LONG GLASS — Privacy Policy

Effective: [[DATE]] Last updated: 25 August 2026

1. Who we are

LONG GLASS is operated by [[LEGAL ENTITY NAME]] ("we", "us"), the data controller for the information described in this policy.

• Postal address: [[BUSINESS OR REGISTERED-AGENT ADDRESS — not a home address]]
• Privacy contact: [[privacy@longglass.xyz]]

If you are in the EU or UK and believe we have handled your information improperly, you may complain to your national supervisory authority. We would rather you came to us first.

2. What LONG GLASS is

LONG GLASS is a private, invite-only research bench for open-source intelligence work. It is not a consumer service and it is not open to public registration. An account exists only where an administrator has issued a single-use invite.

The bench queries publicly available and commercially licensed sources, and records the results so an analyst can work with them.

3. This policy covers two different groups of people

Most privacy policies describe only the people who signed up. Because of what LONG GLASS does, this one has to cover two groups:

• Analysts — people who hold an account and use the bench.
• Subjects — people an analyst researches. Subjects have no account, did not sign up, and in most cases will not know a search took place.

Sections 4 and 5 deal with each in turn. Section 10 explains what rights each group has, and where those rights are limited.

4. Information about analysts

We do not collect analytics about how you use the bench, we do not profile you, and we do not sell or share any of this with anyone.

5. Information about subjects

When an analyst runs a query, the bench collects whatever the queried sources return about the person or entity named. Depending on the module and the source, that can include:

• Names, aliases, usernames and handles
• Email addresses, phone numbers, postal addresses
• Photographs and images, including image-derived data such as EXIF metadata and perceptual hashes
• Employment, education and professional history
• Social-media and messaging-platform profiles and public activity
• Corporate, regulatory and political-donation filings
• Cryptocurrency addresses and on-chain transaction history
• Court records, criminal-history records, sanctions and watchlist entries
• Credential-breach and infostealer exposure drawn from published breach corpora

Two of those categories deserve to be called out plainly. Criminal-offence data is subject to additional restrictions under Article 10 UK/EU GDPR, and breach data concerns information that was disclosed without the subject's consent in the first place. Both are handled under section 9.

Source. We do not obtain this information from the subject. It comes from public records, publicly accessible websites, and third-party data providers (section 6).

Retention. Query results and case records are held until the analyst who owns them deletes them. When an analyst's account is deleted, their case records are not destroyed with it — they become administrator-only until reassigned, because silently destroying investigative records is not a decision an account deletion should make. Audit-log entries referencing a query persist regardless.

6. Where information goes

The bench sends query terms to third-party sources in order to retrieve results. It transmits only what is needed to run the query — typically the selector the analyst entered. Those providers operate under their own privacy policies and will generally log the request.

Roughly 160 distinct upstream sources are reachable across the bench. The ones that receive personal data about a subject fall into these groups:

One disclosure deserves its own paragraph. The reverse-image search feature in Glass Eye works by uploading the supplied image to litterbox.catbox.moe, a third-party temporary file host, so that image-search engines can fetch it by URL. The image is placed on a public host with a self-expiring link. Do not use that feature with an image you are not willing to have leave our infrastructure.

The remaining upstream sources — market data, mapping and geospatial layers, weather and seismic feeds, aircraft and vessel tracking, blockchain nodes, malware feeds and news — receive no personal data about subjects.

International transfers. Most of these providers are in the United States. [[CONFIRM TRANSFER MECHANISM — SCCs / UK IDTA / adequacy, per provider.]]

7. Cookies

LONG GLASS sets two cookies, both strictly necessary:

• lg_session — your sign-in session. HttpOnly. Expires after 12 hours.
• lg_csrf — cross-site request forgery protection. Expires after 12 hours.

There are no analytics cookies, no advertising cookies, and no third-party tracking. Every stylesheet, font and script the bench serves is hosted by us; no page loads assets from a content-delivery network or any other external origin, so browsing the bench does not disclose your IP address to a third party.

8. Legal bases (UK/EU GDPR)

For analysts: performance of a contract (providing your account), our legitimate interests in securing the service (sign-in logging, rate limiting, audit), and legal obligation where one applies.

For subjects: our legitimate interests, and those of our clients, in conducting lawful investigation, due diligence, fraud prevention and security research — balanced against the subject's rights and freedoms. Criminal-offence data is processed only where a lawful condition under Article 10 and applicable national law is met. [[CONFIRM THE ARTICLE 10 CONDITION FOR YOUR JURISDICTION AND USE CASE WITH COUNSEL.]]

Notice to subjects. Article 14 normally requires that we tell a person when we obtain their data from somewhere other than them. We rely on the exemptions in Article 14(5) — that direct notice would be impossible or involve disproportionate effort, and that notice would defeat the purpose of a legitimate investigation — and we publish this policy in their place. This is a deliberate position, not an oversight. [[REVIEW WITH COUNSEL; document the balancing test.]]

9. What LONG GLASS must not be used for

Analysts agree, as a condition of holding an account, that they will not use the bench or anything it produces:

• To make or influence decisions about employment, tenancy, credit, insurance, or eligibility for any benefit or licence. Reports produced by LONG GLASS are not consumer reports, we are not a consumer reporting agency, and the bench is not compliant with the Fair Credit Reporting Act or its state equivalents.
• To stalk, harass, intimidate, threaten or locate a person for the purpose of causing harm, including in any domestic-violence context.
• In violation of any upstream provider's terms of service.
• Without a lawful basis and a documented purpose for the query.

These prohibitions are enforced by contract and recorded against each query in the audit log. Breaching them ends the account.

10. Your rights

If you are an analyst, you may ask us to access, correct, export or delete your account information, or to restrict or object to processing.

If you are a subject, you have the same rights in respect of information we hold about you, subject to the limits below. Contact us at the address in section 1. We will ask for enough information to be confident of your identity, and we will respond within one month.

Three honest limits:

1. We will not erase the audit log. It is append-only evidence of what the bench was used for, and an account being deleted is exactly when its history matters most. This is a retention we consider necessary for accountability and the establishment or defence of legal claims.
2. Deleting an analyst account does not delete their casework. Those records become administrator-only. If you are a subject and ask us to erase information about you, that request reaches the case records themselves.
3. A right to erasure may be restricted where processing is necessary for the establishment, exercise or defence of legal claims, or where an investigation is ongoing and disclosure would prejudice it.

If you are a California resident, you may also request disclosure of the categories of personal information collected and the categories of third parties it was disclosed to, and you may request deletion, subject to the same limits. We do not sell personal information and we do not share it for cross-context behavioural advertising.

11. Security

Access requires a password and, where enabled, a second factor. Sessions are short. Records are owned per-analyst and access is denied by default rather than granted by default. Every query is logged with the account that ran it. Our security posture is documented in the repository's SECURITY.md and enforced by an automated test suite that fails the build when a control is missing.

No system is perfect. If you find a vulnerability, tell us at the address in section 1 and we will not pursue you for reporting it in good faith.

12. Changes

We will update the "last updated" date above when this policy changes. Where a change materially affects how we handle your information, we will tell account holders directly.

13. Contact

[[LEGAL ENTITY NAME]] [[BUSINESS ADDRESS]] [[privacy@longglass.xyz]]