Your family’s stories are not our product

1Who we are, and how to reach us

In short: Longtold is run by Wood Candle Co LLC in Verona, Wisconsin. Write to hey@longtold.life and a person answers.

Longtold is a family-storytelling service: one question a week goes to a family’s storyteller, the answers become emails to the people that family chooses, and a year of them becomes a printed book. We are Wood Candle Co LLC, doing business as Wood Candle Co, a company registered in Wisconsin, United States. In this policy, “we,” “us” and “Longtold” mean Wood Candle Co LLC operating the Longtold service at longtold.life.

Wood Candle Co LLC is the controller of the personal information described here. For anything at all about this policy — a question, a correction, a request to see or delete what we hold — write to hey@longtold.life. A person reads that address, and we would rather answer a question than have you wonder.

The same company runs woodcandleco.com. That site has its own privacy notice covering the shop, and nothing your family writes in Longtold is shared with it — the two do not exchange customer lists, orders or stories.

2Who this policy is for

In short: It covers everybody Longtold touches — storytellers, the person running the year, readers on a family’s list, and people the stories are simply about.

Longtold has more kinds of people in it than most services, and they are not all in the same position. This policy covers all of them.

The storyteller

The person answering the questions — usually a parent or grandparent. Their account holds their name, their stories, and everything they upload.

The person who set the family up

Often a son or daughter. They run the year, manage the reading list and, on a paid plan, pay for it. They have an account of their own.

Readers on a family’s list

The relatives and friends the family sends stories to. Most never create anything: they are added by someone in the family, and they read through a private link in their email. Some later open a reading account with a password of their own.

People the stories are about

The hardest case, and the one worth stating plainly. A family tree in Longtold holds people who never signed up for anything and never will — including people who have died. Where the information comes from explains how we treat information a family gives us about somebody else.

Anyone who texts a photograph in

A family can put a short code on the fridge so relatives can text a photograph into their book. Whoever texts one is covered by this policy too, even though they have no account.

3What we collect

In short: What a person typed in, and the minimum the service has to record to work. Nothing is collected “just in case.”

Everything below is either something a person typed into Longtold or something the service has to record in order to work. There is no category collected “just in case.”

Account information

Your legal name and, if you use one, the name your family knows you by; your email address; a password stored only as a scrypt hash, never as text we could read back; and optionally your birth year and a mobile number if you turn texts on. Readers who open a reading account give an email address and a password on the same terms.

What your family writes and keeps

The stories themselves; the questions asked, including any your family writes; photographs, recordings, letters, scans and documents you upload; the short weekly check-in notes; the replies and reactions relatives send back; the this-or-that answers that print in the book’s margins; and any subjects your family puts off-limits.

The family tree and the reading list

The people your family records — names, other names they go by, relationship, birth and death years where given, and one line about who they were — and the reading list itself: each reader’s name and email address, and their mobile number only if they themselves opt into texts.

Payment information

Handled by Stripe. We never see or store card numbers. What reaches us is which plan a family is on, whether it is in good standing, and Stripe’s own reference for the customer and the subscription, so we can link an account to the right record.

What the service records as it runs

Sign-in sessions

A session is recorded so you stay signed in. We store only a SHA-256 hash of the session token, not the token itself.

Delivery and open records

Whether a story email was sent, and the first time each reader opened it, so the storyteller can see the stories are reaching people. See read receipts.

A record of messages sent

An email ledger holding who a message went to, what kind it was, whether it succeeded, and any error. It records no message content — which is also why nothing on our side can re-send you the exact email you were sent. A story can be sent again from the family’s library, and a question or reminder simply comes round on the next day’s tick; what cannot be reproduced is the message as it was.

Abuse counters

Sign-in, sign-up and password-reset attempts are rate-limited. The counter is addressed by a SHA-256 digest of the address and connection involved, never by the address or the IP itself.

Notification addresses

If you turn on notifications, the address your browser issues for itself and the keys that let only your browser read what we send.

