Legal / Privacy

Privacy

Longtake is a video studio you run on your own provider keys. That shapes this document: most of what happens to your work happens between you and the model providers, and this page says exactly which parts pass through us.

In force since 13 November 2026

Who is responsible

Longtake is operated by IE Pavel Ilin. For anything in this document — questions, access or deletion requests, complaints — write to hello@longtake.studio. We answer within a few working days, and always within one month.

What we store

Account. Your email address, display name and avatar, as provided by Google (or Apple) when you sign in. We never see or store your password to those accounts. You can also sign in with a link sent to your address instead: then the address is all we have, Firebase sends that message, and there is still no password anywhere. We also note when you last used the studio, to the hour.
Language and country. The languages your browser or device asks for (the standard Accept-Language list), the interface language you picked in the studio, if you picked one, and the country your connection comes from, as Cloudflare reports it — in this record we keep the country only, not your IP address. We note them while you use the studio signed in. The lists only grow: a new device, a new browser language or a new country is added to what is already there. We keep them for one purpose: to know which language to write to you in.
Emails about the studio. The studio asks once whether you want emails about new models and features. We keep your answer — yes or no — with the time you gave it, where you gave it (the first-run tour, the one-time question or the account menu), the language and the wording of the question, the email address the answer is about and whether your sign-in had confirmed that address. When you change the answer, up to ten earlier ones are kept the same way, as a record of what you had agreed to before. Such emails go only to people who said yes, to an address their sign-in confirmed, and you can change the answer at any time in the account menu of the web studio (“Emails about new models and features”).
Provider API keys. Stored encrypted (AES-256-GCM) and used only to make the requests you ask for and to check that a key is shaped like a key at all (not, say, a link or a short code): when you save it, and in our admin view, which shows only that verdict and whether a key is set — never the key, not even part of it. Keys are never shown back to you in full — only the last four characters — and never sent anywhere except the provider they belong to.
Your work. Prompts, projects with the brief you give them, scenes, characters, uploaded images and audio, generated videos and stills, your conversations with the Supercomputer, the project's assistant, and the notes it keeps about the project. This is content you created; we store it so the studio can show it back to you. Pictures and voice samples you upload may show or sound like other people; you answer for their consent (see the terms), and we use them only to run your request. The server looks for faces in uploaded pictures — on our own server, with an open detector — only to tell you when a provider is likely to refuse a photo. It recognises nobody and compares no faces; it stores only how many faces it found and how big the largest is.
Billing. Subscription status and plan (monthly or yearly), when the subscription began, its renewal date and, once it ends, when it ended; if a renewal payment fails, also when it first failed. For an App Store purchase we also note whether it was a test purchase in Apple's sandbox, the kind TestFlight and App Review make. The status, the renewal date and the moment a payment failed run your subscription (after a failed payment, access stays open for three days while the payment is retried); the plan, the start and end dates and the sandbox mark are used only in the studio's overall subscription counts. On the web, card details are handled by Stripe and never reach our server. In the iPhone and iPad app the subscription is bought through the App Store: Apple handles the payment, and RevenueCat confirms the purchase to the studio under your account id — we never see your card or your Apple Account.
Invitations and credit. Your personal invitation code, the record of who invited whom (by account identifier), and records of rewards: amount, dates and status. If you open an invitation link, your browser keeps the code from it for 30 days (local storage, key longtake.ref; this is not a cookie and not analytics). If you invite friends, you see only numbers and statuses (joined, waiting, credited, expired), never who they are. If you were invited, you learn nothing about who invited you. We also keep a record of every movement of your credit: credited, held for a render, spent, returned, lapsed. When you delete the account, these records are deleted; a record that another person needs for their own reward stays, without your identifier. The rules of the programme are in the terms.
Notification tokens. If you use the iPhone and iPad app and allow notifications, the app gives us your device's push token, so the studio can tell you when a take finishes or fails, when an upscale is ready and when a project is about to be deleted. Apple delivers those messages (see below). The token is removed when you delete the account, and when you sign out the app asks us to remove it. If that request does not reach us (there is no connection, or the session ended on its own), the token stays until another account signs in on the same device or Apple reports that the app was removed. Turning notifications off in the app stops the messages but not the token: with nothing sent, Apple has nothing to report, so the token then goes when you sign out (and the request reaches us), when you delete the account or when another account signs in on the same device. An account keeps at most ten notification tokens: when an eleventh arrives, the oldest one is removed.
Refused generations. When a provider's filter refuses a take, we keep a short record for 30 days: when it happened, on which model, the provider's error code and what kind of input it refused (a character portrait, a library picture, a clip). Never the prompt and never the names of your files.
Administrator actions. When a studio administrator changes something on your account (for example, resets a subscription), an internal record notes which administrator did it, when, what the action was and your account identifier. When you delete the account, your identifier is erased from those records; the record of the action itself stays.
Usage analytics. Which features are used and how they end — see below.
Technical logs. Ordinary server logs: request paths, status codes, timing, error messages. They are kept short-term for debugging.

