Privacy Policy

Your Privacy at a Glance

Longhand is designed with a local-first architecture. Your API Keys are stored exclusively in your operating system's secure credential store (e.g., macOS Keychain) and are never transmitted to or stored on our servers. The content of your AI interactions (API requests and responses) flows directly from your device to your chosen Model Provider — it never passes through our servers. We do collect product analytics (feature usage, errors, app version) via PostHog and provide in-app support via Intercom to improve the Service. This Privacy Policy ("Policy") explains what data we collect, how we use it, and your rights under GDPR, CCPA/CPRA, LGPD, PIPEDA, and other applicable privacy laws worldwide.

1. Introduction

This Privacy Policy describes how Technical Leaders Inc., a Delaware corporation ("Company," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you install, access, or use Longhand and all related services (collectively, the "Service"). This Policy applies to all users worldwide and addresses specific regulatory requirements for users in the European Economic Area ("EEA"), United Kingdom ("UK"), California, Canada, Brazil, South Korea, and other jurisdictions with applicable data protection laws.

By installing, accessing, or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service. This Policy should be read in conjunction with our Terms of Service.

2. Data Controller Information

For the purposes of applicable data protection laws, the data controller is:

Entity: Technical Leaders Inc.

Address: 1062 E Oaks Manor Dr., Fayetteville, AR 72703

Email: privacy@technical-leaders.com

Data Protection Officer: dpo@technical-leaders.com

The Company does not maintain an establishment in the European Economic Area (EEA) and does not engage in large-scale monitoring of EEA data subjects or large-scale processing of special categories of personal data. Accordingly, the Company relies on the exemption under Article 27(2) of the GDPR and has not appointed an EU representative at this time. If the Company's processing activities change such that an EU representative is required, this Policy will be updated to reflect that appointment.

3. API Key Handling — Local-First Architecture

Key Privacy Safeguard

We do NOT collect, transmit, store, or have access to your API Keys. All API Keys are stored exclusively in your operating system's secure credential store (e.g., macOS Keychain, Windows Credential Manager) and are processed entirely on your device. Our analytics systems do not collect API Key values, API request content, or API response content.

3.1 Technical Architecture

Our local-first architecture for API Keys operates as follows:

• API Keys are stored in your operating system's native secure credential store (macOS Keychain, Windows Credential Manager, or equivalent), leveraging OS-level encryption and access controls.
• API calls to Model Providers are initiated directly from your device to the provider's endpoints, without routing through our servers.
• We cannot access, read, decrypt, or recover your API Keys under any circumstances.
• Our product analytics (described in Section 4.2) never include API Key values, the content of prompts sent to Model Providers, or the content of responses received from Model Providers.

3.2 Implications for Users

Because API Keys are stored locally on your device:

• Uninstalling the Service may or may not remove API Keys depending on your OS credential store behavior.
• API Keys do not automatically synchronize across devices.
• We cannot assist with API Key recovery if they are lost.
• You are solely responsible for backing up and securing your API Keys.

3.3 API Key Security Recommendations

We strongly recommend that you:

• Use API Keys with the minimum necessary permissions (least-privilege principle).
• Set usage limits and spending caps with your Model Providers.
• Regularly rotate your API Keys as recommended by the respective providers.
• Monitor your Model Provider dashboards for unexpected usage patterns.
• Immediately revoke any API Key you suspect may be compromised.

4. Information We Collect

4.1 Information You Provide Directly

We collect information that you voluntarily provide when you:

• Create an account (e.g., name, email address, password hash).
• Update your profile or account settings.
• Contact our support team or provide feedback.
• Participate in surveys, beta programs, or professional services engagements.
• Subscribe to newsletters or marketing communications.

