Privacy.

What we collect

When you create an account, Supabase (our authentication service) stores your email address and a hash of your password — never the password itself. Alongside that, we keep your subscription status so the site knows what you can watch.

If you use Crew Signals, we also store your public handle, comments and replies, reactions, reports you send, moderation decisions, and any temporary or permanent community restriction. These records include account identifiers and timestamps so the feature can work and abuse can be investigated.

Community activity

Your handle, comments, and replies are visible to eligible signed-in members. Reaction totals are visible, but the account behind an individual reaction is not shown. Your email address is never displayed with a post.

Reports and moderation records are available only through the owner moderation tools. They are used to provide the community feature, enforce its rules, respond to complaints, prevent abuse, protect members, and meet legal obligations. This processing is necessary to provide the service and for Longwave's legitimate interests in running a safe community; legal obligations apply where required.

Comments and your handle remain until you delete them or ask for your account to be deleted. Reactions remain until you remove them or your account is deleted. Reports and moderation records are kept only while reasonably needed to protect the community, handle a complaint or dispute, or meet a legal duty. A limited safety record may therefore remain after other account data is deleted where the law allows or requires it.

Payments

Payments are handled entirely by Stripe. Your card details never touch our servers — they go straight to Stripe, and Stripe's own privacy policy governs that payment data. All Longwave sees is whether your subscription is active and which tier it is.

Video delivery

The episodes are streamed by Cloudflare. Like any service delivering video, Cloudflare keeps standard server logs (things like IP addresses and request times) to run the network. We don't use those logs to profile you.

Analytics

We use PostHog in cookieless mode to understand behaviour — how many people start an episode, how many reach the subscribe page, that kind of thing — so we can improve the site. It does not use advertising cookies or follow you around the web. When you are signed in, activity may be linked to your Longwave account identifier and email so sessions can be connected and member journeys understood. If you arrive from a tagged link (say, a link in a TikTok bio), we may record that source alongside a subscription so we know which channels are working.

We also offer an optional OpenAI Ads measurement choice. If you accept, the OpenAI measurement pixel uses first-party identifiers to connect a ChatGPT ad visit with actions such as account creation, checkout, a trial, or a paid subscription. Paid-subscription events are confirmed by Stripe on our server. Longwave sends only the campaign identifiers and hashed account identifiers needed for measurement; it does not send your raw payment-card data. You can reject this choice or change it later using the “Privacy choices” button.

Cookies & local storage

A couple of small things live in your browser: a session token that keeps you signed in between visits, and local storage used for cookieless analytics, your privacy choice, and things like which episodes you've watched. If you accept OpenAI Ads measurement, first-party OpenAI attribution identifiers are also stored so a later trial or subscription can be linked to the ad visit. They are not enabled before you accept. Rejecting or withdrawing your choice stops OpenAI measurement and removes the saved attribution identifiers. Signing out clears the active Longwave session from your browser.

Emails

We only send account and transactional emails — sign-up confirmations, password resets, billing receipts, that kind of thing. No marketing emails unless you explicitly opt in to them, ever.

Your data, your call

You can ask for a copy of your data, correction of inaccurate data, deletion, restriction, or to object to certain uses. Email us and we will respond in line with applicable data-protection law. Account deletion normally happens within 30 days, subject to the limited safety and legal records described above.

If you are not satisfied with how your personal data is handled, you can complain to the UK's Information Commissioner's Office.

Third parties

Longwave's main service providers are Supabase (accounts and community data), Stripe (payments), Cloudflare (video delivery), Vercel (hosting and community requests), PostHog (cookieless product analytics), and—only after you accept measurement—OpenAI (advertising measurement). If you choose to connect Discord, Discord receives the account and membership information needed to assign your community access. Browser notification providers receive what they need to deliver an alert you requested. Each provider receives only what is needed for its job.

Community posts are also shared with the eligible members described above; reports are shared with the owner for moderation. Longwave does not sell personal data.

Changes & contact

If this policy changes, the "last updated" date at the top will change with it. Questions, export requests, deletion requests, or anything else: contact@raphaelurbain.com.