privacy

this is a draft

This policy was written by the people building Lasthand. No lawyer has reviewed it. Lasthand is operated by Nothing To Do, LLC. It is a plain description of what the software does today, published because a product that asks for your judgment should not be vague about what it holds.

Where a sentence describes something that is not built yet, it says so.

what Lasthand stores

• Captures your agents upload: images and video, with the tag and the commit they were rendered at.
• Rulings and notes: your words, stored exactly as you wrote them.
• The decisions, rounds, journal entries, Reviews, and Sections that organise the above, including whatever your agent writes into a round brief or its closing notes.
• Your email address, and the name a ruling is signed with.
• The workspace and project seats you hold, and who invited you.
• The address an invitation link is reserved for, written before that person has an account or a seat.
• Agent keys and agent connections. Only the sha256 of a key reaches the database; the key itself is shown once and never stored.

what Lasthand does not do with it

Lasthand runs no analytics, no advertising trackers, no session recording, and no fingerprinting of its own. It does not sell your data and shares nothing for advertising.

Lasthand does not use your Captures or your words to train models.

That sentence covers Lasthand and stops there. The agent you connect is your own choice, and it can ask Lasthand for a Capture and for your rulings word for word — that is the whole point of it. What it does with them, and what the model company behind it does with them, is governed by that company's terms and not by this policy. The companies listed further down run their own logging for their own services.

cookies

The cookies this application sets are for four things: keeping you signed in, remembering the theme you chose, letting your browser load Capture media for a short window, and returning you to the page you came from after signing in. None of them track you across sites, and the sign-in session may be split across more than one cookie by the library that writes it.

Cookies set by the companies below, on their own domains and for their own services, are theirs and are described by their policies.

who can see a Capture

Capture media is stored privately. Access to a project's media uses your membership. Access through a share link uses the link's own permission, and the address of share media contains the link's token — so anyone holding that address holds the permission, and the address itself lands in the hosting access log named below. Error reports have those tokens cut out of them; a web server's own log is a different thing, and it keeps the URL it was asked for.

The first request proves that access on the server. The answer is then cached in a signed cookie your browser holds for five minutes, and further requests for that project or that link are served on the cookie without asking again. So removing a seat, regenerating a share link, or closing a Review stops fresh access within five minutes rather than immediately, and nothing recalls a copy someone has already downloaded. Signed storage links exist only for this server's own fetch and never reach a browser.

An agent connected through the consent screen reaches one project. A minted agent key reaches one project when it was minted for one, and otherwise every project in that workspace. Another workspace's Review reads as missing, not as someone else's work.

error monitoring

Errors are reported to Sentry when a reporting address is configured, and nothing is sent when it is not. Before an error leaves this server the app deletes the account it happened to, the request body, the headers, and the cookies; drops console breadcrumbs; and cuts query strings, share tokens, and invite tokens out of every URL in the report.

Performance tracing is off and session replay is not installed, because replaying a session would record the Canvas, and the Canvas is where rulings are written.

Vercel records the URL of every request in its own access log before any of that runs.

companies that process data

This is the list as it stands, kept current here rather than presented as a permanent inventory. The changelog below records a change to it.

• Supabase: the database, the file storage, and the accounts system.
• Vercel: hosting. Every request to this site reaches it first.
• Google, Apple, and GitHub: the sign-in providers, each under its own terms, for the ones you choose to use.
• Resend: the mail that carries invitations and sign-in links, sent from hello@lasthand.design.
• Sentry: error monitoring, as described above, when it is configured.
• ntfy.sh: a push to the owner's phone when a round closes, when a topic is configured and nothing at all when it is not. It carries the Review's title and the address of that Review.
• Stripe: payments, if you buy the paid plan. Card details go to Stripe; Lasthand never sees or stores a card number.
• Cloudflare: the captcha in front of asking for a sign-in link, redeeming an invitation, and a guest identity being created on a share page. Its script loads in each of those pages and it sees the request, when a site key is configured — and nothing at all when none is. Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/en-gb/turnstile-privacy-policy/) describes how it processes data through Turnstile.

how long things are kept

• The journal — rulings and notes — is append-only and is never deleted.
• Capture media is kept while the workspace exists, and is removed from storage when a workspace is deleted.
• An account that authored a journal entry is kept as the attribution anchor for it, with sign-in revoked; an account that authored none is deleted outright when it asks to be.
• A guest identity created by a share link has no expiry of its own. One that wrote nothing and holds no seat can be removed by a cleanup run by hand; one that left a note cannot be, because the database refuses to delete the account a journal entry is attributed to.
• Operational records are not workspace records and do not go when a workspace does: Vercel's access log of every request URL, the error reports Sentry holds, and the accounts system's own logs are kept by those companies on their schedules rather than by this application.
• The same is true of their backups. Deleting something here is not instantly gone from a provider's backup.

deletion

Rulings and notes are append-only. There is no edit and no erase, and the database enforces it rather than the application.

A workspace holding journal entries cannot be deleted; one holding none can be deleted by its owner, and its Capture media is removed from storage with it.

Deleting your account removes every seat you hold. You must hand over or delete a workspace where you are the last owner first.

changes to this policy

This policy changes when the software changes. Every change is listed in the changelog below with the date it took effect.

contact

Write to lasthand-support@googlegroups.com. It is a Google Group, and it is the support address Lasthand publishes today, including on the Google sign-in screen. A mailbox on the lasthand.design domain does not exist yet; when one does, this page will name it instead.

changelog

• 2026-10-07 — Names the company that operates Lasthand: Nothing To Do, LLC. Nothing about what Lasthand keeps changed.
• 2026-09-26 — Wording only: "comment" becomes "note", the word the product now uses for what a person leaves on a Review. No commitment changed.
• 2026-09-07 — Added a link to Cloudflare's Turnstile Privacy Addendum in the processor list.
• 2026-09-07 — The captcha now stands in front of the sign-in page and the invitation page as well as the share page, because the accounts system applies it to every address it mails a link to. Cloudflare's entry names all three, so its script now loads for anyone asking for a sign-in link.
• 2026-09-06 — Guest identities shipped, so the sentences that described them as unbuilt now describe what they are: how long a guest identity is kept, and Cloudflare named in the processor list for the captcha in front of one.
• 2026-09-06 — First draft, written for the invite-only free beta. Replaces the earlier placeholder page, and corrects its claim that Capture media reaches a browser through short-lived signed links: signed links never leave the server, and access is re-proved on the server behind a five-minute ticket. Not reviewed by a lawyer.