SideScatter privacy notice
Version 0.1, effective 22 Oct 2026. Draft for a research beta; not reviewed by a lawyer.
Who runs SideScatter
SideScatter (formerly Gatecraft) is made by Anaphase (Anaphase Ltd, incorporation pending). Until incorporation completes, the service is provided by Paul Maciocia, London, UK, trading as Anaphase. Registered office (on incorporation): 71-75 Shelton Street, London WC2H 9JQ. The company number will be added here once it is issued.
For this notice, Anaphase is the controller of the support, problem-report and security information described below. SideScatter has no accounts and no cloud storage, so Anaphase holds no copy of your cytometry data.
Contact for privacy questions and requests: paulmaciocia@gmail.com.
The short version
- Your FCS files and your analysis stay in this browser. SideScatter does not upload event data. Three things you choose to do can send information off your computer: an AI request, a problem report, and a share link you send to someone. Each is described below.
- SideScatter does not load advertising or analytics trackers. The production bundle contains no analytics script, and its fonts are served from the same site, not from a font service.
- Anaphase does not sell personal information and does not use your content to train AI models.
- SideScatter is for research use only. It is not for clinical, diagnostic or treatment decisions. Do not put patient-identifiable information into it, including in file names, sample names, keywords or notes.
What happens to your information
Work in the browser
FCS files you open are read by your browser and analysed there (in the page and in web workers). Workspaces, gates, gating templates, compensation presets, settings and the autosave copy of your workspace are stored in this browser (local storage and IndexedDB). They are not encrypted by SideScatter and are readable by anyone with access to this browser profile. Clearing site data removes them. Anaphase cannot see or recover them. The storage notice lists every key.
If you choose a data folder, the browser gives SideScatter permission to read that folder on your computer. The folder handle is kept in this browser so the permission can be offered again; the files are not copied anywhere.
Actions that send information off your computer
Optional AI assistant (Copilot)
- When: only when you have switched the assistant on and send a message. With the assistant off, a built-in offline helper answers and nothing is sent.
- What is sent: your message and the conversation so far; on the first message, a short description of the open analysis (file name, number of events and channels, channel names and their marker labels, the current plot axes and scales, whether compensation is applied, and gate names and types); and the results of any tool the assistant runs on your behalf, which can include population counts, percentages, medians, a compensation report and cytometer details from the file's keywords. Per-event measurements are never sent.
- Where it goes: to SideScatter's server function at
/api/copilot(hosted by Vercel), which forwards it to the AI provider. With your own key, that is the provider you chose, and your key travels in a request header that the server passes on and does not store or log. Without your own key, the request uses the limited hosted mode: free models through OpenRouter, which passes it to the model host it names for that request. - How long it is kept: SideScatter's server keeps no copy of the prompt or the answer. What the AI provider keeps depends on its terms (yours with your provider, or OpenRouter's and the model host's in limited hosted mode). Vercel's request logs record that a request was made (see "Security and operational logs").
- How to remove it: Anaphase holds nothing to remove. For data held by your own provider, ask that provider.
The AI page describes the hosted states and their limits.
Problem reports
- When: only when you open "Report a problem", optionally write a note, and press send. Errors are collected in memory while you work but are not sent unless you send a report.
- What is sent: your note (up to 1,000 characters); the most recent error's type, message and stack trace (file paths reduced to file names) and up to five recent errors; the page address (first 200 characters); your browser's user-agent string; and a snapshot of the app's state: up to ten sample file names, the channel names, the number of gates, the current plot axes, plot type and view, and the event count.
- Where it goes: SideScatter's server function at
/api/report(hosted by Vercel), which writes it as one line to the Vercel runtime log for the project. It is not sent anywhere else by SideScatter. - How long it is kept: for the runtime log retention period of the Vercel plan the project is on (proposed maximum 90 days; see the retention table below).
- How to remove it: email paulmaciocia@gmail.com with the approximate time of the report.
Sample file names and channel names can say a lot about an experiment. Rename files before reporting if their names are sensitive.
Workspace share links
- When: only when you create a share link and give it to someone.
- What is in it: the workspace description (gate definitions, population names, sample names, settings and notes), compressed into the part of the link after
#ws=. Event data is never included; the recipient has to open the FCS files themselves. - Where it goes: the part of a link after
#is not sent to the server when the link is opened, so Anaphase does not receive it. Anyone who has the link can decode it, and it is stored wherever you paste it (email, chat, notes). - How to remove it: Anaphase holds no copy. Delete the messages that contain the link.
Loading the app and the demo data
Opening SideScatter downloads the app and, if you choose a demo, the demo FCS files from the same site. These are ordinary web requests, recorded in the hosting provider's request logs.
Desktop preview
The desktop preview runs the same app in a local window. Its AI proxy runs on your own computer (127.0.0.1:8787) and sends AI requests straight to the provider you configure there, or to a local model server.
Support and feedback
If you email paulmaciocia@gmail.com, we keep the email thread to answer you. Send a synthetic or redacted example rather than real research data, and never send passwords, keys or patient information.
Security and operational logs
Hosting providers record standard request information (network address, time, path, status, user-agent). We use it to keep the service running and to investigate misuse. For SideScatter this is Vercel's request and runtime logging for the project; SideScatter adds only the problem reports described above.
Lawful bases (UK GDPR)
| Purpose | Basis |
|---|---|
| Serving the app and demo data you open | Legitimate interests (providing the tool you chose to use) |
| Security logs, abuse prevention, rate limits | Legitimate interests (keeping the service available and safe) |
| Optional AI requests | Your choice to send each request; the request is processed to perform the action you asked for (contract) |
| Problem reports you send | Legitimate interests (fixing the faults you report) |
| Answering support email | Legitimate interests |
Who receives information
| Recipient | What for | What it can receive | Location |
|---|---|---|---|
| Vercel Inc. | Hosting the app and its server functions | Request logs (network address, time, path, user-agent); problem reports; AI requests in transit | United States and edge locations worldwide |
| OpenRouter Inc. | Limited hosted AI on free models | AI requests in limited hosted mode; OpenRouter forwards them to the model host it names for the request | United States, plus the routed model host |
| Your own AI provider | AI requests made with your own key | AI requests | Set by your provider |
With your own AI key, the provider you choose is your provider, not Anaphase's sub-processor, and your agreement with it applies. The shared Anaphase sub-processor list, covering all Anaphase products, is published with the company site once it exists; until then this table is the list for SideScatter.
Some providers are in the United States. Transfers rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Addendum otherwise. Which mechanism applies to each provider is still being confirmed.
How long information is kept
"Proposed" means the period is the target but no automatic deletion job enforces it yet.
| Information | Where | Kept for | Status |
|---|---|---|---|
| Files, workspaces and settings in your browser | Your browser | Until you clear them | You control it |
| Share links | Wherever you paste them | Not held by Anaphase | You control it |
| Problem reports you send | Vercel runtime logs | The Vercel plan's log retention, at most 90 days | Proposed |
| Hosting request logs | Vercel | The Vercel plan's log retention, at most 30 days | Proposed |
| AI prompts and answers | Not kept by SideScatter's server | Not kept | In force (no storage code exists) |
| Support email | Email provider | 2 years from the last message | Proposed |
Your rights
You can ask for a copy of your personal information, ask us to correct or delete it, object to or restrict some processing, and ask for portability where it applies. Email paulmaciocia@gmail.com. We will check identity before acting and reply within one month.
If you are unhappy with our answer you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113.
Children
SideScatter is a research tool for adults and is not directed at children.
Changes
We will change the version and date at the top when this notice changes, and say what changed in the release notes.