SlideScaleOpen the studio

Privacy policy

last updated 7 September 2026

Who we are

SlideScale is operated by Quilt Labs LLC. This policy covers slidescale.app and the SlideScale studio. It describes what we collect, why, where it goes, and how to get rid of it.

What we collect

WhatWhyWhere it lives
Email addressTo identify your account and send you password resets and receipts.Supabase (Postgres)
PasswordOnly as a salted hash. We never see or store the password itself. If you sign in with Google we store no password at all.Supabase Auth
Images you uploadThey are the raw material of your slideshows. We store them so your pools persist between sessions.Cloudflare R2, private bucket
Hooks, captions, CTA copy, style settingsThe text and look of the posts you generate.Supabase (Postgres)
Billing detailsHandled entirely by Stripe. We store a Stripe customer id and your subscription status — never a card number.Stripe; ids only in Supabase
TikTok connection (optional)Only if you connect TikTok. Access and refresh tokens so we can act on the permissions you granted, plus the account's TikTok id, display name and avatar so the studio can show you which account is linked.Supabase (Postgres)
TikTok metrics and post ids (optional)Only if you connect TikTok. View, like, comment and share counts for your own posts, and TikTok's ids for the posts we sent, so a post can be matched to the hook that ran it.Supabase (Postgres)

What we do not collect

SlideScale runs no analytics, no advertising pixels, no session recording and no third-party trackers. There is no Google Analytics, no Meta pixel and no heatmap tool on this site or in the studio.

The only cookies we set are the ones that keep you signed in. There is no cookie banner because there is nothing to consent to beyond the session itself.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Your images

Uploaded images are stored in a private bucket. They are not public, not indexed, and not listable. When the studio displays one it uses a time-limited signed link generated for you; the link expires, and it is not a permanent address anyone can share.

We do not look through your images, and we do not use them to train anything.

AI processing

Hook and body copy are written by Claude, a model provided by Anthropic. When you generate, we send Anthropic the text needed to do it: your product description, your audience description, your hooks, and your CTA line.

Your images are never sent to the model. Slides are assembled and rendered on our own servers; the model only ever sees text.

Anthropic processes this on our behalf as a service provider and does not use it to train its models.

TikTok

Connecting TikTok is optional and off by default. If you connect it, we request three permissions:

  • user.info.basic — the account's display name and avatar, so the studio can show you which account is linked.
  • video.list — the public view, like, comment and share counts on your own posts, so the studio can tell you which hooks worked.
  • video.upload — to send finished slideshows to your TikTok drafts.

Posts we send go to your drafts, never to your profile. TikTok calls this an inbox upload. Nothing is published until you open TikTok and post it yourself, choosing the sound, the cover and the audience at that point. We do not request video.publish, which is the permission that would let an app post to a profile directly, so publishing without you is not something we are able to do.

We cannot delete, edit or message from your account, and we do not request the ability to.

TikTok also notifies us when a draft we sent has been posted. We use that to know a draft has left your inbox — TikTok limits how many unposted drafts it will hold — and to record TikTok's id for the post so its metrics can be matched to the hook that ran it.

Disconnecting from the studio unlinks the account, and the stored tokens are deleted once no account you run is still using that connection. Metrics already recorded stay on your posts, so reconnecting later resumes rather than starting over; deleting the account or batch deletes those too.

Who else processes your data

ProviderWhat for
SupabaseDatabase and authentication
CloudflareObject storage (R2) and DNS
AnthropicGenerating hook and body copy
StripePayments and subscription management
VercelHosting the website
RailwayHosting the API and background workers
TikTokOnly if you connect it

Each is used only to run the parts of SlideScale described above. We do not pass your data to anyone for their own purposes.

How long we keep things

  • Rendered exports are deleted automatically 24 hours after the export finishes. They are a cache, not storage — the plan they were rendered from stays on your batch, so you can export again at any time.
  • Images, hooks and batches are kept until you delete them or close your account.
  • Billing records are kept by Stripe for as long as tax and accounting rules require, which is generally seven years.

Deleting your data

Deleting an account in the studio deletes its pools, hooks and every batch inside it, along with the underlying image files. Deleting a batch deletes its posts.

To delete your login and everything attached to it, email daniel@quilt-labs.com from the address on the account. We will action it within 30 days and confirm when it is done.

You can also ask for a copy of what we hold, or ask us to correct it. Depending on where you live you may have further rights under the GDPR, the UK GDPR or the CCPA — including the right to complain to your data protection authority. We honour those requests regardless of where you live.

Security

Traffic is encrypted in transit. Passwords are hashed, never stored in plain text. Storage is private and reachable only through short-lived signed links. Access to production systems is limited to people who need it to operate the service.

No system is perfect. If we discover a breach affecting your data we will tell you and the relevant authority without undue delay.

Children

SlideScale is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, email us and we will remove it.

International transfers

Our providers operate in the United States and the European Union, so your data may be processed outside the country you live in. Where transfers are restricted by law, they are covered by the standard contractual clauses our providers offer.

Changes

If we change this policy we will update the date at the top. For changes that materially affect how we handle your data, we will email you before they take effect.

Questions about either document? daniel@quilt-labs.com. See also our privacy policy and terms of service.