Privacy Policy

1. Scope and who controls your information

This Privacy Policy applies to the LONGSCHED website, planner, calendar feed, account, AI command, profile, and subscription features (collectively, the “Service”). In this Policy, “LONGSCHED,” “we,” “us,” and “our” refer to the operator of the Service.

LONGSCHED primarily acts as the controller of personal information collected through individual accounts. This Policy does not govern third-party websites or services that have their own privacy notices, even when LONGSCHED links to or works with them.

2. Information we collect

• Account and profile information: email address, display name, authentication provider, account identifiers, time zone, time-format preferences, confirmation status, and profile settings. Authentication credentials are processed through Supabase Auth; LONGSCHED’s planner database does not store plaintext passwords.
• Planner content: day tasks, flexible tasks, longitudinal projects, project nodes, milestones, notes, descriptions, dates, deadlines, times, time zones, priorities, stars, completion status, ordering, and other information you choose to enter.
• AI feature information: typed commands, short voice recordings submitted for transcription, transcripts, relevant planner context sent with a command, generated draft actions, whether an action is accepted or declined, and voice-usage duration used to enforce monthly limits.
• Billing information: trial dates, manual-access dates, Stripe customer and subscription identifiers, subscription status, and current billing-period information. Payment-card and bank details are collected and processed by Stripe, not stored in LONGSCHED’s planner database.
• Calendar-feed information: a random private calendar token and the planner events included in the generated iCalendar feed. Calendar applications that subscribe to the feed receive the event information exposed through that token.
• Support and communications: information you submit through the Contact Us form or otherwise provide when requesting help, reporting a problem, or communicating with us.
• Technical and usage information: essential cookie and session data, IP address, browser or device information, request timing, referring page, error information, security events, and service logs that may be generated by LONGSCHED or its infrastructure providers.

3. Where information comes from

• Directly from you when you create an account, enter planner content, use AI commands, set preferences, subscribe, or contact us.
• From authentication providers, such as Google, when you choose social sign-in. The information received depends on the provider and the permissions you approve.
• From Stripe regarding checkout, subscription, cancellation, and payment status.
• Automatically from your browser, device, cookies, local storage, servers, and service providers when you use the Service.

4. How we use information

• Provide, operate, synchronize, and display your personal planner, monthly calendar, longitudinal projects, profile, calendar feed, and subscription access.
• Create and secure your account, authenticate sessions, confirm email addresses, recover access, and prevent unauthorized use.
• Process typed and spoken planner commands, prepare add-only draft actions, and show those drafts for your review before they are saved.
• Administer free trials, paid access, billing records, checkout, subscription management, cancellations, and account deletion.
• Respond to support requests and send transactional or service-related communications, including account, security, confirmation, billing, and policy notices.
• Detect, investigate, and prevent fraud, abuse, security incidents, technical failures, and violations of our Terms of Service.
• Maintain, troubleshoot, analyze, and improve the reliability, usability, and safety of the Service, including through aggregated or de-identified information where practical.
• Comply with law, enforce agreements, establish or defend legal claims, and protect LONGSCHED, users, and others.

5. Legal bases for processing

Where privacy law requires a legal basis, we process information as necessary to perform our contract with you; with your consent; to comply with legal obligations; and for legitimate interests such as securing, supporting, and improving the Service, preventing misuse, and protecting legal rights. Where we rely on consent, you may withdraw it at any time, although withdrawal does not affect earlier lawful processing.

6. AI and voice commands

• When you use an AI command, LONGSCHED sends the command and limited planner context needed to interpret it to OpenAI. Voice commands also send the temporary audio file to OpenAI for transcription.
• LONGSCHED does not intentionally retain the raw voice recording in its planner database after the request is processed. A transcript, command text, generated draft, and acceptance status may be stored as part of a pending planner action or service record.
• LONGSCHED does not use your private planner content to train its own general-purpose AI model. OpenAI processes information under its applicable terms, privacy notice, and LONGSCHED’s service configuration or agreement with OpenAI.
• Do not include information in an AI command that you do not want processed by an AI service provider. AI output may be incomplete or inaccurate, and you remain responsible for reviewing a draft before accepting it.

