Privacy.
Last updated · 23 October 2026The short version: Longwave collects only what it needs to run your account, membership, and community features. It sells nothing. Optional advertising measurement stays off unless you accept it.
What we collect
When you create an account, Supabase (our authentication service) stores your email address and a hash of your password — never the password itself. Alongside that, we keep your subscription status so the site knows what you can watch.
If you use Crew Signals, we also store your public handle, comments and replies, reactions, reports you send, moderation decisions, and any temporary or permanent community restriction. These records include account identifiers and timestamps so the feature can work and abuse can be investigated.
Community activity
Your handle, comments, and replies are visible to eligible signed-in members. Reaction totals are visible, but the account behind an individual reaction is not shown. Your email address is never displayed with a post.
Reports and moderation records are available only through the owner moderation tools. They are used to provide the community feature, enforce its rules, respond to complaints, prevent abuse, protect members, and meet legal obligations. This processing is necessary to provide the service and for Longwave's legitimate interests in running a safe community; legal obligations apply where required.
Comments and your handle remain until you delete them or ask for your account to be deleted. Reactions remain until you remove them or your account is deleted. Reports and moderation records are kept only while reasonably needed to protect the community, handle a complaint or dispute, or meet a legal duty. A limited safety record may therefore remain after other account data is deleted where the law allows or requires it.
Payments
Stripe processes payments and card details. Longwave uses subscription status, plan, customer and subscription identifiers, invoice amounts and payment dates to provide access, handle billing and keep required financial records. These service and financial records are separate from optional product analytics.
Video delivery
The episodes are streamed by Cloudflare. Like any service delivering video, Cloudflare keeps standard server logs (things like IP addresses and request times) to run the network. We don't use those logs to profile you.
Analytics
Daily audience totals follow a rolling 13-month retention rule, with cleanup during collection and when it ends. Hosting and security logs have separate provider retention periods. Account and payment records are kept for service, security and legal needs. A privacy choice does not automatically erase existing attribution history; you can request access or deletion as described below.
We use limited audience statistics to improve the website and streaming experience. These are daily totals for page views, organic source labels, site and audio language, playback and funnel actions. This statistical path does not use a visitor ID, advertising ID, IP hash or persistent journey history, and does not join behaviour to accounts or payments. We do not open a consent panel on arrival. You can turn these statistics off using the footer control; supported browser privacy signals are also respected.
Detailed analytics is optional. If you open Privacy choices and allow it, PostHog can connect visits, playback and subscription steps using a browser identifier and your Longwave account ID when signed in. We do not send email or enable session recordings. Source labels may be saved with a new registration and copied to checkout only while this measurement is allowed. Existing server history is not rewritten.
Advertising measurement is a separate choice. If you accept, OpenAI Ads can link a ChatGPT ad visit to registration, checkout, trials and subscriptions using campaign identifiers and hashed account identifiers. A hash is still personal data, not anonymous data. Future server-side analytics and advertising events check the current saved account choice. A past grant in subscription metadata is not enough. Stripe confirms payments; a registration, trial or zero-value invoice is not a paid subscription.
Emails
We only send account and transactional emails — sign-up confirmations, password resets, billing receipts, that kind of thing. No marketing emails unless you explicitly opt in to them, ever.
Your data, your call
You can ask for a copy of your data, correction of inaccurate data, deletion, restriction, or to object to certain uses. Email us and we will respond in line with applicable data-protection law. Account deletion normally happens within 30 days, subject to the limited safety and legal records described above.
If you are not satisfied with how your personal data is handled, you can complain to the UK's Information Commissioner's Office.
Third parties
Our service providers include Supabase (accounts and community), Stripe (payments), Cloudflare (video), Vercel (hosting), PostHog (optional analytics, US Cloud) and OpenAI (optional advertising measurement). These providers can process personal data outside the UK or EEA; applicable transfer safeguards must be in place. Discord receives the membership details needed for access if you connect it. Notification providers deliver alerts you request. We do not sell personal data.
Community posts are also shared with the eligible members described above; reports are shared with the owner for moderation. Longwave does not sell personal data.
Changes & contact
If this policy changes, the "last updated" date at the top will change with it. Questions, export requests, deletion requests, or anything else: contact@raphaelurbain.com.