Support records

If you report a bug or send feedback we open a numbered case. It holds what you told us, any screenshot you attached, and our own notes, which are encrypted at rest.

Operator and service records

A log of actions our own staff take on an account, service health and backup records. These name facts and accounts, never story content.

4What we deliberately do not collect

In short: No analytics, no advertising trackers, no device fingerprints, no readable IP addresses, no location, no contacts, no card numbers.

This list is as much a part of the design as the one above, and each line is a decision somebody made rather than an accident.

• No analytics and no advertising trackers. There is no Google Analytics, no Meta pixel, no advertising SDK and no third-party tag of any kind on longtold.life.
• No device fingerprints and no user-agent records. We do not store what browser, phone or computer you sign in from.
• No IP addresses in readable form. Abuse counters hold a one-way digest, which can be counted and cleared but not read back. Our hosting provider keeps ordinary server logs of its own, as any host does.
• No location data. Nothing in Longtold asks for or derives where you are.
• No contacts and no address books. Your family types in the people it wants to send stories to; we never read a phone or an email account to find them.
• No card numbers. See what we collect.

5Where the information comes from

In short: Mostly from you. Some of it a family gives us about somebody else, and that case is worth reading.

Most of it comes from you. Some of it comes from somebody else in your family, and that case deserves saying out loud.

When a family adds a reader, records a relative on the family tree, or names somebody in a story, they are giving us information about a person who has not dealt with us at all. We ask the family to add only people who would be glad to hear from them, and every story email carries a one-click way out that we honor immediately. But we hold that information because a family gave it to us, not because the person did.

If you have been named in a family’s Longtold book and you would rather not be, write to hey@longtold.life and we will help. We will not edit somebody’s memories for them, but we can take you off a reading list, stop any messages, and talk to the family.

A small amount comes from our service providers: Stripe tells us whether a payment succeeded, Twilio tells us whether a text was delivered or refused, and Resend tells us whether an email was accepted. None of them tell us anything about you beyond that.

6What we use it for

In short: Running Longtold, and nothing else. No profiling, no scoring, no automated decisions about anybody.

Running Longtold, and nothing else. In full, that means:

• choosing and sending the week’s question, and reminding a storyteller if it has been sitting;
• delivering stories, and the notes and reactions that come back, to the people your family chose;
• showing your family its own book as it grows, and setting and printing the hardcover at the end of the year;
• keeping accounts secure — signing you in, resetting passwords, rate-limiting attempts and investigating abuse;
• taking payment, if your family is on a paid plan, and telling the payer about their own billing;
• answering support requests and fixing what is broken;
• keeping the service running and recoverable — backups, monitoring and error diagnosis;
• meeting our legal obligations and enforcing our Terms of Service.

That is the whole list. We do not profile you, we do not score you, and nothing in Longtold makes an automated decision that has a legal or similarly significant effect on anybody.

7The one part that involves AI

In short: Exactly one thing is machine-written — next week’s question. You can switch it off, and then nothing is sent at all.

Exactly one thing in Longtold is written by a machine: next week’s question. The stories are never written or rewritten by one, and nothing else in the product is.

What is sent

So that the question is one your family has not been asked before, and is about their actual life, we send:

• the name the storyteller goes by — which is their full name if they have not told us a shorter one — and, if they gave one, their birth year, from which the era they grew up in is worked out;
• the family tree — up to twenty-four people within three generations of your storyteller: each one’s name, relationship, birth and death years, where they were born, and the one line describing who they were;
• short excerpts of recent stories — the five most recent, and at most the opening 600 characters of each;
• every question already in your family’s bank, so that none is repeated, and the last few set aside, with the reason;
• the questions the storyteller has rated, the questions the family reacted to most, and the recent this-or-that answers — all of which say what kind of question lands with this family;
• how long an answer your storyteller likes to write; and
• any subjects your family has put off-limits, so that both the machine writing the questions and the second one checking them know to keep away.

