Skip to content
Sleeper Hit Studio

Privacy Policy

Last updated: October 12, 2026

1. Introduction

Sleeper Hit Studio is operated by Sleeper Hit Studio, LLC, a Delaware limited liability company, 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, including the Story API, our MCP connector and our command-line tool, and the apps you connect to them, such as ChatGPT.

2. Information We Collect

Account Information: When you create an account, we collect your name and email address. If you sign in with Google, we additionally receive your Google account identifier and profile picture (see "Sign-in with Google" below).

Payment Information: When you subscribe, payment processing is handled by Stripe. We do not store your credit card number or banking details on our servers. Stripe may collect and store payment information in accordance with their own privacy policy.

Writing & Project Data: If you use our writing-lab features, we store the screenplays, drafts, notes, research entries, and conversations you create. This content is processed by the service providers that generate outputs for us, as described in "Information Sharing" below, to deliver coverage, table reads, pitch decks, and similar features.

Voice Recordings: If you record your voice to create a synthetic voice, or someone records through a recording link you send them, we store the recordings and send them to Cartesia, which makes and speaks the voice. Performance takes recorded for a table read are stored and converted into a character's voice the same way.

Usage Information: We collect information about how you interact with our Service, including course progress, video completion data, feature usage, and pages visited. Some of this is captured via the analytics providers listed below.

Connected Apps: If you connect an app such as ChatGPT, we receive what it sends for you and keep a log of its requests. See "Connected Apps" below.

Apps You Ask Us to Record: If you connect your own app to a project so we can record it, we store its addresses and the login you save for it, encrypted so that it cannot be read back. See "Apps You Ask Us to Record" below.

Communications: If you contact us, we may retain the content of your messages along with your contact information.

3. Sign-in with Google (OAuth)

If you choose to sign in with Google, Google asks you to grant us access to a limited set of profile information. We request only the following non-sensitive scopes:

  • openid — a stable Google account identifier we use to recognize your account on subsequent sign-ins.
  • email — your verified email address, used as your account identifier and for transactional emails.
  • profile — your display name and profile picture, used to populate your account so you don't have to fill them in.

Signing in with Google never gives us access to your Google Drive, Gmail, Calendar, Contacts, or any other Google service. The data we receive when you sign in is used solely to authenticate your account and personalize your experience inside Sleeper Hit Studio. We do not sell or share Google OAuth data with third parties for advertising or any other purpose.

Two optional features ask Google for their own, separate permission, and only when you connect them: connecting an organization's Google Drive asks for read-only access to its files, and publishing to YouTube asks for permission to upload videos to your channel. We use each permission only for the feature you connected, and you can disconnect it at any time.

You can disconnect your Google account at any time from Profile → Sign-in & Security in the dashboard, or revoke Sleeper Hit Studio's access from your Google Account permissions page. Disconnecting Google does not delete your Sleeper Hit Studio account; you can continue to sign in with email and password if you have set one.

4. Connected Apps (ChatGPT and Other Clients)

You can connect other apps to your account: ChatGPT, Claude and other apps that use our MCP connector, our command-line tool, or your own code through the Story API. This section says what they send us, what we send back, what we keep, and how to disconnect them.

Who can connect: An app works only with a Sleeper Hit Studio account, and accounts are for people 18 and older. You can approve an app only after you confirm you are 18 or older and accept our Terms of Service and this policy. Writing made through ChatGPT is always kept suitable for ages 13 and up (no strong profanity, no graphic violence, no sexual content), whatever the project's own setting, and ChatGPT cannot set a show to use strong language.

When you connect: We record your approval: which app, the access you gave it, and when. If you accept our terms on the approval screen, we record that the way we do at signup, with the time, your IP address and your browser's user agent. The app gets an access token that lasts one hour and a refresh token that lasts 90 days. Each refresh replaces the refresh token with a new one, so an app you use at least once every 90 days stays connected until you disconnect it. If an app asks to sign in again for access you already gave it, we skip the approval screen, unless our terms have changed since you last accepted them.

What an app sends us: What you or the app put into the tools you let it use. That can include project names and descriptions, notes and pasted text, links to web pages and PDFs, screenplay text, your directions for a table read, deck or trailer, and a show's settings and sources. When you attach a file in ChatGPT, ChatGPT gives us a short-lived link to it on OpenAI's file storage. We download the file, keep the text we read from it and the link, and do not keep the file itself. We fetch any web page or PDF link you give us from the open web. What an app adds or changes is stored in your account like anything you make on the site. To make what you asked for, we process it with the service providers in "Information Sharing" below, as we do for work you start on the site.

