Privacy policy

What LongSpan collects

Your account: your email address and name, and your sign-in, which WorkOS handles for LongSpan.

Your plan: who is in your household and their birth dates, what you earn, own, owe and spend, and the assumptions, events and scenarios you add, whether you type them or link the account they come from.

Your subscription: when your trial ends, which plan you pay for, through which store, and until when. LongSpan never receives your card number; the store you pay through keeps it.

What it needs to run your account: which institutions you linked, which assistants you connected and what they asked for, and when you use LongSpan.

What LongSpan commits to

Encrypted with a key of its own. Your plan is encrypted in transit and at rest, and with a key that belongs to your household alone. The keys are kept apart from the data, so a copy of LongSpan’s database or its backups shows none of your figures and nothing you typed.

Used only to do what you ask. Your plan is decrypted only by LongSpan’s own systems, and only to do something you asked for: work out your forecast, refresh your accounts, answer the assistant you connected. Settings lists every use of it besides your own.

Opened by nobody at LongSpan. Nobody at LongSpan opens your plan, and LongSpan has no tool that would. If helping you ever needed one, you would be asked first, the access would end on its own, and you would see it in Settings.

Never sold, advertised with or used to train AI. LongSpan never sells your data, never uses it for advertising, and never uses it to train AI models, its own or anyone else’s. Its site and apps carry no advertising, analytics or tracking code, and its only cookies are the ones that keep you signed in.

Never in a log or an error report. No amount, name or label of yours is written to LongSpan’s logs or error reports. The emails LongSpan sends you count what changed; they never say what it changed to.

Kept apart from every other household. The database itself refuses to hand one household’s rows to another household’s request, whatever the request asks for.

Gone when you delete your account. Deleting your account deletes your plan and then your household’s key, so the encrypted copy a backup still holds can never be read again.

Who else sees what

LongSpan shares your information only with the services below, which work for LongSpan, and with the people and assistants you choose. It does not share it with anyone for their own purposes.

People in your household. The partner the owner invites sees the plan at the level the owner chose, and the owner can change that or remove them at any time.

Your bank, through Plaid. If you link an account, LongSpan reads its balance from Plaid and nothing else: never your transactions, never your account numbers. When you link a bank, Plaid’s consent screen says it shares your transactions as well, because LongSpan connects banks through Plaid’s transactions product; LongSpan never reads them and never stores them. Plaid itself may also collect the account holder’s name and contact details from your bank, as its consent screen says, and LongSpan does not ask it for them.

YNAB. If you connect a YNAB budget, LongSpan reads your monthly spending by category from it to fill in your plan.

The assistant you connect. Claude, ChatGPT or another assistant you connect receives the parts of your plan it asks for, under its own privacy terms: whether it may learn from your conversations is set in that assistant’s own settings. You see every request it made in Settings.

Apple, Google, Stripe and RevenueCat. Whichever you subscribe through, Apple, Google or Stripe, takes your payment under its own privacy policy and tells LongSpan only what you bought and until when. RevenueCat keeps that record of your subscription for LongSpan, under your household’s id. None of them receives your plan.

WorkOS. Handles signing in, and holds each household’s encryption key in its vault.

Railway and Vercel. Run LongSpan’s servers and database, which hold your plan only in its encrypted form, and serve this site and the app.

Resend. Sends LongSpan’s emails to you, which carry no amount and nothing you typed.

Sentry. Receives LongSpan’s error reports when something breaks, so it can be fixed: what failed, where in the code, and on which kind of browser or device. A report carries no amount, name or label of yours, no email address and nothing you typed, and never says who you are.

LongSpan may also disclose information when the law requires it, and would pass it to whoever takes over LongSpan, under this same policy.

How long it is kept

Your plan is kept for as long as your account exists, including while a subscription has ended, so it is there if you subscribe again. Deleting your account deletes it, as above.

If your subscription has ended and nobody in your household has signed in for 2 years, LongSpan may delete the household, after emailing the owner at least 30 days before.

Your choices

You can change or remove anything in your plan, disconnect a bank or a budget, revoke an assistant, and remove a partner at any time. The owner can delete the household in Settings, and that cannot be undone.

To ask what LongSpan holds about you, to have something corrected, or with any other question about your data, write to hello@longspan.app.

What LongSpan does not claim

Your plan is not end to end encrypted. LongSpan works your forecast out on its servers and answers your assistant from them, so its systems can decrypt your plan to do that, and whoever runs those systems could in principle reach the keys. That is why access to them is limited, logged and never routine, and why every use of your plan besides your own is listed for you in Settings.

If your data were ever exposed despite all this, LongSpan would tell you, and the authorities the law names, as the law requires.

Everything else

LongSpan is for adults in the United States, and does not knowingly collect information about anyone under 18 except what an adult enters about their own dependents.

If this policy changes in a way that matters, you will be told, by email or in LongSpan, before the change takes effect.

This policy is part of LongSpan’s terms. LongSpan is run by SetForth LLC. Questions: hello@longspan.app.