Privacy policy

Your account

• Your email address and name.
• Your password, which we only ever store as a secure hash (argon2id), never as the password itself.
• When you confirmed your email address and last changed your password.

Signing in and security

• If you sign in with Google: your Google account ID, email address and name. We don’t get your Google password or anything else from your Google account.
• If you turn on two-factor authentication: your authenticator secret, stored encrypted, and your backup codes, stored as hashes.
• Your signed-in sessions, with the IP address and browser they came from.
• A log of sign-in activity, such as sign-ins, password changes and failed attempts, with IP address and browser, so we can spot and stop account takeovers and abuse.

Payments

• Payments go through our checkout partner, Whop. We never see or store your full card details.
• From Whop we receive your Whop user ID and your plan, payments, refunds and disputes, with amounts and currency.
• For invoices, we keep the name, email address, billing address and tax details that appear on them.

What you make

• Your video topics and choices, such as style and length, the scripts we write for you, and scripts you bring yourself.
• Brand profiles, including their language, voice and any background image you upload. We remove photo metadata, such as location, from uploads.
• Your finished videos, thumbnails and captions, and your credit history, which notes the topic of each video.
• If you use voice input, the recording of what you say, so it can be turned into text.

Before you sign up

If you pick a topic, style, length or plan before creating an account, we remember those choices so they’re waiting in your new account.

We don’t use analytics tools, advertising cookies or tracking pixels, and we don’t buy data about you.

• To make your videos: researching topics, writing scripts, and producing narration, pictures, music and the edit.
• To run your account: signing you in, keeping your account secure, and stopping fraud and abuse.
• For payments: adding credits when you pay, handling refunds and disputes, and issuing invoices.
• To email you: confirmation and password reset links, receipts, and important notices about your account or LongFormat.
• To help you: answering your questions and fixing problems.
• To meet legal duties: such as keeping tax records.

We don’t sell your personal data or use it for advertising. We only show a video you made in public examples, such as on our website, if you’ve given us permission.

If you’re in the European Economic Area, the United Kingdom or another place with similar laws, we rely on:

• Our contract with you to provide your account, make your videos and handle payments.
• Our legitimate interests to keep LongFormat secure, prevent abuse, and fix and improve the service.
• Legal obligations to keep invoices and tax records.
• Your consent where we ask for it, such as showing your video in public examples. You can withdraw it at any time.

We use trusted services to run LongFormat. They handle data on our behalf, only for the work we give them:

We may also share data when the law requires it, to protect people’s rights and safety, or as part of a merger or sale of the business, in which case we’ll tell you first.

Some of these services process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

Working files are deleted as soon as a video is finished. To save space, we may remove older finished video files from our servers while keeping your scripts, thumbnails and captions, so download the videos you want to keep.

• Passwords are stored only as argon2id hashes, and two-factor secrets are encrypted.
• One-time links and backup codes are stored as hashes, so even our own database doesn’t reveal them.
• Sign-in cookies can’t be read by scripts on the page, and are only sent over HTTPS.
• Repeated sign-in attempts are limited, two-factor authentication is available, and changing your password signs out your other sessions.

No system is perfectly secure, but if a breach affects your data, we’ll tell you and the authorities as the law requires.

Depending on where you live, you can ask us to:

• give you a copy of your personal data, or send it to another service;
• correct data that’s wrong;
• close your account and delete your data;
• limit or object to how we use your data;
• withdraw consent you’ve given.

Email us at support email, and we’ll reply within 30 days. Some things, like signing out your other sessions, you can do yourself in the app.

If you’re not happy with how we handle your data, you can also complain to your local data protection authority.

LongFormat isn’t meant for anyone under 18, and we don’t knowingly collect their data. If you think a child has given us personal data, contact us and we’ll delete it.

When our practices change, we’ll update this policy and the date at the top. If a change is significant, we’ll tell you by email or in the app before it takes effect.