Why we may process it

To provide the service you asked for — the account, your projects, the renders, the subscription. Without this data there is no studio.
Our legitimate interest in keeping the service working and safe — technical logs, the record of administrator actions, abuse protection, and product analytics in the aggregate — and in writing to you in a language you read (the language and country noted on your account).
Your consent — for analytics, where the law asks for it: if you are in the EEA, the United Kingdom or Switzerland, a banner asks first; and for emails about new models and features, everywhere: only if you ticked that box yourself. You can withdraw either at any time (see Analytics and Your choices).
Legal obligations — payment records kept for accounting purposes.

What leaves the studio

To render anything, we pass your prompt and any references you attach to the model provider you selected, using your key:

BytePlus ModelArk — video generation, standard image generation, and (as a separate product) voice synthesis.
Google — video generation on the Veo and Gemini Omni models, the alternative image engine, and prompt translation when it is enabled.
Kling (Kuaishou) — video generation on the Kling models; the API we call is served from Singapore.
fal.ai — upscaling a finished take, when you ask for it.
OpenAI — image generation on GPT Image in the Art Dept, and the Supercomputer when a conversation runs on a GPT model with your OpenAI key (what it receives is described under Anthropic below).
OpenRouter — video generation on the models of the OpenRouter section of the model picker, image generation on the OpenRouter models of the Art Dept, a character's voice sample when you have an OpenRouter key and no Seed Speech key (the description and the line, or the portrait the voice is built from), and the Supercomputer when a conversation runs on one of OpenRouter's models (what it receives is described under Anthropic below). OpenRouter passes the request on to that model's own provider (ByteDance, Google, OpenAI, Anthropic, Kling, Alibaba, MiniMax, Moonshot AI, Z.ai, Runway and others), which renders or answers it.
Anthropic — the Supercomputer, the project's assistant, when a conversation runs on Claude with your Claude key and you write to it: your messages; the project's name and its memory — the brief, script, shot list, cast and style notes that you and the Supercomputer keep; the scene that is open, the text in its prompt field and the list of video models you can use; and what it reads of the project to answer — the names of its episodes, scenes, characters and library items and the prompts of its takes. Pictures, videos and voices are never sent to it.

Those providers process that content under their own terms and privacy policies, and they — not us — decide what a model may refuse. Nothing is sent to them unless you start a generation or write to the Supercomputer, with one exception: when you save an OpenAI, Claude or OpenRouter key, the studio asks that provider — OpenAI, Anthropic or OpenRouter — once whether the key works, and that request carries the key and nothing else.

A render that runs on the studio's own key instead of yours (for example, the free takes in the Academy, or takes paid with studio credit) also carries a pseudonymous account identifier — a keyed hash, not your account id or email. BytePlus asks for it so that its usage-policy checks can tell our users apart.

Notifications. If you use the iPhone and iPad app and allow notifications, the studio sends each notification to Apple's push notification service, which delivers it to your device. Its text is a take number with the name of the take's scene and its resolution, or the reason a take failed, or the name of a project that is about to be deleted; a notification about a take also carries the take's identifier, so that a tap opens it. Apple handles it under its own privacy policy. The studio cannot see the device's own notification settings: if you switch notifications off only there, it keeps handing them to Apple and the device simply does not show them. To stop that, turn notifications off in the app (Account → “Push when a take lands”); that one switch covers every kind of message above, the project deletion warnings included. If you have never used the app, never allowed notifications or turned them off in the app, nothing goes to Apple this way. If notifications are on and you delete the app without signing out, the studio keeps handing messages to Apple until Apple reports that the token is no longer valid (Apple does not say when); the studio then drops the token.

Who else is involved

Google Firebase — sign-in and analytics.
Stripe — subscription payments on the web.
Apple — subscription payments in the iPhone and iPad app (App Store) and delivery of its notifications (Apple Push Notification service), under Apple's own privacy policy.
RevenueCat — confirms App Store purchases to the studio; it receives your account id and the purchase history.
Railway — hosting and the disk your projects live on.
Cloudflare — traffic in front of the site; it also tells the studio which country a request comes from.
Google Fonts — the typefaces on our pages are loaded from Google's servers, which see your IP address and browser details.

We do not sell your data, and we do not share it with anyone beyond what is needed to run the service.