Never anybody’s email address, and never anybody’s phone number. Never a photograph, a recording or a document — no file of any kind leaves for the machine. Never your weekly check-ins, the notes relatives write back, or the sentence a storyteller writes to warn the family about a hard story. It goes to Anthropic and it goes nowhere else.

What is not done with it

What we send is never used to train an AI model — not one of ours, and not Anthropic’s. That commitment is part of why we chose them. Anthropic keeps what we send only briefly, for their own safety checks, under their commercial terms.

How to stop it

Turn curation off in Settings and nothing is sent at all — not less, none. The check happens before any of it is gathered, so there is no request to make. Your questions then come from the bank every family starts with, and anything your own family adds.

You can also hold back one story at a time as you tell it, and put subjects off-limits entirely. A held-back story is never sent, and an off-limits subject is kept out of the questions the machine writes and out of the ones we wrote ourselves.

There is a fuller, plainer account of all of this on Your data, and of what the curator is for on The curator.

8Who else touches it

In short: Eight companies, each doing one job, each given only what that job needs. The list is complete.

Eight companies, each doing one job, each given only what that job needs. This list is complete as of the date at the top of this page.

Railway — hosting

Runs the servers and holds the database and the uploaded files. Everything below passes through here.

Resend — sending email

Delivers questions, stories, reminders and account email. Receives recipients’ names and addresses and the content of the message being sent.

Anthropic — writing the next question

Receives only what the AI section describes, and only if curation is switched on.

Stripe — plans, and tips

Takes payment and holds the card details we never see. Receives an email address and the amount.

Twilio — text messages

Delivers texts, and receives photographs texted to a family’s photo line. Receives the phone number and the message. Only involved for people who opted in, or who texted us first.

Cloudflare — an offsite copy

Holds an encrypted second copy of every uploaded file and of the nightly backups, so that a failure at our host cannot lose your family’s photographs. The files are encrypted before they leave us.

Microsoft — the replies mailbox

Hosts the mailbox that receives replies to story emails, so that a relative can answer an email and have it reach the family. Receives those replies and any photographs attached to them.

cron-job.org — the daily schedule

Calls Longtold once a day to send the week’s questions and take a backup, and once every ten minutes to collect replies. It receives the summary Longtold returns, which names the families that were written to that night.

One more, which we do not choose and cannot switch: your own browser’s notification service — Google’s, Apple’s or Mozilla’s, depending on the browser — if you turn notifications on. It carries the notification to your device. We send it no more than the few words you see on the screen.

Each is bound by its own agreement with us to use what it receives only to provide its service to us. We do not authorize any of them to use your family’s information for their own purposes.

The only other times we would disclose anything

• When the law requires it. A valid subpoena, court order or equivalent legal process. Where we are permitted to tell you first, we will.
• To prevent serious harm. If we believe in good faith that disclosure is necessary to prevent death, serious physical injury, or a crime against a child.
• If the business changes hands. If Wood Candle Co is sold, merged or reorganized, Longtold and the information in it would transfer to the new owner, who would be bound by this policy until they gave you notice and a chance to leave.

9What we will never do

In short: We will not sell it, share it for advertising, train an AI on it, publish it, or read it to decide what to sell you.

These are commitments, not descriptions of current practice that might quietly change. If any of them ever stopped being true, it would be a change to this policy and you would get an email about it before it took effect.

• We will not sell your personal information, rent it, or give it to a data broker. Not the stories, not the photographs, not your family’s email addresses. We have not done so at any point, including in the twelve months before the date on this page.
• We will not share it for cross-context behavioral advertising. There is no advertising in Longtold and there is not going to be.
• We will not train anything on your family’s words — not a model of ours, and not by handing them to somebody else to train theirs.
• We will not make it public. No public profiles, no shareable feed, nothing indexed by a search engine.
• We will not read your stories to decide what to sell you. The only thing that reads them writes next week’s question.