What ChatGPT adds: ChatGPT attaches details of its own to each request, such as identifiers for your ChatGPT account, conversation and organization, your locale and your approximate location. We do not store, use or pass on any of them.

What we send back: The answer to each request. That can include your name and email address (when an app checks which account is connected), your projects, Series Bibles, episodes and coverage reports, your Studio Credit balance, and links to what you made, such as table reads, videos and show episodes. Anyone who has one of those links can open it. Once an app has our answer, its provider handles it under its own privacy policy: for ChatGPT, that is OpenAI's.

What we log: Each time an app reads or changes your work, we log which account made the call, which operation it called, when, whether it worked and why not, how long it took, the call's ids, its user agent, and a one-way hash of the network address it came from. The log never holds what the app sent or what we sent back. We delete each log entry after 90 days.

Repeated requests: When an app creates something or starts work, we keep a copy of our answer, so that if the app sends the same request again it gets the same answer instead of the work being done twice. We keep each copy for 7 days, then delete it.

Disconnecting: To disconnect an app, open Developers → Connected assistants and choose Disconnect. It takes effect at once: we delete the app's tokens and your approval, so it can no longer reach your account, and connecting it again asks for your approval again. The command-line tool and your own code use API keys, which you revoke on the same page. Changing your password also disconnects every app; API keys keep working until you revoke them. Disconnecting does not delete what an app made: it stays in your account until you delete it. Deleting your account removes your connected apps, API keys and request log with everything else (see "Data Retention").

5. Apps You Ask Us to Record

You can connect your own app to a project so that we can record it for a trailer or deck. This section says what we store to reach and sign in to your app, how a login is protected, how long we keep it, and how to delete it.

What we store: For each app you connect: its address and the other addresses it calls, its sign-in page, how it signs in, what shows that it is signed in, the parts of the screen to blur, and the name you give it. And the login you save for it: a username and password, an authenticator (TOTP) secret, a Cloudflare Access service token, a Vercel protection bypass secret, or a saved browser session. Use a demo or test account, never a real customer's account or production data.

How a login is protected: Each part of a login is encrypted the moment you save it, so that only the servers that make recordings can decrypt it. The website and the Story API (which our command-line tool and your own code use, with the access you gave them) can save or replace a login but cannot read it back. Nothing shows a saved login to you, to an app you connect or to anyone else: you see only that it is saved, and your username masked (for example, "de•••@example.com"). ChatGPT, Claude and other apps that use our MCP connector, and Slug, never take or receive a login: at most they give you a link to the page where you type it. A login is used only to sign in to the app it was saved for, on that app's own addresses. If you change the app's address or add another one, its saved login is deleted and you enter it again.

What we log: Each time a connection is created, changed, tested, used for a recording or deleted, we log what happened, how (on the site or through the API), and when. The log never holds a login. We delete each log entry after 90 days.

Recordings: The screen recordings of your app (captures) you upload are stored in your project. A capture you place in a trailer may be rendered on render machines we run ourselves, outside our cloud hosting, as other video we make for you may be.

How long we keep it, and deleting it: A connection and its saved login are kept until you delete them, or until it has gone unused for the number of days you set on it. Deleting a connection deletes its saved login at once. A deleted project's connections are deleted when the project is erased, and deleting your account deletes them with everything else (see "Data Retention"). Captures stay in your project until you delete them, the project or your account.

6. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Service
  • Process subscriptions and payments
  • Track your course progress and provide a personalized learning experience
  • Communicate with you about your account, updates, and our programs
  • Send newsletters and marketing communications (with your consent)
  • Respond to your inquiries and provide support

7. Information Sharing

We do not sell, rent, or trade your personal information to third parties. We share information only with the service providers listed below, and only to the extent needed for them to provide their service to you:

