Longline Labs Account Privacy Policy
Effective date: November 3, 2026
Draft. This version was written on November 3, 2026 for review by our attorney and is in use on the test site only. The questions it raises are listed in
legal/FOR-THE-ATTORNEY.md.
We never sell your information, and we never use it for advertising or to train artificial intelligence models. This policy explains what LONGLINE LABS LLC ("Longline Labs," "we," "us") collects through the Longline Labs account service at account.longlinelabs.com (the "Account Service"), why, who helps us handle it, and the choices you have.
1. Who this covers, and what it does not
This policy covers people who create a Longline Labs account, and visitors to account.longlinelabs.com. A Longline Labs account is one sign-in for the Longline Labs apps: Coifish, ReelMinder, PacketSkipper, BallastBook, ShipShape and AboveBoard (the "Apps").
Each App has its own Privacy Policy. What an App does with the information you put into it, and with what we tell it when you sign in (Section 4), is covered by that App's policy, not this one.
The Account Service is a business tool. It is not meant for consumers or personal use.
2. Information we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Your name, email address, and a scrambled form of your password (never the password itself) | You, at sign-up and on your account page |
| Two-step sign-in | The secret shared with your authenticator app, and scrambled recovery codes | Automatically, when you set it up |
| Acceptance records | Who accepted the Terms and this policy, when, which version, and the internet address and browser used | Automatically, when you accept |
| Apps you sign in to | Which Apps you have let sign you in, and when you first did | Automatically, when you approve an App |
| Sign-in records | The time of each sign-in and sign-in attempt, the internet address and browser used, and counts of recent attempts used to slow down guessing | Automatically |
| Support | Messages you send us | You |
| Email delivery | Whether an email we sent you was delivered, bounced or marked as spam | Postmark |
| Technical data | Internet address, browser and device type, pages used, error logs, and one essential sign-in cookie | Automatically, when you use the Account Service |
We do not ask for, and you should not send us, Social Security numbers, bank account numbers, health information or similar sensitive personal information.
3. How we use information
- To sign you in to the Account Service and, at your request, to the Apps.
- To send you the emails the account needs: confirming your address, resetting your password, a sign-in link, confirming a new address, and notices when your password, email address or two-step sign-in changes.
- To keep your account secure: two-step sign-in, limits on sign-in attempts, a check that a person and not a program is creating an account, and notices of security changes.
- To answer support requests.
- To keep the Account Service working and fix problems.
- To send you service messages, such as notice of changes to our Terms or this policy.
- To comply with the law and to enforce our Terms.
4. What we tell an App when you sign in to it
When you choose "Continue with Longline Labs" in an App and approve the sign-in here, we give that App: your name, your email address, confirmation that the address has been verified, and a code that identifies your account. The App uses them to find or create your login there. We do not give an App your password, your authenticator secret, your recovery codes, or anything about the other Apps you use. Your account page lists the Apps you have let sign you in.
Each App's own Privacy Policy covers what it does with this information and with everything you do in that App.
5. What we do not do
- We do not sell personal information or share it for cross-context behavioral advertising.
- We do not use advertising or tracking cookies, analytics trackers, or social media pixels.
- We do not use your information to train artificial intelligence models.
- We do not send marketing email to account holders.
6. Who we share information with
We share information only as this policy describes:
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | The database and the sign-in service that holds accounts | United States (Virginia) |
| Vercel | Website and application hosting | United States |
| Postmark | Sending the account's emails | United States |
| Cloudflare | Our domain's name service, and the "are you a person?" check on the sign-up page (Turnstile) | United States |
| Proton | Our contact@ mailbox, which holds the messages you send us | Switzerland |
Each provider may use the information only to provide its service to us. We may also share information:
- With the Apps you sign in to, as Section 4 describes;
- When the law requires, for example in response to a valid subpoena or court order, or to protect the rights, safety or property of Longline Labs, our customers or others; and
- In a business transfer, such as a merger, acquisition or sale of assets, to a buyer that will honor this policy. We will tell you before your information becomes subject to a different policy.
7. Cookies
The Account Service uses one essential cookie, which keeps you signed in. It is needed for the service to work and cannot be switched off. The sign-up page's "are you a person?" check is run by Cloudflare and may set a cookie of its own for that purpose, under Cloudflare's privacy policy. We use no advertising, analytics or tracking cookies, so there is nothing for browser "Do Not Track" or Global Privacy Control signals to switch off. If this changes, we will update this section before it does.
8. Where information is stored
Information is stored and processed in the United States, except messages you send to our contact address, which our email provider, Proton, keeps in Switzerland. The Account Service is offered for use in the United States.
9. Security
- Connections to the Account Service are encrypted in transit.
- Our database provider encrypts stored data at rest.
- Passwords are stored only in a scrambled form (a salted bcrypt hash) that cannot be turned back into the password, and passwords that have appeared in known data breaches are refused.
- Recovery codes are stored in the same scrambled form, and each works once.
- Sign-in attempts are limited, so a password cannot be guessed by trying many.
- We reach stored data directly only to run, maintain and secure the Account Service, or as the law requires.
No system is perfectly secure. If we determine that account information was accessed or acquired without authorization, we will tell affected people without unreasonable delay, and no later than 10 days after that determination, and will notify regulators where the law requires us to.
10. How long we keep information
| Information | How long |
|---|---|
| Account details, two-step sign-in secrets, and the list of Apps you sign in to | While the account exists, then up to 30 days; then deleted from active systems |
| Backups | Removed as backups expire on our normal schedule, and never restored except to recover from a failure |
| Sign-in attempt counts | 10 minutes |
| Sign-in records and technical logs | For a limited period, and longer only if needed to investigate a security issue |
| Support messages | As long as needed to answer and follow up on your request |
| Acceptance records | As long as needed for legal purposes, including after the account is deleted (the link to the deleted account is removed; the email address and the record stay) |
11. Your choices and rights
- Your account page lets you see and change your name, email address, password and two-step sign-in, and see and remove the Apps you have let sign you in.
- Anyone can ask us to tell them what personal information we hold about them, to correct it, or to delete it, by writing to contact@longlinelabs.com. We will confirm your identity before acting, answer within 45 days, and not treat you differently for asking. Deleting your account ends your sign-in to the Apps; each App handles its own data under its own policy.
- State privacy laws. Depending on where you live, laws such as the California Consumer Privacy Act may give you further rights, including to appeal a decision about your request. Write to us with "Appeal" in the subject line. You may use an authorized agent, with written permission we can verify.
- Email. You cannot opt out of service messages while you have an account. We send no marketing email.
12. Children
The Account Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.
13. Changes to this policy
If we make a material change, we will email account holders at least 30 days before it takes effect and show the new effective date at the top. We will not use information already collected in a materially different way without the consent required by law.
14. Contact
LONGLINE LABS LLC. Email: contact@longlinelabs.com.