Privacy

Langford is run by [LEGAL ENTITY], [LEGAL ENTITY ADDRESS] ("Langford", "we", "us"). This policy covers the Langford website and the apps you launch from it. Questions: [CONTACT EMAIL].

Langford is not for protected health information (PHI) today. Do not put patient health records or other PHI into Langford, or into an app you launch from it. We will offer that only once business associate agreements are in place with Microsoft, which hosts the service, and with you.

Review note: app_instance.data_class allows only 'none' and 'pii'; the launch flow offers no PHI option (scripts/check.mjs checks this). No BAA is signed yet.

Your account: your email address and, if you set one, your password. We store a password only as a salted scrypt hash, never as you typed it. If you turn on an authenticator app, we store its secret key so we can check your codes.

Your profile: your first and last name and when you agreed to these terms and this policy (asked when you sign up), and then your job title, your company or office name, its industry, its size, and its country and state or region. Two fields are optional: your phone number and your date of birth.

Review note: Asked in sign-up step 1 (name, Terms) and step 2 "Your office" (the rest), for both email and Google sign-up; editable on /account.

Your workspace: its name, its members and their roles (owner, admin, billing), and invitations, including the email address of the person invited.

Sign-in records: for each session we keep a fingerprint of your session cookie (not the cookie itself), your IP address, and when it started and ends. We count failed sign-ins per IP address; after 8 failures that address waits 15 minutes.

Activity: a log of what is done in your workspace (for example sign-ins, invitations and app launches), with the person's email address, IP address and the time.

Requests you send us: what you write in the "Ask for an app" form (up to 4,000 characters), your email address, your industry if you pick one, and your IP address.

Apps you launch: which app, its web address, and its launch, pause and delete dates.

The records, files and documents you or your team put into an app you launch are yours. We store and process them only to run that app for you, and we do not look at them except to keep the service working or when you ask us to.

Review note: Policy statement, not something code enforces: staff with cloud access could reach the data. Confirm with John.

During your free 3 months your app runs on a shared server with other trial apps. Each trial has its own database and login on that server, its own file area and its own document container, and the app can reach only its own.

Review note: CONTROLS.md FILES records a gap: trial file traffic is not encrypted inside the private network, and isolation of the file share is by mount configuration, not a credential.

To create and run your account and apps, sign you in, send the emails listed below, keep the service secure (rate limits, sign-in lockout, the activity log), and answer your requests.

Your profile: your name, so we can address you and name your workspace until you give your office's name, which then becomes the workspace's name. Your job title, industry, office size, country and state, to set up your workspace and suggest apps that fit an office like yours. Your phone number, only if we need to reach you about your account. Your date of birth is private to you: we do not show it to the people in your workspace.

Review note: Who sees it today: the person (/account) and Langford staff on a second-factor session (/admin/users); other workspace members never see the profile. Phone and date of birth are never written to the activity log or a log line (PII_FIELDS: the log names which fields changed, not their values). App suggestions from industry are not built yet: nothing reads the profile's industry or office size except /account and /admin/users. Nothing sends a text or calls the phone number. Keep or soften the 'suggest apps' clause before this goes live.

We do not sell personal information and do not use it for advertising. The site has no advertising or third-party analytics code.

Review note: The second sentence is checked against web/package.json and app/layout.tsx (no analytics or ad scripts; fonts are self-hosted by next/font at build time). The first is a policy commitment for John to confirm.

Only fixed messages: confirm your email, a sign-in link, set your password, an invitation to a workspace, your app is ready, and reminders on days 75 and 85 of your free 3 months. No newsletters or marketing email.

Review note: The day 75/85 reminder templates exist; the job that sends them is not built yet (config.ts).

Links in these emails expire: a sign-in link after 15 minutes, a set-password link after 1 hour, an email confirmation after 24 hours and an invitation after 7 days, and each works once. We store only a fingerprint of each link.

The emails are sent through Azure Communication Services, part of Microsoft Azure, with tracking turned off: no tracking pixels and no rewritten links.