  • Stripe — payment processing and subscription billing.
  • Mux — hosting and delivery of course videos.
  • Resend — transactional and digest emails (account notifications, pursuit reminders, contact replies).
  • Cloudflare R2 — storage and delivery for uploaded assets and generated media (e.g. table-read audio, voice recordings, pitch deck images). These files are served from unlisted links: anyone who has a file's link can open it, so share links with care.
  • Service providers that generate outputs — when you use the writing, coverage, table read, voice, pitch deck, video and Slug chat features, the parts of your content each step needs (screenplay text, prompts, conversation history, lines to voice, voice recordings, images) are sent to the providers that generate the output for us. Today these include Anthropic, OpenAI, Google (Gemini), Cerebras, DeepSeek, Moonshot (Kimi), DeepInfra, OpenRouter and the model hosts it routes to, Alibaba Cloud (DashScope), Cartesia, ElevenLabs, Hume, Deepgram, fal.ai, Krea, Runway, HeyGen (the reference images and recorded line audio a video render sends it), Tavily and TypeSafe. They process this data to generate the output you asked for. Not all of them are barred from learning from it: the terms of ElevenLabs, Runway, Krea and Hume let them use what they process to improve their services, and so do the terms of DeepSeek, Moonshot and some hosts reached through OpenRouter. Cartesia's terms allow the same unless a customer opts out: we are opting out, which covers only what Cartesia processes after the opt-out takes effect. Every request we send to Deepgram opts out of its model training. We are moving all text processing to providers that do not train on our requests, and we will update this page when that is done.
  • refs (refs.video) — on a product project, when you look for reference films for a business video, compare a finished video with one, or plan with one, refs receives only a short description of the kind of video (its category, shape and length band), up to four single keywords about what it shows (taken from the feature names and your notes; never your notes themselves, your product's or release's name, a person's name, a number or a link), the reference film's id and, for a comparison, measurements of your video (cut times, brightness, motion and loudness — never the video file, its script, its title or your notes). Reference films are shown credited to refs and play in place from their original posts through YouTube's privacy-enhanced player, X's post player or Vimeo's player, which load from those services when the film is shown; we do not copy or host the films.
  • Daily — audio and video for live table reads and workshops, which may record session audio for the host.
  • Apps you connect — an app you connect, such as ChatGPT, receives what it asks for within the access you gave it, and its provider handles that under its own privacy policy (see "Connected Apps" above).
  • Your show's listeners — when you publish a show, its episodes go out on a public podcast feed (RSS) and on the show's own pages. The feed carries each episode's title, description and audio, the show's cover art, and the author name and contact email you give the show. Anyone with the feed can play the episodes. A show is public unless you change it: podcast apps and search engines can list a public show. An unlisted show is reached only by its link and asks them not to list it. A private show's feed and pages are closed.
  • YouTube and TikTok — only when you connect an account and publish to it.
  • PostHog — product analytics. We use PostHog to understand how the platform is used and improve it. Events include page views, feature clicks, errors and account lifecycle events, and can include your email address and the titles of your scripts, projects and shared items. Session recordings of how pages are used can capture text shown on screen, including writing in the editor.
  • Legal requirements — when required by law, regulation, or valid legal process.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure.

9. Data Retention

We keep your information while your account is open, or as long as we need it to provide the Service. You can download a copy of your data at any time from Profile → Sign-in & Security → Download my data.

Deleting a project hides it at once and keeps it restorable for 30 days. After that, we erase it with its episodes and the files it made.

You can delete your account from Profile → Sign-in & Security. The deletion is scheduled 7 days after you ask, and you can cancel it until then. Then we erase the account and everything it made, including its scripts, projects, table reads, decks, trailers, shows, voices, stored files, API keys, connected apps and stored app logins. We keep records of your payments, without your name or email, for as long as tax law requires, and anything else the law requires us to keep. Deleted data can remain in our encrypted database backups until those backups expire, and the service providers in "Information Sharing" keep what they processed under their own terms.

If your account cannot be deleted from its settings, the page says why. You can also email help@sleeperhit.studio from your account's email address and we will help.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Withdraw consent for marketing communications
  • Request a copy of your data in a portable format

To exercise any of these rights, email help@sleeperhit.studio or use our contact page.

11. Cookies

We use essential cookies to maintain your authenticated session and remember your preferences. We use first-party analytics cookies set by PostHog to measure how the platform is used. We do not use third-party advertising or cross-site tracking cookies.

12. Children's Privacy

You must be 18 or older to use the Service. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. To tell us, use our report page.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. When that date changes, we ask you to accept the new policy the next time you sign in.

14. Contact

If you have any questions about this Privacy Policy, email help@sleeperhit.studio or use our contact page. To report content that publishes your private information, or uses your voice or likeness without consent, use our report form.