4.2 Information Collected Automatically

Although Longhand is a desktop application with a local-first architecture for AI processing, the Service does collect certain analytics and operational data during normal use:

• Product Analytics (PostHog): The Service collects usage analytics including app launch events, feature usage (Skill and workflow creation, execution, and reviews), settings changes, learning and certification progress, platform information (operating system), app version, and your email address for user identification. Session recording is disabled. Error reports (error messages and stack traces, truncated to 2,000 characters) and main thread performance data are also collected. The Rust-side error tracking component is opt-in via configuration.
• In-App Support (Intercom): The Service integrates the Intercom support widget, which identifies you by email address when activated.
• License Verification: The Service contacts the Company's licensing server to validate your Seat license, transmitting your license token and basic device information.
• Software Updates: The Service checks for updates via a CDN-hosted update manifest (currently cdn.crabnebula.app). Update checks transmit the current app version, OS family, and architecture; no user-identifying data is included. Update artifacts are signed with Minisign (which uses Ed25519 internally) and verified on your device before installation.
• Content Delivery: Learning videos and educational content are served from cdn.getlonghand.com.
• Community and Pricing: The Service may fetch aggregate community statistics and current pricing information from Company endpoints.
• Account Authentication: When you sign in, standard authentication data (IP address, timestamp) is processed.
• Website Analytics: If you visit our website (separate from the desktop application), standard analytics data (browser type, pages visited, referring URLs) may be collected.

4.3 Information We Do NOT Collect

To be explicitly clear, we do NOT collect:

• Your API Keys (stored locally on your device only, as described in Section 3).
• The content of API requests or responses processed through your API Keys.
• Model Provider account credentials or authentication tokens.
• The content, outputs, or configurations of your Agents, Skills, or workflows.
• Financial or payment information of your Model Provider accounts.
• The contents of the embedded vault (encrypted Skill bundles, MCP configurations, and shared credentials). Vault data is encrypted on your device under a master key derived from credentials you control; the Company cannot decrypt vault contents, recover master keys, or read transfer payloads exchanged with other Users in plaintext.

4.4 Cookies and Tracking Technologies

The desktop application uses PostHog for product analytics (as described in Section 4.2), which maintains a local identifier for usage tracking. The desktop application does not use traditional browser cookies. If you interact with our website or web-based account management portal, we use the following categories of cookies:

You can manage your cookie preferences through our website's cookie consent banner or your browser settings.

5. How We Use Your Information

5.1 Legal Bases for Processing (GDPR)

For users in the EEA, UK, and Switzerland, we process your personal data based on the following legal bases:

5.2 Purposes of Processing

We use the information we collect to:

1. Provide, operate, maintain, and improve the Service.
2. Create and manage your account and authenticate your identity.
3. Process transactions and send related notifications.
4. Respond to your inquiries, provide customer support, and address complaints.
5. Detect, investigate, and prevent fraud, abuse, and security incidents.
6. Send administrative notices, technical updates, and security alerts.
7. Send marketing and promotional communications (with your consent, where required).
8. Comply with legal obligations and enforce our Terms of Service.
9. Develop new features, products, and services.

5.3 AI and Machine Learning

We do NOT use your personal data, Content, Agent configurations, Skill definitions, or workflow data to train machine learning models. The Company does not collect this data during normal operation. Any anonymized, aggregated data used for service improvement (such as opt-in crash reports) will be de-identified in accordance with applicable regulations.

5.4 Automated Decision-Making (ADMT)

The Service does not use automated decision-making technology to make significant decisions about Users (as defined under the CCPA/CPRA) without human oversight. The AI capabilities within the Service are tools that augment human decision-making; they do not autonomously make decisions that produce legal or similarly significant effects on Users.

6. Data Sharing and Disclosure

6.1 Categories of Recipients

We may share your personal information with the following categories of recipients:

• Service Providers: Third-party vendors who perform services on our behalf (hosting, email delivery, payment processing, customer support), bound by contractual obligations to protect your data.
• Model Providers: When you use the Service, your device sends requests directly to Model Providers (Anthropic, OpenAI, Google, xAI, or local models) using your API Keys. The Company does not intermediate or have visibility into these requests.
• Legal and Regulatory: Government authorities or law enforcement when required by applicable law, regulation, legal process, or enforceable governmental request.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.
• With Your Consent: Any other parties you expressly authorize.

