Your privacy in SplaySpace
SplaySpace collects only what it needs to sign you in and keep your team's shared projects in sync. It has no advertising, analytics or tracking, and it never sells personal information.
Effective .
Who we are
SplaySpace is a VS Code extension, a collaboration service at
api.splayspace.com and relay.splayspace.com,
and this website. It is developed independently by the SplaySpace team.
In this policy, "we" means the SplaySpace team. We handle personal
information in line with the Australian Privacy Principles in the
Privacy Act 1988 (Cth).
SplaySpace was previously released under a different name. This policy also covers it under that name.
What we collect
| Information | Source |
|---|---|
| Account ID from GitHub, Microsoft or Google | Your sign-in provider, when you sign in. |
| Email address | Your provider: GitHub's primary verified address, Google's verified address or your Microsoft account email. |
| Name, GitHub username and profile picture URL | Your provider. Microsoft sign-in supplies no picture. |
| SplaySpace username | You, when you choose or change it. |
| Shared project content | You and your teammates: file names, paths and contents, edits, comments, @mentions and .splayignore rules. |
| Collaboration records | Created as you use SplaySpace: project memberships and roles, invitations, notifications, which teammate last edited each line, and sign-in sessions. |
| Technical information | Our servers: your IP address, request times and the API address requested. |
We do not collect or store:
- Your GitHub, Microsoft or Google password or access tokens. SplaySpace reads your identity once during sign-in and discards the provider's token.
- Your repositories, other files on your computer, or files your
.splayignoreor SplaySpace's built-in rules exclude, such as.git,node_modules,.env,*.pemand*.key. - Usage analytics or telemetry. The extension's logs stay on your computer unless you choose to share them.
- Cookies. This website sets none and loads nothing from third parties.
Cursors, selections and which file a teammate has open are relayed live between project members and are not saved.
What we ask your sign-in provider for
SplaySpace only requests access to your identity and profile information.
| Provider | Permissions requested | What they allow |
|---|---|---|
| GitHub | read:user, user:email | Read your profile and email addresses. |
| Microsoft | openid, profile, email | Confirm your identity and read your name and email. |
openid, email, profile | Confirm your identity and read your name, email and profile picture. |
We use the provider's token only during sign-in, to read who you are. We don't save it, don't use it afterwards and don't request offline access to your account.
How we use it
- To sign you in and keep you signed in on your devices.
- To run shared projects: syncing files and edits, showing presence, delivering comments and notifications, and enforcing each member's role.
- To let teammates find you: others invite you by your SplaySpace username.
- To protect the service: limiting repeated requests, investigating faults and preventing abuse.
We do not use your information for advertising, profiling or training AI models.
Who can see it
- Your project teammates see your username, display name, profile picture, live cursor and open file, your edits and the lines you last changed, and your comments. Observers can view but not edit.
- Anyone holding an invitation link can see the project's name, the inviter's display name and the role offered, until the link expires or the host revokes it.
- Service providers who host and deliver SplaySpace for us: Oracle Cloud (application servers and database), Cloudflare (network tunnel, website hosting and encrypted database backups) and GitHub (source code and release images, which contain no user data). They process information only to provide those services.
- Your sign-in provider learns that you signed in to SplaySpace. Its own privacy policy applies to what it does.
We may disclose information if Australian law requires it. We will not sell or rent personal information.
Storage outside Australia
Our service providers may store or process information outside Australia. Cloudflare routes traffic through its global network, and our cloud servers and backups may be located overseas. We choose providers that protect information with encryption in transit and access controls.
How long we keep it
| Information | Kept until |
|---|---|
| Account and profile | You ask us to delete your account. |
| Project files, edits and comments | The host deletes the project, or the file or comment is deleted. A deleted file's contents are erased; its name may remain in the project's records until the project is deleted. |
| Sign-in sessions | 30 days after the session expires or you sign out. |
| Notifications | 30 days if unread, 90 days once read. |
| Invitations and invitation links | 90 days and 30 days after they expire. |
| Database backups | Up to 30 days, after which they are deleted automatically. |
Access, correction and deletion
You can:
- Change your SplaySpace username at any time with SplaySpace: Change Username.
- Leave a project, or delete a project you host, which removes its files, comments and memberships.
- Sign out, which ends your session on our servers.
- Ask us for a copy of your personal information, to correct it, or to delete your account. Contact us; we will respond within 30 days. Deleting your account removes your profile and sign-in identities. Comments you made in other people's projects may be kept as part of those projects, without your name, so that discussions still make sense.
How we protect it
All connections use HTTPS or secure WebSockets. Sign-in uses PKCE, and we store only one-way hashes of session and invitation tokens. Every request is checked against your current project role. The extension keeps your session in VS Code's encrypted secret storage, and its logs remove tokens and file paths.
No system is perfectly secure, and SplaySpace is still under active development. Avoid sharing projects that contain passwords, API keys or other sensitive data, and keep your own backups. If we become aware of a breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner.
Children
SplaySpace is not intended for children under 16, and we do not knowingly collect their information.
Changes to this policy
We will update the effective date above when this policy changes, and tell you before a significant change takes effect.
Complaints
If you are concerned about how we handle your information, contact us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live.
Contact us
Email [email protected] with privacy questions or requests. Please don't post personal details on the public Marketplace Q&A page.