Why This Matters on a Call Sheet
A call sheet is a list of where your people will be, when, and how to reach them. Home addresses, mobile numbers, unreleased locations, and cast names all sit on one page. Treating it as a public document is how it ends up on a fan site. What follows is what the software does. The rest is distribution discipline, which is yours.
Who Can See a Production
Access is per production. You are either the owner or you hold a membership someone granted you, and there is no path to another production's data without one. Membership carries a role and a tier. The role decides whether you can edit; the tier decides whether you see money. An AD-tier member cannot open Burn Rate, Hot Costs, or the financial columns on a production report, even if they can edit everything else.
| Level | What it controls |
|---|---|
| Viewer | Read only. Cannot change anything. |
| Editor | Can edit the production. |
| AD tier | No access to financial tabs or cost data. |
| Production tier | Full access, including financials. |
Data Protection
The infrastructure protections in place:
| Protection | Description |
|---|---|
| Encryption in transit | HTTPS and TLS on every connection |
| Encryption at rest | Stored data is encrypted |
| Regular backups | Data is backed up regularly |
| Password storage | Passwords are hashed with bcrypt and never stored in readable form |
| Uploads | Files are checked by their actual contents, not their filename, so a renamed script cannot be uploaded as an image |
Sessions and Logins
A signed-in session lasts 30 days, then expires whether or not you are using it. Signing out revokes the session on the server, so the token on that device stops working immediately. "Previous session detected" is tied to the specific browser you signed in on. It is never inferred from your network address, which is what stops two crew on the same unit wifi being offered each other's account. Login attempts are rate limited and pass a captcha check, so a stolen email address cannot be used to grind passwords.
The Links You Text to Crew
Each person gets their own link, showing only their call time and their information. The link carries a random token long enough that guessing one is not realistic. Those links stay valid. They are not single-use, because a 2nd AD reopening their call sheet six times during the day is the normal case. Treat a mobile call sheet link the way you would treat a printed call sheet: it is fine in the hands of the person you sent it to, and it should not be forwarded outside the unit.
Admin Access and Audit
Support staff can reach production data when a support request requires it. Privileged admin actions are written to an append-only audit trail that records who did what, to which record, and from where. The trail has no delete or edit path, including for the admins it records.
Your Data Rights
You can:
- Export your production data at any time
- Request deletion of your account and data
- Remove anyone's access to a production you own