Review note: On staging, messages are held in an outbox that staff read in /admin/outbox instead of being sent (MAIL_OUTBOX=1, MAIL_LIVE=0 in web/app.json; prod refuses the outbox, lib/stage.ts).

We set one cookie to keep you signed in, and a short-lived one while you enter an authenticator code. Both are first-party, HttpOnly, Secure and SameSite=Strict, and only our own site can read them. A session lasts at most 12 hours.

Your light or dark display choice is kept in your browser's local storage. We set no advertising or analytics cookies.

Microsoft Azure hosts the service: the website, its database, your apps, their files and documents, backups, logs and our secret store (Key Vault).

Azure Communication Services, part of Microsoft Azure, sends our emails, with its data location set to the United States.

Google, if you choose "Sign in with Google" (the "Continue with Google" button): Google then tells us your email address, that Google has verified it, your name and an account identifier, and confirms you signed in. We keep that identifier and your email address. When you sign up this way, we fill in your first and last name from Google for you to check or change, and keep the name you confirm. We do not receive your Google password, and we do not keep Google's sign-in tokens.

Review note: Scopes openid, email, profile. user_identity stores the subject id and address. given_name/family_name ride only in the 15-minute google_signup token to prefill /signup/google; app_user.first_name/last_name hold what the person submits. A sign-in to an existing account never writes Google's name. Google's picture is in the profile scope but is not read or stored.

We may disclose information if the law requires it. If the business is sold or reorganised, this information may pass to the new owner under this policy.

Review note: Standard clause with no code behind it; for the lawyer.

In Microsoft Azure data centres in the United States. Our infrastructure refuses resources outside the regions we set.

Review note: Stacks use centralus, eastus (platform) and westus2 (trial MySQL).

Your app is free for 90 days (3 months), with no card. On day 90 it pauses: it stops taking visits, and its data is kept for 14 more days so you can upgrade. If you have not upgraded by then, on day 104 we delete the app and its data: its database, its files and its documents.

Review note: The pause and delete dates are set when the app launches (app_instance.trial_ends_at, purge_at). The scheduled job that pauses and deletes on those dates is not built yet (config.ts: 'the lifecycle job ... is phase 4'); today a pause or delete is a staff action. Make it automatic, or soften this wording, before this goes live.

Backup copies expire on their own after deletion: deleted documents within 7 days, file snapshots and database backups within 35 days.

Security logs from our cloud resources are kept in an archive that cannot be altered or deleted, for up to six years.

Review note: Default auditRetentionDays 2190. Database audit logging (pgaudit write) can capture statement text, so this archive may hold some personal data; the lawyer should know.

Your account information is kept while you have an account. To have it deleted, write to [CONTACT EMAIL].

Review note: No self-serve account deletion or export exists (CONTROLS.md DISPOSAL: designed, not built).

Connections are encrypted (TLS 1.2 or later) and stored data is encrypted. Databases and file stores are not reachable from the internet. Passwords for our systems are generated and kept in a key vault, not in code. Our staff need a second factor to open our operations console.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell you as the law requires.

Review note: No incident-response process exists in the repo; for the lawyer and John.

You can see and change your account details in Langford. To get a copy of your information, correct it or have it deleted, write to [CONTACT EMAIL] and we will answer within [RESPONSE TIME].

Review note: Rights and response times depend on where customers are; for the lawyer.

Langford is for businesses. It is not meant for children, and we do not knowingly collect information from anyone under 18.

Review note: Sign-up has no age check, except that the optional date of birth refuses anyone under 16 (lib/profile-rules.ts), which does not match the 18 here. The age is a policy choice for the lawyer.

If we change this policy we will post the new version here with its date, and tell account owners by email before a change that matters. Contact: [CONTACT EMAIL], [LEGAL ENTITY], [LEGAL ENTITY ADDRESS].

Review note: There is no email template for policy changes yet; the mail module sends fixed templates only.