Privacy

What is collected, which is an email address and nothing else, and how a hosted project stores your writing. Last updated 4 October 2026.

The short version

An email address and a password, and a card held by Stripe if you subscribe. That is the whole list. These marketing pages count page views and nothing else, with no cookie and no identifier; the editor itself carries no analytics of any kind. When you open a folder in the editor, your writing stays on your own disk and is never sent anywhere, whether you have an account or not.

That is unusual enough to be worth stating precisely rather than summarising, so the rest of this page is specific.

This website

• One counter, and it is the only script here. Cloudflare Web Analytics counts page views on these marketing pages. It sets no cookie, stores nothing in your browser, and builds no profile: there is no identifier for you to have, so there is nothing to follow you with. It is the only remote origin the policy on these pages allows, and the editor does not have it at all.
• No cookies. Nothing is stored in your browser by visiting.
• Server logs. Cloudflare, which serves this site, records ordinary request information such as an IP address, and it is processed by them under their own terms. Nothing is derived from it here and nothing is kept beyond their retention.

The editor, running on your own folder

Opening a folder in Chrome or Edge uses the browser's own File System Access permission. Longmatter reads and writes those files from your browser. Nothing is uploaded. Opening a folder involves no server, and a hosted project is a separate thing you choose.

Three things are stored in your browser, and only in your browser:

• Your themes. Two entries in local storage, holding the theme you chose and any you made.
• A reference to the folder you opened, so it can be offered again after a reload. It is a permission handle, not a copy of the files.
• Unsaved edits. Work that has not reached disk yet is mirrored locally so a crashed tab does not take it with it, and each one is removed as soon as the real save lands.

Clearing site data for this domain removes all three. None of it reaches us, because none of it leaves your machine.

Your account

Signing up and hosted projects are live. Signing up takes an email address and a password, and creates a session cookie. In a hosted project your writing is stored for you rather than on your own computer. The list below says what is kept.

• Your writing. Stored on Cloudflare R2 as content. Neither the text of a document nor its filename goes in the database, which is asserted by a test that reads every value in every table. What is in there is identifiers, content hashes, the name you gave the project, and timestamps.
• Teams and invitations. The name of a team, who is on it and what each person may do, and the email address of anybody invited until they accept or the invitation expires.
• Your account. An email address and a password hash. The password itself is never stored and cannot be recovered from the hash.
• One cookie. A session cookie holding an opaque identifier and a signature, and nothing else. Everything known about you lives on the server keyed by that identifier, so a cookie that leaks is a cookie rather than a profile. It is HttpOnly, Secure, and expires after two weeks.
• Payment, if you subscribe. Stripe takes the payment and holds the card. Card details never reach us and are never stored here: the checkout page is Stripe's own, on their address, and what comes back to us is an identifier, which plan you are on, and the date it runs until. Stripe processes that under their own privacy terms.
• No third-party advertising or trackers. If that ever changes, this page changes first.

What you can ask for

These are built before the thing that makes them necessary, which is the right order.

• A copy of everything. A project comes out as a zip of ordinary Markdown files that opens on any machine without us, optionally with its full history.
• Deletion, for real. Deleting an account removes every project it owns, every version of every page, and the stored content itself. Content shared with another project that still exists survives, because it is theirs as well as yours.
• Correction and access. There is very little to correct: an email address, and the writing you can already read and edit.

Who to contact

Write to privacy@longmatter.com about anything on this page, including a request to see or delete what is held about you. Post reaches us at:

Longmatter
64 Lower County Rd
West Dennis, MA 02670
United States

Changes to this page

It carries the date it was last changed. A page describing a product that collects nothing is easy to write honestly, and the test of it will be whether it is updated on the day that stops being true rather than afterwards.