Privacy notice

MorphScreen is an API that turns a model's answer into a user interface. This notice covers this website (morphscreen.com), the dashboard (app.morphscreen.com), the API (api.morphscreen.com) and the mail we send.

MorphScreen is run by Nandishwar Singh, a sole proprietor, at Ward number 5, Hiranagar, Jammu and Kashmir 184142, India, who decides how the data below is used (the data fiduciary under India's DPDP Act, the controller under the GDPR). Questions and requests go to support@morphscreen.com.

1. What we collect

• Visits to this website: each page seen, where the visit came from (the site that linked to it, or the ref and utm_ tags in the link) and the country the IP address belongs to, counted without cookies. To count a visitor once a day, the server mixes the IP address and the browser's description of itself with a secret that changes every day, keeps that mix in memory until the day ends, and stores only the totals. Your IP address isn't stored.
• Recordings of visits, only if you say yes: when you agree on this website, Microsoft Clarity records how you use it: clicks, scrolling, and the pages you see, with what you type hidden. Say no, or say nothing, and Clarity isn't loaded at all. Change your mind with "Recording choices" at the foot of any page. The dashboard is never recorded.
• Your account: your email address, the version of this notice and of the terms you agreed to and when, and when you confirmed the address. If you sign in with GitHub, also your GitHub account's number and its verified primary address. We ask GitHub for nothing else.
• The device check at sign-up: the sign-up page checks your device to prevent fraud, so one person can't collect the free calls many times over. FingerprintJS, an open-source library running in your browser, works out an identifier from your browser's characteristics. We keep only a one-way hash of it, mixed with a secret of ours, and use it only to see whether another account signed up from the same device. If it did, the new account still works, but its calls run on your own model key instead of ours.
• The check that you're a person: Cloudflare Turnstile runs a check in your browser when you sign up, sign in or ask to delete your account. Cloudflare sees what that check needs, under its own privacy policy.
• Where a sign-up came from: the ref and utm_ tags of the link you followed, and the country your IP address belongs to. We don't keep your IP address. To limit sign-ups from one network, the server counts requests per network in memory, under a hash, and forgets the count each day.
• Your use of the API: for each call, when it was made, with which key, the endpoint and model, how it ended, how long it took, whether the answer was valid, which components had errors and what repair did, and what it cost us when it ran on our model key. Never the prompt or the answer, unless you turn on debug logs (below).
• Debug logs, if you turn them on: for a project with debug logs on, the prompts and answers of its calls, kept 7 days and then deleted. They're off unless you turn them on in the dashboard.
• Billing: your plan, and the ids, amounts and states of your subscription and payments. Razorpay takes your card, UPI or bank details; we never see them.
• Demo calls, if you book one: Calendly takes the booking (your name, email and the time). With your agreement at the start of the call, Fathom records and transcribes it, so we can go back over what you told us.

2. Why, and on what basis

• To run your account and the API you signed up for, and to bill for it: the contract between us.
• The device check, Turnstile and the limits per network: to prevent fraud and abuse of the free plan, a legitimate interest of ours that keeps the free plan possible.
• Visit counts, and where sign-ups come from by country and link: to know which channels work, a legitimate interest. Nothing here identifies you.
• Clarity's recordings, debug logs and demo-call recordings: your consent, which you can take back at any time.
• Mail: sign-in links, a welcome mail, warnings as you near your plan's limit, and billing notices. We send no marketing mail.

3. Who handles it for us

• OpenRouter passes each call's conversation to the model that answers it. On our model key we only use providers that don't keep or train on it. With your own OpenRouter key, your OpenRouter settings apply.
• Cloudflare runs Turnstile.
• Resend sends our mail.
• Razorpay takes payments.
• GitHub signs you in, if you choose it.
• Hostinger rents us the server this website, the API and its database run on.
• Microsoft runs Clarity, for visitors who agree to it.
• Calendly and Fathom, if you book a demo call.

We sell nothing about you to anyone, and nothing goes to advertisers.

4. Cookies and storage

• This website sets no cookies of its own. Your browser keeps your answer about recordings (in local storage) and, for the visit, the link tags you arrived with (in session storage), so a sign-up knows where it came from.
• If you agree to recordings, Clarity sets its cookies: _clck and _clsk on this site, and Microsoft's own on its domains, to tie the pages of a visit together.
• The dashboard sets ms_session, which keeps you signed in for 30 days or until you sign out, and ms_github, which ties a GitHub sign-in to your browser for 10 minutes. It uses no analytics or advertising cookies.

5. How long it's kept

• Your account and its records: until you delete the account.
• Visit counts: as totals per day, page, source and country, with nothing that identifies a visitor.
• Clarity's recordings: Microsoft keeps them for 30 days, and up to 13 months for ones we mark to study.
• Sign-in links and GitHub sign-in states: a day at most. Sessions: until they end.
• Debug logs: 7 days.
• Demo-call recordings: until we've taken our notes from them, or sooner if you ask.
• Nightly backups of the database are kept for 7 days, then weekly for 4 weeks and monthly for 12 months, so a deleted account is gone from backups within 12 months.
• Razorpay keeps its own records of your payments, as the law requires of it.
• After an account is deleted, two things stay, with nothing of it left but a number: its payments' records (the amount, the date and Razorpay's ids), as tax law asks us to keep them, and the counts of what happened (a sign-up, a payment), so past months' figures stay true.

6. Your rights

You can delete your account yourself, on the dashboard's Account tab: everything it holds goes at once, and from the backups as they age out, but for the payment records and counts above. Write to support@morphscreen.com to get a copy of your data, to correct it, or with any complaint; we aim to answer within 30 days. Under India's Digital Personal Data Protection Act you can also take a complaint to the Data Protection Board of India, and in the EU or UK to your data protection authority.

7. Changes

When this notice changes, the version above changes, and we aim to mail account holders before a change that affects them takes effect.