Privacy Policy
Effective date: September 30, 2026
1. Who we are and the short version
This Privacy Policy explains how Christopher Zou and Vanessa Tao ("Fountainhead," "we," "us") collects, uses, and protects information when you use the Fountainhead website at https://fountainhead.site and the Fountainhead screenwriting application (together, the "Service"). It applies together with our Terms of Service.
Our promise about your work. Your scripts, outlines, notes, treatments, pitch materials, production documents, and anything else you write or upload to Fountainhead ("Your Content") belong to you. Specifically:
- We do not read Your Content. No person at Fountainhead opens, reads, or reviews Your Content, except in the three narrow situations listed in Section 3 (you ask us to, a security emergency, or a legal requirement).
- We never sell Your Content. We do not sell, rent, license, or trade Your Content to anyone, and we do not sell your personal information for money.
- We never train AI on Your Content. We do not use Your Content to train, fine-tune, or improve any artificial intelligence or machine learning model, whether ours or a third party's.
- We never use Your Content for advertising. We do not mine Your Content for ad targeting, and we do not show ads based on what you write.
- We claim no ownership. Using Fountainhead does not give us any rights to your stories, characters, or productions beyond what we need to store and display them back to you.
The rest of this policy explains the details, including the limited automated processing our software needs to do to save, sync, and format your work.
2. Information we collect
We collect only what we need to run the Service.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account information | Name, email address, password (stored only as a secure hash), profile photo | You, or Google if you use Sign in with Google (see Section 4) |
| Your Content | Scripts, outlines, notes, title pages, comments, attachments, and project files | You |
| Collaboration data | Names and emails of people you invite to a project, and their permission levels | You |
| Usage data | Features used, pages visited, session length, error and crash reports, and session replays with on-screen text masked (Sentry) | Collected automatically |
| Device and log data | IP address, browser type, operating system, device type, timestamps | Collected automatically |
| Communications | Messages you send to our support team, survey responses, feedback | You |
| Cookies | Session and login cookies, preference cookies, and advertising cookies (Google Ads) | Collected automatically (see below) |
Payment information. Fountainhead is currently free. If we introduce paid plans, payments will be handled by our payment processor, Stripe, and we will not store your full card number. We will update this policy before collecting any payment information.
Cookies. We use strictly necessary cookies to keep you logged in and secure your session. We use Vercel Analytics to understand how the Service is used in aggregate. We also use advertising cookies set by Google Ads, which recognize your browser across websites so we can show and measure our ads (see Section 5). You can block non-essential cookies in your browser settings, and the core Service will still work.
3. How we use information
We use personal information to:
- Create and secure your account, and let you sign in.
- Provide the features you use, such as saving, autosaving, syncing, formatting, collaboration, and exporting your work.
- Respond to your support requests and send service messages (for example, password resets or security alerts).
- Understand, in aggregate, which features are used so we can fix bugs and improve the product.
- Show ads for Fountainhead on other websites and measure how well those ads work (see Section 5).
- Send occasional product updates and newsletters. When you create an account, you are added to our mailing list automatically, unless you are in the EU, EEA, UK, or Switzerland, where we add you only if you say yes when you set up your account. You can unsubscribe at any time using the link at the bottom of any newsletter or by turning off Email Updates in Settings.
- Detect and prevent fraud, abuse, and security incidents, and comply with the law.
How Your Content is handled
Your Content is processed only by automated systems, and only to deliver the features you use. For example, our software stores your script, formats it in industry-standard layout, keeps version history, and generates a PDF when you export. None of this involves a person reading it. To diagnose bugs, our error-monitoring provider, Sentry, records a replay of how the page behaves (clicks, scrolling, and layout) for a sample of sessions and whenever an error occurs. Text on screen, including Your Content, is masked in these recordings, so they do not show what you write.
A person at Fountainhead will access Your Content only in these situations:
- You ask us to. For example, you open a support request and give us explicit permission to look at a specific script or project. We will access only what you authorize, only for that request.
- Security. It is necessary to investigate a security incident, a bug that is corrupting or exposing data, or abuse of the Service. Access is limited to the minimum needed.
- Legal obligation. We are required to by law, such as a valid subpoena or court order. Where the law allows, we will notify you before disclosing Your Content so you can object.
What we will never do with Your Content
- Sell, rent, or license it to anyone.
- Use it to train, fine-tune, or improve AI or machine learning models.
- Use it for advertising, ad targeting, or building marketing profiles.
- Share it with studios, producers, agencies, or other companies without your direction.
- Claim ownership of it, or use it in our own marketing without your written permission.
4. Google user data
If you connect a Google account, Fountainhead accesses only the Google data needed for the features you choose to use.
| Google data we access | Why we access it | How we store it |
|---|---|---|
| Your name, email address, and profile picture (Sign in with Google: openid, email, profile) | To create your account and sign you in | Stored in your Fountainhead account until you delete it |
| Your Google account email address, the Google Forms that Fountainhead creates for you, and the responses submitted to those forms (Google Forms integration: userinfo.email, forms.body, forms.responses.readonly) | When you choose to send a cast and crew form from a script: to create a commute and dietary info form in your Google account, keep its questions and description up to date, and copy its responses into that script's cast and crew directory. Your email address is shown as the connected account. | We store your Google email address, a token that lets us reach the form, and the form's ID and link. Form responses are copied into the script's directory. We delete this data when you delete the script or your account. We never access forms that Fountainhead did not create. |
Use. We use Google user data only to provide and improve the user-facing features described above. We do not use it for advertising, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.
