What stays local and what you can choose to share
Scene work stays in your browser by default. Performance analytics and research-dataset contribution are two separate optional choices, both off until you enable them.
Effective and last updated 18 August 20261. Controller and scope
The controller for the processing described in this notice is Tomas Sikora. Privacy and data requests can be sent to sikora@splatfiction.com. The address receives mail through HostCreators. Research attribution and beta status are in the Research Notice.
This notice covers the public Splatfiction beta at splatfiction.com. A linked third-party site is governed by its own notice.
2. Data-flow map
| Flow | Data and purpose | Basis and choice | Retention |
|---|---|---|---|
| Local workspace | Files you choose, reconstruction state, recovery points, exports, and workspace preferences are processed in your browser to provide the requested feature. The ordinary workflow does not send scene content, filenames, or local paths to a Splatfiction application server. | Local processing is initiated by you and is necessary to provide the feature you request. | Until you discard a scene, clear app/site data, or the browser removes its storage. |
| Site delivery and security | Vercel receives network-request information needed to deliver and protect the site, including request, device, timestamp, and IP-related information. Scene names and content are not intentionally placed in URLs. | GDPR Article 6(1)(f): the legitimate interests are delivering the requested site, maintaining availability and security, and preventing abuse. | Splatfiction does not create a second access-log database. Provider-side retention follows the active Vercel service and its published notice. |
| Performance analytics | No page-analytics or advertising script is included. If enabled, Splatfiction sends random browser/session IDs; browser, OS, device, GPU, bucketed CPU and memory details; app/build identity; run configuration, timing, outcome and speed; quality scores; normalized error/stop categories; and bounded diagnostic milestones. The application does not send photos, scene geometry, filenames, local paths, project names, or raw error messages in this flow. The server stores only a masked and keyed-hash form of the request IP. | GDPR Article 6(1)(a): your separate consent, used to compare beta quality, compatibility, performance, and failures. It is off until you enable “Share performance analytics.” Refusal does not limit the local app. | New detailed pseudonymous sessions, runs, and traces expire after 90 days. Daily cohort and workload aggregates expire after 13 months. Earlier internal test records are not represented as deleted until their retention backfill is verified. |
| Dataset contribution | If separately enabled, a completed reconstruction is packed in a worker and uploaded to private Wasabi storage: photos re-encoded at no more than 1024 pixels on the long edge, generated image names, scaled camera intrinsics and poses, sparse points, the compact Gaussian scene, and a manifest with creation, app/build, run, quality, and count information. A random local contributor ID and photo-set fingerprint are keyed-hashed in Firestore for duplicate and quota control. Original filenames, local paths, and storage credentials are not uploaded. | GDPR Article 6(1)(a): your separate consent, for reconstruction research, evaluation, training, and product improvement. The contribution licence is in the Beta Terms. Do not contribute material unless you have the necessary rights and permissions. Refusal does not change your local result. | New dataset objects and their pseudonymous admission/catalog records are scheduled to expire after 730 days. Incomplete multipart uploads are scheduled for cleanup after one day. Earlier internal test objects are not represented as deleted until their inventory is verified. |
| Email correspondence | HostCreators processes messages sent to the published role address so Splatfiction can answer privacy, security, and beta correspondence. | GDPR Article 6(1)(f) for answering and documenting correspondence and protecting the beta; another basis may apply where a request requires it. | Only as long as reasonably needed to handle the message, establish what was done, and meet applicable legal obligations. |
3. Your controls and local storage
Both improvement choices start off. Enabling analytics creates its random identifiers; turning it off stops future analytics, removes those local identifiers, and clears queued milestones. Dataset contribution has its own versioned decision and random contributor reference. Turning it off stops future packages. It does not silently claim that an archive already uploaded has been deleted.
IndexedDB stores saved scenes, source data needed for recovery, and checkpoints. Local or session storage records workspace preferences, optional-choice decisions, and any identifiers needed for an enabled choice. Use the in-app Storage panel to change either choice, discard scenes, or clear offline app files. Browser site-data controls can remove all remaining local data.
4. Providers
- Vercel Inc. — active site hosting, delivery, and provider-side security and operational processing.
- Google Cloud / Firebase. — active only for opted-in performance analytics and the pseudonymous contribution ledger/catalog, plus an access-restricted operator dashboard.
- Wasabi Technologies. — private object storage used only for reconstruction packages that a user separately chooses to contribute.
- HostCreators. — inbound and outbound email hosting for the published Splatfiction address.
The current code has no advertising provider, payment provider, user account provider, or data-broker integration. It does not expose a public scene-hosting service.
5. International processing and account terms
The infrastructure providers operate internationally and publish information about processing locations and transfer mechanisms. This notice does not claim that an optional DPA, a particular account tier, or a particular contractual transfer mechanism applies unless that coverage has been verified for the active account.
6. Withdrawal and your rights
You can withdraw either optional choice at any time in Storage, without losing the local feature. Withdrawal stops future collection through that choice and does not affect processing that was lawful before withdrawal. For deletion of previously stored records or a contributed archive, or to exercise access, correction, restriction, portability, or objection rights where applicable, contact sikora@splatfiction.com.
Because there is no account, enough information may be required to locate a record without disclosing another person's data. You may also complain to the competent supervisory authority. The European Data Protection Board member list links to national EEA authorities.
7. Adults only, automated decisions, and security
The beta is intended only for adults. It does not make decisions that produce legal or similarly significant effects about a user and does not create an advertising profile.
Collection routes require reviewed source and production release gates, same-origin requests, bounded bodies, and rate limits. Credentials remain server-side; dataset objects remain private and downloads require operator authorisation. These are implementation controls, not a guarantee of absolute security. Report a concern through the Security page.
8. Sources and changes
Provider statements can be checked in Vercel's Privacy Notice, Google's Firebase privacy information, and Wasabi's DPA information. GDPR rights and disclosure requirements are in the official regulation text.
A material change to a data category, purpose, provider, retention rule, or contribution licence receives a new notice or consent version and is presented again where required.