Privacy notice

Last updated: 8 November 2026

This notice covers the website www.scatter.study, the demo on it and the app at www.scatter.study/app.

Controller

Hosting

Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, hosts the website, the demo and the app as a processor. When you open a page, your browser sends your IP address, the requested address, the date and time, your browser’s user agent and, where applicable, the referring page.

• Purpose: delivering the pages and protecting them against abuse.
• Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is a working and secure website.
• Transfer to the USA: Vercel Inc. is certified under the EU–U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).
• Storage: request logs for this website are deleted after at most one day.
• The pages cannot be delivered without this data.

Email

If you write to me, I use your email address and message only to answer it. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is answering your request. I delete the messages once the request is settled, unless statutory retention periods apply. The mailbox is provided by Google (Gmail), which can process messages in the USA; Google LLC is certified under the EU–U.S. Data Privacy Framework.

Storage on your device

To open the app directly for returning users, this website checks two signals in your browser:

• The scatter_app_started cookie, which the app sets when you open it. It contains only the value 1, is limited to www.scatter.study and expires after one year.
• Whether the app’s settings.json file exists in your browser’s storage for this website. The page never reads the file’s contents and does not send the result anywhere.

Legal basis: § 25(2) no. 2 TDDDG; both signals serve only to show the app you use instead of this page. Opening www.scatter.study/?landing=1 always shows this website. Clearing the site data for www.scatter.study removes the cookie and all app data; export your projects first.

The app

The app stores projects, sources, saved media, settings and API keys only in your browser; they are not sent to me. When you use a feature that needs another service, your browser connects to that service directly, and the service processes the request under its own privacy policy:

• Model providers you configure, such as OpenRouter, OpenAI or Anthropic, receive your API key and the request content, which can include conversation history, source excerpts and images.
• Optional synchronization sends projects and settings to your Google Drive app-data folder or to a WebDAV server you configure. API keys are excluded unless you enable Sync model-provider API keys.
• Search and media services receive requests for web search, free-image search through Wikimedia Commons and Openverse, and videos you embed from YouTube or Vimeo.

While the app is open, it checks every 15 seconds whether your device is online, with a request without content or cookies to Google’s connectivity service (connectivitycheck.gstatic.com). Google receives your IP address and browser information and can process them in the USA; Google LLC is certified under the EU–U.S. Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is reporting a missing connection instead of failing requests.

The demo

The demo replays answers recorded in advance and sends nothing to model providers or to Google’s connectivity service. Its images are copies hosted on this website. It keeps all changes in memory and sets no cookies.

The demo’s video loads from YouTube (youtube-nocookie.com) only when you click it; until then the demo shows a preview image hosted on this website. YouTube, provided by Google Ireland Limited, then receives your IP address and browser information and can store information on your device; Google can process this data in the USA. Legal basis: your consent by clicking the video, Art. 6(1)(a) GDPR and § 25(1) TDDDG. The consent applies to that page view; reloading the page ends it.

Optional support through Ko-fi

The support button and its cup image load from this website. Ko-fi is contacted only when you follow a Ko-fi link. The support button opens Ko-fi in a new tab. There, Ko-Fi Labs Limited in the UK receives your IP address and browser information and asks for your cookie preferences. This website does not read or store those preferences.

Ko-fi and its payment providers handle the transaction. This website does not collect payment details. If you send a tip, I may receive your name, email address, message and transaction information. See Ko-fi’s privacy and cookie policy for details.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)) and lodge a complaint with a data protection supervisory authority (Art. 77).

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21).

Data in your browser is under your control: I do not hold your projects, prompts, answers or API keys.