10Cookies and similar technology

In short: Two, both boring, and neither is an advertising cookie. Your light-or-dark choice never even reaches us.

Longtold sets no advertising cookies and no analytics cookies, so there is no consent banner to click past. What it does set:

Your sign-in session

A cookie holding a random session token, so you stay signed in. It is marked HttpOnly so scripts cannot read it, SameSite=Lax, and Secure in production. It lasts thirty days, or until you sign out. Readers who use a reading account get an equivalent one of their own.

Your light or dark preference

Kept in your browser’s local storage, not in a cookie, and never sent to us. It lives only on that device.

A few small conveniences, also local

Where you left your ribbon in the book, whether the reading lamp is on, and whether you have dismissed a banner. Same story: your browser, not our servers.

One more, only if the site is behind a password

While Longtold is behind a pre-launch password, a third cookie remembers that you got past it. It holds a one-way digest, never the password. The curtain is currently down and the site is open, so nobody has this cookie today.

Payment happens on Stripe’s own hosted pages, so any cookie Stripe sets is set there, on their domain, under their policy. We do not load Stripe’s scripts on longtold.life.

11Texts and phone numbers

In short: Off unless somebody turns them on, and STOP always works.

Texts are optional and off unless somebody turns them on, in Settings or on a reader’s own page. A number should only ever be entered by the person who answers it, and we only ever ask somebody for their own. Story texts go only to numbers that have been opted in this way.

Your number is used to send you those notifications and for nothing else. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and text messaging originator opt-in data and consent are never shared with any third party. Reply STOP to any message and the texts end immediately; reply HELP for help. Message and data rates may apply.

If a family uses the photo line — a short code they can put on the fridge so relatives can text a photograph into the book — we receive the photograph and the sending number in order to file it and send one confirmation back. The number is shown to the family as the last four digits only unless it is already on their list.

The full program description is at longtold.life/sms.

12Read receipts and notification records

In short: We record that a story was opened, and when. Nothing else — no location, no device, no browser.

This is the one place Longtold records something about you that you did not type, and we would rather explain it than have you find it.

Story emails contain a small image that records the first time each reader opens the story. It exists so the storyteller — often an elderly parent who has just written something difficult — and the person running the book can see that the stories are reaching people. If you have turned notifications on, we record in the same way when one is delivered, opened or dismissed.

Both record only that it happened, and when. No location, no IP address, no browser and no device details. It is shown to your own family and to nobody else, it is never used for advertising, and it leaves the service in no form at all.

Turning notifications on is the one thing that gives us a device to address: your browser issues an address for itself, and we keep it, along with the keys that let only your browser read what we send. Switch notifications off and it is deleted; so is any address that stops working.

13How it is protected

In short: Encrypted where it sits, with AES-256-GCM. Here is what that covers, what it does not, and the honest limit.

The stories a family tells are the most private thing we hold, and they are treated that way.

Encrypted where it sits

Stories, photographs, recordings, letters, documents, weekly check-ins, the notes relatives write back, what you tell us in a support case, and off-limits subjects are all encrypted at rest with AES-256-GCM. If somebody stole the disk, the database or a backup, they would get nothing readable.

What that encryption does not cover

Names, email addresses, the family tree, the text of the questions themselves, the this-or-that answers that print in the margins, any word you have told us to stop marking as a name in a story, and the filename a photograph arrived under are held in ordinary form, because the service has to search and sort on them to work at all. They are protected by the access controls in this section rather than by encryption, and they never leave except as who else touches it describes.

Encrypted in transit

The whole site is served over HTTPS, with HSTS, and the offsite copies travel encrypted.

Passwords

Hashed with scrypt and a per-password salt, and compared in constant time. No plain copy of a password exists anywhere — we cannot look one up, which is why a forgotten one has to be reset rather than told to you.

