Privacy Policy
Version date: August 6, 2026
1. Scope
This Policy explains how Longform Studio collects, uses, stores, and protects information while providing account authentication, AI content assistance, template recommendations, image search, and export. By using the service, you acknowledge the data practices described here.
2. Information we collect
Account information includes your email address, salted password hash, account creation time, and session records. With Google sign-in, we receive your Google subject identifier, email address, and email verification status; we never receive or store your Google password. Product data may include daily AI usage, authentication security events, and content or options required to fulfill a request. Basic technical data may include IP address, request time, and error logs.
3. Google user data
Google user data is used only to create or identify your Longform Studio account, prevent duplicate accounts, and maintain your session. We do not use Google user data for advertising, sell it, or use it for purposes unrelated to authentication. We request only the basic identity information needed for sign-in and do not request access to Gmail, Google Drive, contacts, or other Google service content.
4. AI and image requests
When you actively use an AI feature, your submitted content and generation options are sent to the configured AI provider for processing. When you use Pro image templates, AI-generated search terms may be sent to Pexels to find images. Do not submit unnecessary identity documents, health or financial information, trade secrets, or other sensitive data.
5. Service providers and sharing
We share data only as necessary to deliver features. Cloudflare provides hosting, D1, R2, and Turnstile; Google provides sign-in; AI providers process generation requests you initiate; Pexels provides image search; and Resend sends password reset emails. Each provider processes relevant data under its own terms. We do not disclose account information to other parties except when required by law, needed to protect users and the service, or necessary to complete a feature you explicitly request.
6. Retention
Account records are retained while your account remains active. Sessions are generally retained for up to 30 days. Password reset tokens expire after 30 minutes and can be used only once. Rate-limit and security records are retained for a reasonable period needed to prevent abuse. After account deletion, information that is no longer needed will be deleted or anonymized, subject to legal, security, dispute, and backup requirements.
7. Security
Passwords are stored using salted PBKDF2 hashes; sessions use HttpOnly and SameSite cookies; sensitive tokens are stored only as irreversible digests; and Google ID tokens are verified on the server for signature, audience, issuer, and expiration. Registration, sign-in, and password recovery use server-verified Turnstile challenges and rate limits. No online service can guarantee absolute security, but we apply safeguards proportionate to the risk.
8. Your rights and choices
You can change your password and sign out after logging in. You may contact us to request access, correction, or deletion of account information. You may stop using Google sign-in and use an email password where available. Revoking Google authorization does not automatically delete your Longform Studio account. Applicable law may also provide rights to object, restrict processing, receive portable data, or complain to a regulator.
9. International processing
To serve users internationally, information may be processed by infrastructure and service providers located in different countries or regions. We take reasonable measures under applicable law and provider data-protection arrangements. Before using the service, make sure you have the right to submit the relevant content.
10. Children
The service is not directed to children below the legal age of consent in their region, and we do not knowingly collect their personal information. A guardian who believes a child submitted information without consent should contact us.
11. Updates and contact
We may update this Policy as features, providers, or legal requirements change and will display a new version date. For privacy, Google user data, or account deletion questions, contact us through the details published on shenyou.ai. Before paid service and Google brand verification launch, this page will be updated with the operating entity, registered address, and a dedicated privacy email.