Sharing. We do not sell Google user data. We transfer it only (a) to service providers that help us run the features above (such as our hosting provider), under confidentiality obligations; (b) for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, and only after obtaining your explicit prior consent.
Human access. No person at Fountainhead reads your Google user data unless you give us affirmative permission for specific data, it is necessary for security purposes, or it is required by law.
Limited Use disclosure. Fountainhead's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access. You can disconnect Fountainhead from your Google account at any time at myaccount.google.com/permissions. Disconnecting stops our access immediately. To delete the Google data we have already stored, delete the script the form is connected to, delete your account, or email us (Section 6).
5. How we share information
We do not sell Your Content or share it with advertisers, and we do not sell your personal information for money. We do share limited personal information with Google for advertising, as described under "Advertising partners" below. We disclose information only in these cases:
- People you choose. When you invite collaborators or share a project link, the people you choose can see that project.
- Service providers. Companies that host our servers, store data, send email, provide error monitoring, or power AI features: Vercel (website hosting and usage analytics), Render (application and collaboration servers), Prisma (database hosting), Brevo (account and product emails), Sentry (error monitoring and session replay), OpenAI (the script breakdown feature), and Google (Sign in with Google and the Google Forms integration). They may process data only on our instructions, only to provide their service to us, and are bound by confidentiality and security obligations. They may not use Your Content for their own purposes, including AI training.
- Advertising partners. We use Google Ads to advertise Fountainhead and to measure how well our ads work. Google's advertising tag on our website collects your IP address, device and browser information, cookie identifiers, and the pages you visit, and Google may combine this with other information it holds to target ads. We never share Your Content with advertising partners. Under some U.S. state laws, including California's, this may count as "selling" or "sharing" personal information for targeted advertising. You can opt out by emailing chris@fountainhead.site or through Google's My Ad Center.
- Legal requirements. When required by law or valid legal process, or when we believe in good faith that disclosure is necessary to protect someone's safety, prevent fraud, or protect the rights and security of Fountainhead or our users. We will push back on overbroad requests and notify you where legally allowed.
- Business transfers. If Fountainhead is involved in a merger, acquisition, or sale of assets, your information may transfer to the new owner. The new owner must honor this policy's commitments about Your Content, or give you notice and the chance to delete your account before any change takes effect.
We may share aggregated statistics that cannot identify you or reveal Your Content (for example, "users wrote 10,000 pages this month").
6. Keeping and deleting your information
We keep your information only as long as your account is active or as needed to provide the Service.
- Deleting a script or project. When you delete a script or project, it is permanently deleted from our active systems right away. There is no trash folder, and deleted work cannot be recovered, so export anything you want to keep before you delete it.
- Deleting your account. You can delete your account in Settings by clicking Delete Account, or by emailing chris@fountainhead.site. We delete your account information, Your Content, and stored Google user data from our active systems immediately when you delete your account in Settings, or within 30 days of an emailed request.
- Backups. Copies in encrypted backups are overwritten on a rolling basis and fully removed within 90 days of deletion.
- What we may keep. We may retain limited records where the law requires it (for example, records of a legal request), or aggregated data that cannot identify you. We never retain Your Content for these purposes beyond the backup window.
Export. You can export your scripts at any time in standard formats, including PDF, Final Draft (.fdx), Fountain, WriterDuet, RTF, HTML, and plain text, so you are never locked in.
7. Security
We protect your information with safeguards appropriate to a small company handling creative work:
- Data is encrypted in transit (HTTPS/TLS) and at rest.
- Access to production systems is restricted to the few team members who need it to keep the Service running, protected by multi-factor authentication, and logged.
- Passwords are stored only as salted hashes, never in readable form.
No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and any required authorities as the law requires.
8. Your rights and other important details
Your choices and rights. Wherever you live, you can ask us to:
- Access the personal information we hold about you, or receive a portable copy.
- Correct inaccurate information.
- Delete your information and account.
- Opt out of marketing emails.
- Opt out of the sale or sharing of your personal information for targeted advertising (see Section 5).
Depending on where you live (for example, California, other U.S. states with privacy laws, the EU, or the UK), you may have additional rights, including the right to object to or restrict certain processing and to complain to a data protection authority. Email chris@fountainhead.site to make a request. We will respond within 30 days (or sooner if the law requires), may need to verify your identity, and will not discriminate against you for exercising your rights. You may use an authorized agent where the law allows.
Legal bases (EU/UK users). We process your information to perform our contract with you (running the Service), for our legitimate interests (security and improving the product), to comply with law, and with your consent where required (such as marketing emails). You may withdraw consent at any time.
International users. Fountainhead is based in the United States, and your information is stored and processed in the United States. If we transfer personal data from the EU or UK, we rely on appropriate safeguards such as Standard Contractual Clauses.
Children. Fountainhead is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are between 13 and 18, you must have a parent or guardian's permission to use the Service. If we learn that a child under 13 has created an account, we will delete it. Parents can contact us at chris@fountainhead.site.
Changes to this policy. If we make material changes, we will notify you by email or in the app at least 14 days before they take effect. We will not apply a change that weakens our commitments about Your Content to content you uploaded before the change without your consent. If we change how we use Google user data, we will ask for your consent before using it in the new way.
Contact us.
Christopher Zou and Vanessa Tao, 59 Keene St, Providence, RI 02906 · chris@fountainhead.site · vanessatao14@gmail.com