighting Book). Nothing is sent until you tap Generate. Then the app sends that look's lighting description, and any subject or setting you typed, to the AI provider you connected (OpenAI or Google Gemini), using your own key. It sends the scene's heading and action text only if you choose Scene reference. If you switch on the free option, it sends the prompt to pollinations.ai, a third party. Generated images are kept only in this browser's storage on your device. They are not synced, and they are labelled AI-generated. Google user data is never included.
• Webhooks (Discord, Slack, Zapier) send only the event lines you enable to the address you paste.
• E-signature links carry a document encrypted with AES-256-GCM. The key sits in the link's # fragment, which browsers never send to a server.
• Industry and union news fetches public feeds through our own relay (/api/feed). The request contains words from a fixed list only and no production data.

3. Google user data

This section covers what Google user data the Pure Alacrity app, made by D.C. Alacrity, accesses. It also explains how the app uses, stores, protects, shares, keeps and deletes that data. Each Google connection is optional and starts only when you choose it, and each feature asks Google only for the permission (scope) it needs.

3.1 What Google user data we access

YouTube API Services. The YouTube features use YouTube API Services. By using them you agree to be bound by the YouTube Terms of Service, and Google's handling of the data is covered by the Google Privacy Policy. You can revoke the app's access at any time on the Google security settings page, or with System → Google → Disconnect in the app.

The app requests no other Google scopes. It cannot read your Gmail, your contacts, Drive files it did not create or that you did not pick, or anything on your YouTube channel beyond your uploads list and their statistics.

3.2 How we use Google user data

• We use Google user data only to provide the features you turned on, as described in the table above: signing in, saving and restoring backups, importing files you picked, publishing your production events, showing your calendar next to your schedule, and uploading the videos and captions you choose to YouTube and showing how your uploads are doing.
• We use it only on your request or under a setting you chose, such as the auto-backup interval.
• We do not use Google user data for advertising, profiling, marketing, analytics, or to build databases about you.

3.3 How we share, transfer or disclose Google user data

• We do not sell, rent or trade Google user data. We do not transfer or disclose it to third parties, except in these cases:
  • to provide the feature you are using: the app talks to Google's own APIs directly from your device, and Cloud Mode stores your sign-in with Google Firebase;
  • when you direct it yourself, for example by sharing a production with your crew;
  • to comply with applicable law or a valid legal request;
  • as part of a merger, acquisition or sale of assets, with notice to you and under the same protections.
• Calendar events, Drive file details and YouTube channel statistics read from Google are never sent to our servers, Cloud Mode, live rooms, webhooks, usage statistics or AI providers.
• The content of a file you choose to import from Drive becomes part of your production. Like the rest of your production, it goes only where you send it. If you send part of your production to an AI provider you connected, that is a transfer you make yourself, for a feature you requested.

3.4 How we store and protect Google user data

• In transit: every request to Google uses HTTPS (TLS encryption).
• Access tokens: tokens for Drive, Calendar and YouTube are held only in the open tab's memory. They are never written to storage or sent to our servers. They expire within about an hour and end when you close the tab.
• Least privilege: Drive uses only drive.file. Each feature asks only for its own scopes when you first use it, and the captions permission is asked for only when you include captions.
• On your device: calendar events cached for display stay in your browser's storage on your device. They are protected by your device and browser account.
• In the cloud: Cloud Mode sign-in data is held by Google Firebase. It is encrypted at rest by Google and protected by authentication and database rules.
• People: staff access is limited as described in 3.6.

See the Security overview for more.

3.5 How long we keep Google user data, and how to delete it

• Access tokens: kept in memory only, for at most about an hour, and gone when you close the tab.
• Calendar events and calendar list cached on your device: refreshed while you use the calendar. They are deleted as soon as you disconnect Google Calendar or erase the workspace.
• Drive file details (ID, name, type, size) for files you imported stay with that production on your device until you delete the production.
• YouTube channel statistics are held in the tab's memory only and are gone when you close it. The video and caption IDs, link, title and privacy setting stored on an edition stay with that production until you delete the production or unlink the video. Uploaded videos stay on your channel until you delete them in YouTube Studio.
• Your Cloud Mode sign-in (name, email, account ID) is kept while you have an account. We delete it, with your cloud copy, within 30 days of your request.
• Backups and published events live in your own Google account. Delete them there at any time.

To disconnect, go to System → Google in the app. That revokes the permission at Google and deletes cached Google data from your device. You can also remove the app's access at myaccount.google.com/permissions. To delete your account and cloud copy, email pure@dcalacrity.com from the address you sign in with (see section 9).

3.6 Limited Use disclosure

Pure Alacrity's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide or improve user-facing features that are visible and prominent in the app's interface.
• We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
• We do not sell Google user data to data brokers or information resellers, and we do not use it to create databases.
• We do not use Google user data to determine credit-worthiness or for lending purposes.
• We do not use Google user data, including data obtained through Google Workspace APIs, to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models. We do not transfer it to third parties for that purpose either.
• No person at D.C. Alacrity reads your Google user data, except:
  • with your explicit permission for specific data;
  • when necessary for security purposes, such as investigating abuse;
  • to comply with applicable law;
  • when the data has been aggregated and anonymised for internal operations.