Uploads are checked, not trusted

Every uploaded file is identified by its actual first bytes rather than its name or its claimed type, and anything that cannot be positively identified as an image, a PDF, a Word document or a recording is refused. Files are served so that a browser cannot be tricked into running one.

Attempts are limited

Sign-in, sign-up, password-reset and code-guessing attempts are rate-limited, on counters that survive a restart.

Staff access is limited by design, not by policy alone

The operator screens our own staff work in every day can tell us how many stories a family has told. They cannot show us a word of them, and administrative accounts can be protected with an authenticator app.

The honest limit: we hold the key, because the site has to open a story to show it to your family and again to set the book at the end of the year. That means somebody here can open one as well. It happens when something is broken and needs fixing, and for no other reason. No system is perfectly secure, and we cannot promise that a breach will never happen — only that we have built it so that the failures that actually occur do not hand anybody your family’s words.

Private reading links

Readers without an account reach their stories through a private link in their email. That link is their key: whoever holds it can use it. So it ages. Sixty days after a link was last sent, it can still open the stories it was sent for, but it can no longer react, write in the margins, change a phone number or ask the storyteller anything. Any reader’s link can also be replaced outright, on request, which stops every copy of it in every email ever sent — without losing anything that person has written.

14How long we keep things

In short: The stories last as long as your family wants them. Almost everything else has a shorter life than people assume.

A family’s stories are meant to last — that is the entire point — so we keep them for as long as the family has an account with us, and until they ask us to stop. Everything else has a shorter life than people usually assume.

Stories, photographs, recordings and the family tree

Kept until your family deletes its book (see deletion) or closes its account.

Sign-in sessions

Thirty days, or until you sign out. Expired sessions are swept away.

Password reset and sign-in links

One hour. A link sent to somebody who has never set a password lasts seven days, because it is often their only way in and they may read their mail after dinner.

Half-written drafts

Kept until the story is told, so an interrupted sitting is not lost. Earlier versions of an edited story are kept as a safety net, most recent five only.

The record of messages sent

Ninety days. It holds no message content.

Abuse counters

Pruned as they go; a digest of an attempt outlives its window by minutes, not months.

Notifications waiting for the morning

A text or notification raised late at night is held until seven, so nobody’s phone wakes them. Anything still undelivered after forty-eight hours is dropped, and the record of one that was delivered is deleted after thirty days.

Private reading links

We keep a record of every private link we have ever issued a reader, so that an old email still opens the story it carried. They stay until that person leaves the family’s list, or until their link is replaced on request.

Our own record of operator actions

When somebody here comps a family, replaces a link, sends a reset or deletes a book, we record that it happened, who did it and when. It never holds a word any family wrote. These are kept indefinitely: they are how we answer “who changed this, and when?” about our own conduct, and a record of that which we could quietly delete would be worth little.

Support cases

Kept indefinitely, so that we can pick up a conversation where it left off. If your family’s book is deleted, your name, your account and your email address are cut out of any case you filed, and what is left is the correspondence itself.

Backups

Fourteen days on our own disk and ninety days offsite, then they expire. This is the number that decides when a deleted thing is finally gone; seedeletion.

Records we are required to keep

Payment and tax records, kept for as long as the law requires, regardless of anything else on this list.

15Your choices, and how to use them

In short: Most of these are switches inside the product rather than requests you have to make of us.

Most of these are switches inside the product rather than requests you have to make of us, which is deliberate: a right you have to ask for is a right most people never exercise.

Take a copy of everything

From Settings, any time, without asking us. You get every story, photograph, recording and document as ordinary files, with two plain web pages to read them in, that work on your own computer with Longtold switched off entirely.

Delete your family’s book

The storyteller can do this from Settings. See deleting your family’s book.

Correct what we hold

Names, addresses and family details are editable in the product. If something is wrong that you cannot reach, write and we will fix it.

Stop the emails

Every story email has a one-click unsubscribe, and we honor it immediately. Unsubscribing does not delete anything you have written.

Stop the texts

Reply STOP, or switch them off where you switched them on.

