How we handle data across our website, our apps, and our browser tools.
Effective 22 August 2026 · Version 1.0
The short version. Our software is built to keep your data on your own device. We do not run advertising, we do not sell or share personal information, and we do not use third party analytics or tracking on this website. Most of our products never send your working data anywhere at all.
Longleaf Software builds web applications, desktop applications, and browser based tools. This policy covers the website at longleafsoftware.app, the products listed below, and email you send to us. In this policy, "we" and "us" mean Longleaf Software, and "you" means the person or organization using our website or software.
We publish this as a table because the honest answer is different for each thing we make.
| Product or surface | What leaves your device | Where it is stored |
|---|---|---|
| longleafsoftware.app (this website) | Standard web server request data handled by our hosting provider: IP address, user agent, requested URL, timestamp. No cookies are set by us, and we run no analytics, advertising, or tracking scripts. | Our hosting provider's short term operational logs. We do not build profiles from them. |
| ClinicStudio | Nothing, with one exception described below. Your schedule template, settings, and entries stay in your browser's local storage on your own computer. ClinicStudio has no user accounts, no sign in, and no server that receives your work. | Your browser, on your machine. Clearing your browser data deletes it. We never receive a copy and cannot recover it for you. |
| ClinicStudio branding lookup (optional feature) | Only if you choose to use it: the website address you type into the branding field is sent to a Longleaf operated service, which reads that public page to pick up colors and a logo so the printed output matches your organization. | Used to answer that one request. The lookup is limited to the public web address you supplied. Do not enter a private or credentialed URL. |
| Longleaf Assistant | Your prompts and documents stay on your machine. The assistant runs a local engine on your own computer, so what you type is not transmitted to us. The application checks a version file on our site to see whether an update exists, and downloads updates from our site when you approve one. | Your computer. Update checks reach our servers as ordinary web requests. |
| Browser tools | Nothing, unless a specific tool says otherwise on its own page. These are single page tools that compute in your browser. | Your browser. |
| Email to us | Whatever you choose to write, plus your email address and the usual mail headers. | Our mail provider's servers and our mailbox. Kept as long as needed for support and business records. |
ClinicStudio is a scheduling template design tool. It is not built to hold patient information, and it does not ask for any. It works with counts, visit types, appointment lengths, and room and provider structure. It has no field for a patient name, date of birth, medical record number, diagnosis, or any other patient identifier, and its exports carry none.
Because your work stays in your own browser and never reaches us, we do not receive health information from you. We are not acting as a business associate under HIPAA for this product, and no business associate agreement is required for its intended use. If you type identifying information into a free text field anyway, that text stays on your machine like everything else, and it remains your responsibility under your own policies.
If you buy one of our applications through the Apple App Store, Apple handles the payment and receives the payment details. We never see your card number. Apple provides us with aggregate sales reporting. If we sell a license directly in the future, payment will be handled by a reputable payment processor that receives the card details in our place, and this policy will be updated to name it before that happens.
Our products are business tools intended for adults. They are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, write to us and we will delete it.
Website request logs are kept only for the short operational window our hosting provider applies. Email correspondence is kept while it is useful for support and for as long as ordinary business records require. Product data is not kept by us at all, because it does not reach us.
Our website and downloads are served over HTTPS. Private downloads are restricted to the people we authorize. Because our products keep your data on your own device, the most important security control is the one you already run: your device password, disk encryption, and backups. No method of transmission or storage is perfectly secure, and we do not claim otherwise.
Depending on where you live, you may have the right to ask what personal information we hold about you, to get a copy, to correct it, to have it deleted, and to be free from discrimination for asking. Because we hold so little, most requests are answered quickly. Write to [email protected] and we will respond within 30 days. We do not sell or share personal information, so there is nothing to opt out of.
We operate in the United States and our servers and service providers are located there. If you use our website or products from outside the United States, you understand that the limited data described above is handled in the United States.
If we change this policy, we will change the effective date and version at the top of this page. Material changes will be summarized here so you can see what moved.
Longleaf Software
[email protected]