Privacy Policy

Last updated: August 12, 2026

This Privacy Policy explains how LongCat ("we", "us", "our") collects, uses and protects your personal information when you use our website and AI creation studio at long-cat.app (the "Service").

Information We Collect

Account information: email address and display name you provide when registering.
Authentication data: if you sign in with Google or GitHub, we receive the profile information those providers share (e.g. email, avatar).
Usage data: pages visited, generation requests, feature usage and timestamps, used to improve the Service.
Content you generate: prompts, uploaded reference images and generated outputs, processed to deliver the Service.
Payment data: handled by our payment provider; we store only the order record and subscription status, never your full card details.

How We Use Your Information

To provide and operate the Service, including running AI generations and managing your credits and subscriptions.
To send service notifications (e.g. email verification, password reset).
To improve the Service, prevent abuse and ensure security.
To communicate product updates, where you have opted in.

AI Processing and Your Content

Prompts and uploaded images are transmitted to our AI generation providers solely to produce your requested output.
Generated images and videos are stored privately in your account. We do not use your content to train our models unless you explicitly opt in (we do not currently offer such a program).
Your generations are not publicly visible unless you choose to share them.

Cookies

We use essential cookies for authentication and locale preferences, and analytics cookies (if enabled) to understand usage. See our Cookie Policy for details.

We do not sell your personal data. We share data only with service providers necessary to operate the Service (hosting, storage, AI providers, payment processor, email delivery), each bound by confidentiality obligations.

Data Retention

We retain account and usage data for as long as your account is active or as required by law. You may request deletion of your account and associated data at any time.

Data Security

We implement industry-standard administrative, technical and physical safeguards designed to protect your personal information:

Encryption in transit: all data transmitted between your device and our Service is encrypted using TLS (HTTPS).
Encryption at rest: account credentials are stored using modern salted hashing; database and object-storage volumes are encrypted at rest by our infrastructure providers.
Access control: access to production systems and customer data is restricted to authorized personnel via role-based access and authentication; all access is logged.
Infrastructure: our application runs on Vercel; data is stored with managed providers (Neon for the database, S3-compatible object storage for media). These providers maintain their own security certifications (e.g. SOC 2, ISO 27001) and physical security controls.
Backups: database backups are encrypted and retained on a rolling basis for disaster recovery; you may request earlier deletion as described below.
Incident response: in the event of a personal-data breach affecting you, we will notify you and the relevant authorities where required by applicable law.

No method of transmission or storage is, however, 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. To exercise these rights, contact us at the address below.

Children's Privacy

The Service is not directed at children under 13, and we do not knowingly collect their data.

Changes to This Policy

We may update this policy from time to time. Material changes will be announced on this page with an updated "last updated" date.

Contact

Questions about this policy? Contact us at support@long-cat.app.

Information We Collect

Account information: email address and display name you provide when registering.

Authentication data: if you sign in with Google or GitHub, we receive the profile information those providers share (e.g. email, avatar).

Usage data: pages visited, generation requests, feature usage and timestamps, used to improve the Service.

Content you generate: prompts, uploaded reference images and generated outputs, processed to deliver the Service.

Payment data: handled by our payment provider; we store only the order record and subscription status, never your full card details.

How We Use Your Information

To provide and operate the Service, including running AI generations and managing your credits and subscriptions.

To send service notifications (e.g. email verification, password reset).

To improve the Service, prevent abuse and ensure security.

To communicate product updates, where you have opted in.

AI Processing and Your Content

Prompts and uploaded images are transmitted to our AI generation providers solely to produce your requested output.

Generated images and videos are stored privately in your account. We do not use your content to train our models unless you explicitly opt in (we do not currently offer such a program).

Your generations are not publicly visible unless you choose to share them.

Data Security

We implement industry-standard administrative, technical and physical safeguards designed to protect your personal information:

Encryption in transit: all data transmitted between your device and our Service is encrypted using TLS (HTTPS).

Encryption at rest: account credentials are stored using modern salted hashing; database and object-storage volumes are encrypted at rest by our infrastructure providers.

Access control: access to production systems and customer data is restricted to authorized personnel via role-based access and authentication; all access is logged.

Infrastructure: our application runs on Vercel; data is stored with managed providers (Neon for the database, S3-compatible object storage for media). These providers maintain their own security certifications (e.g. SOC 2, ISO 27001) and physical security controls.

Backups: database backups are encrypted and retained on a rolling basis for disaster recovery; you may request earlier deletion as described below.

Incident response: in the event of a personal-data breach affecting you, we will notify you and the relevant authorities where required by applicable law.

No method of transmission or storage is, however, 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.