Turn off AI curation

One tick in Settings, and nothing is sent at all.

Replace a private reading link

Ask, and that person’s link is retired everywhere it has ever been sent.

For anything not covered by a switch, write to hey@longtold.life. We will need to be reasonably sure you are who you say you are before we act on a request about somebody’s account — usually that means writing from the address the account uses. We answer within forty-five days, and normally within a day or two.

16Deleting your family’s book

In short: The storyteller can delete the book from Settings. Thirty days to change your mind, then it is gone for good.

A storyteller can delete their family’s book from Settings. Everything stops that day: no more questions, no more story emails, and nobody outside the family can reach it.

For thirty days it can be brought back with one click, and nothing is destroyed until then. During that time Longtold is closed to the family — they can still download a copy of everything, which we would urge anyone to do, but not read it here. Whoever signs in sees the date and the way back, because nobody should discover this on the last morning. After thirty days it is destroyed for good, the family’s sign-ins stop working, and nobody can bring it back, including us.

Two things outlive that, and we would rather say so than let you find out.

• Stories we have already emailed are in inboxes around your family, and nothing we do reaches those.
• Backups hold a copy until they expire — fourteen days on our own disk, ninety days offsite. A backup restores the whole service at once and never a single family, so it cannot be used to get your book back; it only decides when the very last copy is gone.

One consequence worth knowing before you press it: if someone in your family also belongs to another family’s book — they told a story there, or added a reader there — we keep their sign-in rather than deleting it, because destroying it would damage the other family’s book. They are simply detached from yours.If you want to know whether that applied to your family, write to hey@longtold.life and we will tell you.

We also keep our own record that an account existed and was deleted, so we can prove we did what you asked. Support correspondence survives too, with the account link and the contact address stripped out of it — a bug report is our record of a fault in Longtold rather than a part of your family’s book.

17Your rights under US state privacy laws

In short: You can know, get a copy, correct, delete and opt out. There is nothing to opt out of, because we do not sell or share.

A number of states — California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana and others — give their residents specific rights over personal information. Where those laws apply to you, you have the right to:

• know what personal information we hold about you, where it came from, what we use it for and who we disclose it to — which this policy sets out in full, for everybody, whichever state they are in;
• get a copy of it in a portable form;
• correct anything inaccurate;
• delete it, subject to the limits in the deletion section;
• opt out of its sale, of its sharing for cross-context behavioral advertising, and of profiling with legal or similarly significant effects;
• limit the use of sensitive personal information; and
• not be discriminated against for exercising any of these. We will never charge you a different price, or give you a worse service, because you did.

There is nothing for you to opt out of, because we do not do any of it. Longtold does not sell personal information and has not; does not share it for cross-context behavioral advertising; and does no profiling of the kind those laws describe. That has been true for the whole of the preceding twelve months. We therefore offer no “Do Not Sell or Share My Personal Information” link, because there is nothing behind it, and we treat any Global Privacy Control signal your browser sends as already satisfied.

The categories, in the law’s own terms

These are the categories the California regulations name, and what we have collected in the twelve months before the date at the top of this page.

Two of those rows differ from the notice on woodcandleco.com, and deliberately: that site uses analytics and advertising tools, and Longtold uses neither. There is no analytics package and no advertising pixel here, so we hold no browsing history and no location for you.

Row L is a yes because it has to be. Some of what a family writes may count as sensitive personal information — a story might mention someone’s health, their religion, their politics or their family life. We cannot know in advance and we do not read them to find out. We use it only to provide the service, exactly as what we use it for describes, and never to infer anything about anybody. Under California law you may limit the use of sensitive personal information; we already use it for nothing beyond running Longtold for your family.

To exercise any of these rights, write to hey@longtold.life, or use the export and delete controls in Settings, which do the same thing faster. An authorized agent may act for you if they can show they are entitled to. If we have to refuse a request we will tell you why, and you may appeal by replying to us; where your state provides one, you may also complain to your Attorney General.

