What we collect, and what we don't.

Last updated 9 May 2026. This is an early draft for Splitstream's closed beta. We will publish a finalised policy before opening to general availability. By using the service during the beta you accept the terms below.

Who we are

Splitstream is operated by the team behind splitstream.ai. Contact: privacy@splitstream.ai.

Data we collect from you directly

Account email and display name (used to sign you in and address support). Workspace name and slug. Nothing else is collected from a form on our side.

Data we collect through integrations

When you connect GitHub, Vercel, or PostHog you authorise Splitstream to read a scoped subset of your account data via OAuth. Specifically:

GitHub: repository metadata, file contents on the repo you connected, and the right to open pull requests.
Vercel: project metadata and preview deployment URLs for the project you connected.
PostHog: aggregate event counts queried via HogQL — we never read individual event payloads or user identifiers.

Integration access tokens are stored encrypted at rest in our database. Revoking access on the provider's side immediately revokes our access.

Data we generate

For every experiment we record: the variant code we generated, the PR we opened on your behalf, conversion counts pulled from PostHog, and the winner decision. This is stored against your workspace and visible only to workspace members.

Data we do not collect

We do not collect end-user PII from your visitors. We do not embed any tracking script of our own — the only client-side script we add to your site is your own PostHog snippet, configured against your PostHog project. We do not sell or share data with advertising or analytics third parties.

Subprocessors

Supabase (database + auth, Frankfurt region), Inngest (job orchestration), Anthropic (LLM inference for variant generation), Vercel (hosting). All listed subprocessors are SOC2-compliant.

Your rights

You can export your workspace data at any time from the dashboard, and request full deletion by emailing privacy@splitstream.ai. Deletion is processed within 30 days and cascades to all subprocessors.

Changes

We will email all account owners at least 14 days before any material change to this policy.