Where the data goes

The studio's server and the disk holding your projects are located in Singapore (Railway). The companies listed above operate internationally as well: Google, OpenAI, Anthropic, OpenRouter, Stripe and RevenueCat process data in the United States (a render through OpenRouter is then processed by the model's own provider, in its own region), Apple delivers notifications on its own infrastructure under its own policy, BytePlus renders in its Asia-Pacific region, and Kling (Kuaishou, a Chinese company) serves the API we call from Singapore. So your account data and your work are stored and processed outside the European Union, and starting a generation sends your prompt and references to the provider whose key you configured. If you are in the EU or the UK, those transfers rely on the providers' own safeguards (standard contractual clauses and equivalent frameworks) and, for the studio itself, on your explicit choice to use a service hosted there.

Analytics

We use Google Analytics — the plain web tag on the public pages, Google Analytics for Firebase inside the studio — to understand how both are actually used: which pages people read, which steps they finish, which settings they choose, how often a render succeeds. Events carry categories and numbers: a page address, a model name, a resolution, a duration, an error category.

Prompts, project and character names, file contents, email addresses and API keys are never sent to analytics. That is enforced in code, not just promised: the analytics layer accepts only short values and discards anything else.

Consent. If you are in the EEA, the United Kingdom or Switzerland — or we cannot tell where you are — analytics stays off until you press Accept in the banner, and Decline keeps it off. Elsewhere it runs unless your browser sends a “Do Not Track” or “Global Privacy Control” signal; with either signal analytics stays switched off entirely, everywhere. Your choice is kept in your browser (longtake.consent) and you can change it at any time: change my analytics choice.

Cookies

One cookie, cf_token, carries your sign-in session so that videos and images load — those requests cannot send an authorisation header, which is the whole reason it exists. It is required for the studio to work. Analytics sets its own cookies through Google (_ga and _ga_*), and only once it is switched on as described above. Your analytics choice is stored in your browser, not in a cookie. The same goes for the code from an invitation link: it is kept in your browser's local storage (longtake.ref) for 30 days.

How long we keep things

Your account and work are kept while your account exists, with one exception: on an account without a subscription, a project is deleted seven days after it was created, together with everything in it (a project opened from an Academy lesson or holding a take from one, 37 days after it was created). The studio shows that date on the project itself, and, if notifications are on, it sends a notification to the iPhone and iPad app one day before it; deletion cannot be undone. An account that has ever paid keeps its projects for 90 days after the paid period ends; that date is on the project too, and, if notifications are on, the studio sends a notification to the app 14 days before it. The rule is set out in full in the terms.

Delete a project, an asset or a take yourself and its files are removed from the server immediately. Delete the account and everything belonging to it goes at once: projects, takes, uploads, characters, API keys, notification tokens, invitation records and the sign-in itself (a record that another person needs for their own reward stays, without your identifier, and so do records of administrator actions on the account, also without it). In the Longtake app for iPhone and iPad that is Account → Delete account; the app asks you to sign in once more to confirm. A subscription paid on the web is cancelled together with the account; one bought in the App Store is billed by Apple and has to be cancelled in your Apple account. The web studio has no such button yet — write to us and we will do it by hand.

Technical logs are kept for about a week. Payment records are kept as long as accounting rules require. Analytics data follows Google's own retention settings for the property.

Your choices

Access and a copy. Write to us and we will send you a copy of your data, in a common machine-readable format: your account details and your work — prompts, uploaded files, finished videos and stills — including projects the studio has locked, as long as they have not been deleted yet (the deletion date is shown on the project, so write before it). We put it together by hand and may ask you to confirm that the account is yours first. It is free and does not depend on a subscription.
Correct, restrict, object. Ask us to correct what is wrong, to pause using your data, or object to processing that rests on our legitimate interest, such as analytics.
Delete the account yourself in the iPhone and iPad app (Account → Delete account), or write to us and we will delete it.
Remove your API keys at any time from “API keys” in the account menu; the encrypted values are erased.
Cancel the subscription at any moment: on the web from the same menu, through the Stripe portal; in the iPhone and iPad app in your App Store subscription settings (the app's Account › Subscription leads there).
Switch emails about new models and features on or off at any time in the account menu of the web studio; switching them off does not affect what was sent before.
Withdraw your consent to analytics at any time, as described above; this does not affect what happened before. A browser with “Do Not Track” or “Global Privacy Control” enabled is never tracked.
If you are in the EU or the UK and think we handled your data wrongly, you may complain to your national data protection authority — but please write to us first, it is usually faster.

We answer requests within a few working days, and always within one month.

If something goes wrong

If a personal-data breach puts your rights at risk, we will tell you and, where the law requires, the supervisory authority, without undue delay.

Children

The studio is not intended for people under 16.

If the studio closes

Longtake is a small product. If it ever shuts down, we will announce it in advance and give you time to download your work before anything is deleted.

Changes

If this document changes in a way that matters, the date at the top changes with it.