3.7 Changes to how we use Google user data

If we change how the app accesses, uses, shares or keeps Google user data, we will update this policy and tell you in the app before the change takes effect. Where required, we will ask for your consent again.

4. How we use information

• To provide the app and the features you turn on: syncing, live rooms, backups, calendar publishing and display, and file import.
• To keep the service secure and prevent abuse: rate limiting, blocking scanners, reCAPTCHA through Firebase App Check.
• To understand, through aggregate reports from consent-qualified pseudonymous events, which features are used and where errors happen, so we can improve the app.
• To answer you when you write to us.

We do not use your data for advertising, and we do not build profiles of you for marketing. We make no automated decisions about you that have legal or similarly significant effects.

5. Sharing and disclosure

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. Data reaches these parties only as described:

• Cloudflare: hosts the website, relays news feeds and stores optional pseudonymous usage events and aggregate reports.
• PostHog: when configured and enabled, receives consent-qualified, schema-limited product events from our server; no production content or Google user data.
• Google: Firebase Authentication, Realtime Database, Storage and App Check (reCAPTCHA) for Cloud Mode and live rooms. Also the Google Drive and Google Calendar APIs, which the app calls directly from your device on your behalf.
• Services you choose: AI providers, webhook services and the people you share rooms, productions or e-signature links with.
• People you share a production with: when you share a production, you disclose its contents to the people you invite or who join with your code, at the access level you choose. Health notes such as emergency contacts, allergies and measurements are never shared. Phone numbers and emails of cast and crew are shared only with people whose access includes contact details. People you invite see your name; only you and the editors you allow to share see email addresses.
• Legal reasons: if required by law, or to protect the rights, safety and security of our users or the public.

6. Cookies and browser storage

The app does not use advertising or tracking cookies. It uses your browser's localStorage and IndexedDB to store your work and settings on your device. It uses a service worker to open offline. If you use Cloud Mode, Firebase keeps your sign-in session in your browser until you sign out. Google reCAPTCHA, used by Firebase App Check, may set its own cookies under Google's policies.

Search index. To make ⌘K search and Where is this used instant, the app builds a search index of your productions on your device. It holds the names, titles, roles, descriptions and links between your scenes, people, shots, props, places, days, budget lines and takes. It is kept in the tab's memory, with a copy in your browser's IndexedDB so the next start is fast. It is never sent to our servers, never synced to the cloud, and never included in exports or production files. It leaves out confidential measurements and sizes, allergies and medical notes, phone numbers, email and postal addresses, the Google Calendar cache, the Vault and any access tokens. It is deleted when you erase the workspace or end the local session, and rebuilt from your own data as it changes. Searching All productions covers only the productions stored in this workspace on this device; it never fetches anything from the cloud. A link to an item (#/e/…) carries identifiers only, never names or content.

7. Retention

8. Security

All traffic uses HTTPS/TLS. The website sends HSTS and a strict Content Security Policy. Cloud data is protected by Firebase Authentication and database rules that require membership. Google tokens are kept in memory only and limited to the narrowest scopes. Files you seal in the Vault are encrypted with AES-256-GCM. No system is perfectly secure: the rest of your workspace in the browser is protected by your device and browser account, not by app-level encryption. See our Security overview for details and how to report a vulnerability.

9. Your choices and rights

Because your work is on your device, most rights are self-service and immediate:

• Access and portability: export everything as one file from System → Privacy & Security, or one production from Transfer Bay.
• Correction: edit any record where it lives in the app.
• Erasure: erase one production or the whole workspace in the app. Deleting a production keeps a restorable copy for 30 days (Backups & Recovery → Recently deleted); after that it and its cloud copy and backups are removed. To delete your entire cloud copy and sign-in account, email pure@dcalacrity.com from the address you sign in with. We complete it within 30 days.
• Objection / opt-out: switch off usage statistics in Settings → Privacy. Every other feature that sends data is off until you turn it on.
• Google access: disconnect in System → Google or at myaccount.google.com/permissions.

If you are in the EU, EEA, UK, California or another place with data-protection laws, these choices cover your rights:

• access, rectification, erasure, restriction, portability and objection;
• the right to know, delete, correct and opt out of sale or sharing (we don't sell or share).

You can also complain to your local data-protection authority. We will not discriminate against you for using your rights.

10. International transfers

Our service providers, Cloudflare and Google, process data on servers around the world, including in the United States. Where the law requires it, these transfers rely on the providers' standard contractual clauses and equivalent safeguards.

11. Children

Pure Alacrity is a professional tool. It is not directed at children under 13 (or under 16 where local law sets a higher age), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this page when our practices change, and change the effective date and version above. If a change affects how we use Google user data or other personal data in a material way, we will tell you in the app before it takes effect. Where required, we will ask for your consent.

13. Contact

For questions, requests or complaints about privacy, email D.C. Alacrity at pure@dcalacrity.com.