Longhaul Privacy Policy
Effective date: 15 October 2026
Who is responsible
Chaoming Weng, trading as Longhaul, 23 Vevay Crescent, Bray, Co. Wicklow, A98 EW28, Ireland, is the controller of the personal data described here. Contact: support@uselonghaul.com.
The short version
- The relay forwards your tool calls and their results (which include source code) between ChatGPT and your Mac. It does not store that content, and its logs record only which tool ran, for which account, how long it took, and whether it worked.
- We hold your email address, your subscription status, and what is needed to connect your Mac. We never see your card details.
- We do not sell your data or use it for advertising.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | Your account; sign-in codes; service and billing emails | Contract |
| Sign-in codes, sessions, and device tokens (stored as one-way hashes; a new device token is held for at most 10 minutes until your Mac collects it) | Keeping you signed in and your Mac connected | Contract |
| Your Mac's name, while a pairing code is open (10 minutes) | Showing which Mac is being connected | Contract |
| The list of Longhaul tools your Mac offers | Answering ChatGPT quickly; it describes the tools, not your files | Contract |
| ChatGPT authorization records | Letting your ChatGPT connector use your account | Contract |
| Stripe customer and subscription IDs, subscription status and dates | Knowing whether your plan is active | Contract |
| A fingerprint of the card used for a trial, from Stripe | One free trial per card | Legitimate interest (preventing abuse) |
| Server logs: account ID, tool name, duration, status, and payment events | Running, securing, and fixing the service | Legitimate interest |
| IP addresses, in memory only | Rate limits against abuse; not written to the relay's logs | Legitimate interest |
| Emails you send to support | Answering you | Legitimate interest |
The content passing through the relay (your prompts, code, diffs, and command output) is held in memory only while it is forwarded, and is not stored or logged.
Giving us your email address is needed to have an account; without it we cannot provide the service. We make no decisions about you by automated means alone.
Cookies
The relay's pages set only cookies they need to work: keeping you signed in, connecting your Mac, and the ChatGPT authorization flow. The sign-up page uses Cloudflare Turnstile to tell people from bots. We use no advertising or analytics cookies, so we do not ask for cookie consent.
What stays on your Mac
The app keeps its settings, project state, task history, and logs on your Mac. Your ChatGPT sign-in lives in the app's browser storage on your Mac. Codex runs on your Mac under your own OpenAI account; what OpenAI receives from ChatGPT and Codex is covered by OpenAI's privacy policy, not ours.
Who processes data for us
| Provider | Role | Data |
|---|---|---|
| Amazon Web Services (Ireland) | Runs the relay server (Amazon Lightsail) and sends sign-in and service emails (Amazon SES) | Everything the relay holds; email address and message content |
| Cloudflare | DNS; the website; the human check on sign-up (Turnstile); app downloads and updates; database backups | IP address and request details; backups contain the relay database |
| Stripe and Link (Stripe Managed Payments) | Checkout, payments, tax, receipts, refunds; Link is the merchant of record and decides how it uses payment data, under its own privacy policy | Your payment details and billing address |
| Zoho (EU data center) | The support mailbox | Emails you send to support and our replies |
The relay server, its email, and the support mailbox are in the European Union. Some providers (such as Cloudflare, Stripe, and Link) may process data outside the European Economic Area. Each such transfer is covered by the EU-US Data Privacy Framework where the provider is certified, or otherwise by the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep it
- Account data: while you have an account. When you ask us to delete it, we delete it within 30 days.
- Sign-in codes expire in minutes, pairing codes in 10 minutes, and browser sessions in 30 days.
- Server logs: no longer than 30 days.
- Database backups: 30 days, so deleted data leaves the backups within 30 days of deletion.
- Stripe keeps payment and tax records for as long as the law requires.
Your rights
You can ask to see, correct, export, or delete your data, or object to or restrict how we use it, by writing to support@uselonghaul.com. To delete payment records held by Link, you can also ask Link, which then also cancels the subscription. We answer within one month. If you are unhappy with our answer, you can complain to the Irish Data Protection Commission (dataprotection.ie) or the data protection authority where you live.
Security
Sign-in codes, sessions, and device tokens are stored as one-way hashes, connections are encrypted, and the storage provider encrypts backups at rest. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.
Children
Longhaul is not for anyone under 18.
Changes
We may update this policy. For changes that matter to you, we email you before they apply.