6.2 What We Never Share

We will never:

• Sell your personal information to third parties.
• Share API Keys (we do not have access to them).
• Share your personal data with third parties for their direct marketing purposes without your explicit consent.
• Use your data for AI model training.
• Disclose your data to data brokers or advertising networks (unless you opt in to marketing cookies on our website).

6.3 International Data Transfers

If we transfer your personal data outside of your jurisdiction, we will implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Brazilian Standard Contractual Clauses (Brazilian SCCs) for transfers from Brazil, as required under the LGPD.
• Adequacy decisions where available.
• Binding Corporate Rules where applicable.
• Your explicit consent where required and appropriate.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law. No indefinite data retention is permitted under our policies. Our general retention periods are:

Upon account deletion, we will delete or anonymize your personal data within thirty (30) days, except where retention is required by law. API Keys and all locally-stored data (Agent configurations, Skills, workflows) reside on your device and are not affected by account deletion.

8. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256) for any data stored on our servers.
• API Keys protected by your operating system's native credential store encryption (e.g., macOS Keychain uses AES-256-GCM).
• Regular security assessments and penetration testing.
• Access controls and principle of least privilege for our personnel.
• Incident response procedures and breach notification protocols.
• Employee security training and confidentiality agreements.

In the event of a data breach affecting your personal data, we will notify affected users and relevant supervisory authorities within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Article 33 and other applicable breach notification laws.

9. Your Privacy Rights

9.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Article 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): Request deletion of your personal data, subject to legal exceptions.
• Right to Restriction (Article 18): Request that we limit the processing of your personal data.
• Right to Data Portability (Article 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw previously given consent at any time.
• Right to Lodge a Complaint: File a complaint with your local supervisory authority.

9.2 Rights Under CCPA/CPRA (California)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of personal information collected, used, disclosed, or sold.
• Right to Delete: Request deletion of personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information).
• Right to Non-Discrimination: Exercise your rights without discriminatory treatment.
• Right to Limit Sensitive Personal Information: Direct us to limit the use of sensitive personal information.
• Right to Opt-Out of ADMT: Opt out of automated decision-making technology for significant decisions (note: we do not use ADMT for such purposes).

9.3 Training Data Transparency (California AB 2013)

In compliance with the California Generative AI Training Data Transparency Act (AB 2013, effective January 1, 2026), we disclose that Longhand does not train or develop its own generative AI models. Longhand is a platform that enables users to interact with third-party Model Providers (Anthropic, OpenAI, Google, xAI, and locally-hosted models) using the user's own API Keys. We do not collect or use user data for AI model training. For information about each Model Provider's training data practices, please refer to their respective privacy policies and transparency disclosures.

9.4 US State Privacy Laws

The Company complies with applicable state comprehensive privacy laws, including those in effect in Delaware, Indiana, Iowa, Kentucky, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Colorado, Connecticut, Virginia, Utah, Montana, Oregon, Texas, and Maryland. If you are a resident of any of these states, you generally have rights to access, correct, delete, and port your personal data. Contact us to exercise these rights.

9.5 Rights Under LGPD (Brazil)

If you are located in Brazil, you have rights under the Lei Geral de Protecao de Dados (LGPD), including the right to access, correct, delete, anonymize, or port your personal data, and to be informed about the entities with which your data has been shared. International transfers of your data are governed by Brazilian Standard Contractual Clauses (effective August 23, 2025).

9.6 Rights Under PIPEDA (Canada)

If you are located in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access your personal information, challenge its accuracy, and withdraw consent.

9.7 Rights Under South Korea Basic AI Act

If you are located in South Korea, the Basic AI Act (effective January 2026) provides additional transparency, risk assessment, and human oversight requirements for AI systems. As a platform that facilitates user interaction with AI models, we comply with applicable transparency and documentation obligations.