18Do-Not-Track and Global Privacy Control

In short: We do not respond to Do-Not-Track, because no standard for it was ever agreed. Global Privacy Control has nothing here to switch off.

Most browsers offer a Do-Not-Track setting. No uniform standard for honoring it has ever been agreed, and most of the industry does not respond to it, so we do not claim to either.

Global Privacy Control is a different matter, and for Longtold the answer is simple: the signal asks us not to sell or share your personal information for advertising, and we do not do either, for anybody, signal or no signal. There is nothing for it to switch off. If Longtold ever did anything a GPC signal would need to stop, we would honor the signal and this paragraph would say so.

19Complaints

In short: Tell us first and we will look at it properly. You can also go to your Attorney General, or the California unit named below.

If you are unhappy with how we have handled your information, tell us first — write to hey@longtold.life or call 608-438-2800. We will look at it properly and answer you.

If we refuse a request you have made about your own information, you may ask us to think again by replying to that answer, and we will have somebody look at it afresh. Depending on where you live you may also complain to your state Attorney General, or, if you are in the United Kingdom or the European Economic Area, to your local data protection authority.

California residents: if a complaint is not resolved to your satisfaction, you may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210 or (916) 445-1254.

20Children and young people

In short: Longtold accounts are for adults. We do not knowingly collect from, or market to, anyone under 18.

Longtold accounts are for adults. We do not knowingly collect personal information from, or market to, anyone under 18, and the service is not directed at children. By using Longtold you represent that you are at least 18.

Children do appear in these books, and that is as it should be: a story about a father’s childhood is full of children, and grandchildren are on the family tree and often on the reading list. Information like that is given to us by an adult in the family, stays inside that family, and is never used for anything but showing it to them and printing it in their book.

If you believe a child has created an account, write to hey@longtold.life and we will delete it.

21People outside the United States

In short: Longtold is operated from the United States, and your information is processed there.

Longtold is operated from the United States and its servers, backups and service providers are in the United States. If you are somewhere else — a relative reading from abroad, or a family that has moved — your information is transferred to and processed in the United States, where privacy law differs from your own. By using Longtold or reading a family’s stories through it, you understand that.

Longtold is not currently offered to families in the European Economic Area or the United Kingdom, and we do not target it there. If you are in one of those places and have found yourself on a family’s reading list, write to us and we will give you the same access, correction and deletion you would expect at home.

22Changes to this policy

In short: If we change this in a way that matters, account holders get an email before it takes effect.

When we change this policy, the “last updated” date at the top changes with it, and the previous version is available on request.

If we change it in a way that matters — if we start collecting something new, use it for a new purpose, or add a company tothe list of service providers — account holders get an email before it takes effect. We will not quietly widen what we do with your family’s stories and leave you to notice.

23How to see, correct or delete what we hold

In short: A copy of everything and a deletion are both buttons in Settings. For anything else, write to us.

For the two requests people make most often, you do not have to ask us at all, and you do not have to wait:

A copy of everything

Settings › download your archive. Every story, photograph, recording and document, as ordinary files, straight away.

Delete your family’s book

Settings, by the storyteller. See deleting your family’s book for exactly what happens and when.

For anything else — to see what we hold, to correct it, to ask about a person who is not you, or to complain — write to hey@longtold.life or to the postal address in how to contact us. We will need to be reasonably sure you are who you say you are, which usually means writing from the address the account uses. An authorised agent may act for you if they can show they are entitled to. We answer within forty-five days, and normally within a day or two.

24How to contact us about this notice

In short: hey@longtold.life, 608-438-2800, or 203 N Marietta St, Verona, WI 53593.

If you have questions or comments about this notice, write to us at hey@longtold.life, call 608-438-2800, or send a letter to:

If something here is unclear, or you want to know what happens in a case we have not thought of, write and ask. We would rather answer it than have you wonder.