7. Cookies and local storage

• LONGSCHED currently uses essential cookies for authentication, session refresh, security, and billing redirects. These cookies are necessary for signed-in planner features to work.
• LONGSCHED uses browser local storage to remember that you dismissed the cookie notice and may use local storage for non-account demonstration state.
• The current Service does not use advertising cookies or sell browsing activity for targeted advertising. If non-essential analytics or advertising technologies are introduced, this Policy and any required consent controls will be updated.
• You can block or delete cookies and local storage through your browser, but doing so may sign you out or prevent account and planner features from working correctly.

8. Private calendar-feed links

A LONGSCHED calendar feed is protected by a long random token in its URL, not by an interactive sign-in each time a calendar application refreshes it. Anyone who obtains the URL may be able to read the events in that feed. Treat the calendar URL like a password, do not publish it, and remove it from calendar services or contact us if you believe it has been exposed. Third-party calendar applications process imported events under their own privacy policies.

9. How we disclose information

• Supabase, which provides authentication, session management, database hosting, and related infrastructure.
• OpenAI, which processes typed commands and voice recordings or transcripts to provide AI-assisted draft actions.
• Stripe, which provides checkout, payment processing, subscriptions, and the customer billing portal.
• Google, when you use Google sign-in or submit the Google-hosted Contact Us form.
• Hosting, email-delivery, logging, security, and technical service providers that process information only as needed to operate and protect the Service.
• Government authorities, courts, law enforcement, or other parties when reasonably necessary to comply with law or legal process, protect rights or safety, investigate fraud or abuse, or enforce our agreements.
• A buyer, successor, adviser, or other participant in a merger, financing, acquisition, reorganization, bankruptcy, or sale of some or all of the Service, subject to appropriate confidentiality protections where required.
• Other parties at your direction or with your consent.

10. Data isolation and security

LONGSCHED uses administrative, technical, and organizational safeguards designed to protect information. Current controls include authenticated sessions, server-only secret keys, owner-scoped database queries, and database row-level security intended to separate each user’s planner workspace. No method of transmission, storage, or security is completely reliable, so we cannot guarantee absolute security.

You are responsible for using a strong unique password, protecting your account and calendar-feed link, signing out on shared devices, and promptly contacting us if you suspect unauthorized access.

11. Retention and deletion

• We generally retain account and planner information while your account is active and as needed to provide the Service.
• You may delete your account from the profile page after canceling any managed Stripe subscription. Account deletion is intended to remove the authentication account and associated active planner data.
• Limited information may remain temporarily in encrypted backups, security logs, fraud-prevention records, support records, or systems where immediate deletion is technically impracticable. Billing, tax, transaction, and legal records may be retained when required or permitted by law.
• Information held independently by Stripe, Google, OpenAI, a calendar provider, or another third party is subject to that provider’s retention practices and may require a separate request to that provider.
• We may retain aggregated or de-identified information that can no longer reasonably identify you.

12. Your privacy rights and choices

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or information about how personal information is processed and disclosed. You may also have the right to withdraw consent, appeal a decision, or complain to a privacy regulator. These rights may be subject to verification, exceptions, and limitations under applicable law.

• Review and update available profile, email, password, time-zone, and billing settings through your account and Stripe’s Customer Portal.
• Delete planner entries individually or delete your account through the profile page when eligible.
• Submit a privacy request through the Contact Us form. We may ask for information reasonably necessary to verify your identity and authority.
• You will not receive discriminatory treatment for exercising a privacy right protected by applicable law.

13. Regional disclosures

For applicable U.S. state privacy laws, LONGSCHED may collect identifiers, account credentials, customer records, commercial information, internet or network activity, approximate location inferred from IP address or time-zone settings, and personal information contained in user content. These categories are used and disclosed for the business purposes described above. LONGSCHED does not currently sell personal information or share it for cross-context behavioral advertising.

If you access LONGSCHED from outside the country where its operator or providers are located, your information may be transferred to and processed in other countries, including the United States. Where required, transfers will use an approved legal mechanism or another basis permitted by applicable law.

14. Children’s privacy

LONGSCHED is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information in violation of this section, contact us so we can investigate and delete it as appropriate. Users who are not old enough to enter a binding contract in their location must use the Service only with permission from a parent or legal guardian.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, law, or data practices. We will post the revised version with a new effective date and provide additional notice when required by law. Your continued use after an update takes effect is subject to the updated Policy.