9.8 Exercising Your Rights

To exercise any of your privacy rights, please contact us at privacy@technical-leaders.com or dpo@technical-leaders.com. We will respond to all verifiable requests within the timeframes required by applicable law (generally within thirty (30) days for GDPR and forty-five (45) days for CCPA). We may request additional information to verify your identity before processing your request.

10. Children's Privacy

The Service is not directed to individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. In compliance with the amended Children's Online Privacy Protection Act (COPPA, as amended April 22, 2025, compliance deadline April 22, 2026):

• We do not knowingly collect personal information, including biometric data, from children under 13.
• We do not use children's data for AI model training or development.
• We do not engage in indefinite data retention of any user data.

If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at privacy@technical-leaders.com.

11. AI Transparency (EU AI Act Compliance)

In compliance with the European Union Artificial Intelligence Act (EU AI Act), we provide the following transparency disclosures:

11.1 AI System Description

Longhand is an AI agent platform that enables users to build, configure, and deploy Agents, Skills, and workflows that interact with third-party Model Providers (Anthropic, OpenAI, Google Gemini, xAI Grok) using the user's own API Keys, or with locally-hosted models running on Longhand's bundled llama-server runtime or any user-managed OpenAI-compatible local endpoint. The AI processing is performed by the Model Providers, not by Technical Leaders Inc.. Longhand is a desktop application built with Tauri that runs locally on user devices. The Service includes a local smart routing system that selects the optimal model and provider for each request based on prompt complexity, without sending routing data to external servers.

11.2 Risk Classification

As of the effective date of this Policy, the Service is classified as a general-purpose AI application tool (minimal risk) under the EU AI Act framework. The Service does not make autonomous decisions in high-risk domains (healthcare, law enforcement, critical infrastructure, etc.) without human oversight.

11.3 AI Literacy (Article 4, effective February 2, 2025)

The Company provides documentation, training materials, and support resources to help Users understand the AI capabilities and limitations of the Service, in compliance with the AI literacy obligations under Article 4 of the EU AI Act.

11.4 Transparency and Content Marking (Article 50)

In compliance with Article 50 of the EU AI Act (enforceable August 2, 2026):

• Users are informed when they are interacting with AI-generated content within the Service.
• AI-generated outputs are clearly labeled or identifiable.
• The Service supports machine-readable content marking (C2PA metadata standard) for AI-generated outputs where applicable.
• The Company maintains documentation of the AI systems and Model Providers used within the Service.

11.5 Human Oversight

The Service is designed to augment, not replace, human decision-making. Users maintain full control over whether to accept, modify, or reject AI-generated outputs. Agent outputs intended for customer-facing use should be subject to appropriate human review and quality assurance.

12. Do Not Track Signals

We respect Do Not Track ("DNT") browser settings on our website. The desktop application collects product analytics via PostHog as described in Section 4.2; PostHog session recording is disabled. Some third-party services integrated into our website may not respond to DNT signals.

13. Third-Party Links and Services

The Service may facilitate interactions with third-party services, including Model Providers. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any Model Provider or third-party service before providing them with your information. The Company is not responsible for the privacy practices of third-party services.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will provide notice of material changes by posting the updated Policy on the Service and updating the "Last Updated" date. For significant changes, we will provide at least thirty (30) days' advance notice via email or in-app notification. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Privacy Inquiries: privacy@technical-leaders.com

Data Protection Officer: dpo@technical-leaders.com

Legal Inquiries: legal@technical-leaders.com

Mailing Address: 1062 E Oaks Manor Dr., Fayetteville, AR 72703

EU Representative: Not applicable — see Section 2 for the Company's Article 27(2) exemption basis.

For GDPR-related inquiries, we will acknowledge receipt within forty-eight (48) hours and provide a substantive response within thirty (30) days. For CCPA-related requests, we will respond within forty-five (45) days as required by law.

By installing or using the Service, you acknowledge that you have read and understood this Privacy Policy.