Effective: 31 August 2026 Last updated: 27 September 2026
LONG GLASS is operated by Vulcan Inc. ("we", "us"), the data controller for the information described in this policy.
If you are in the EU or UK and believe we have handled your information improperly, you may complain to your national supervisory authority. We would rather you came to us first.
LONG GLASS is a private, invitation-only research workspace for open-source intelligence work. It is not a consumer service and it is not open to self-service registration. Anyone may apply for access, but an account exists only where an administrator has reviewed that application and issued a single-use invite.
Using LONG GLASS is a paid subscription once an account exists. Payments are taken by Stripe; see sections 4 and 6.
LONG GLASS queries publicly available and commercially licensed sources, and records the results so an analyst can work with them.
Most privacy policies describe only the people who signed up. Because of what LONG GLASS does, this one has to cover three groups:
Sections 4, 4a and 5 deal with each in turn. Section 10 explains what rights each group has, and where those rights are limited.
| What we hold | Why | How long |
|---|---|---|
| Username, display name, role | Identify you, apply permissions | Life of the account |
| Password | Sign-in | Stored only as a scrypt hash; never in plaintext |
| Two-factor secret, recovery-code hashes | Protect the account | Life of the account; codes are single-use |
| Session records — IP address, browser user-agent, timestamps | Keep you signed in, spot session theft | Expire after 12 hours, or 4 hours idle; deleted on expiry or sign-out |
| Sign-in attempts — username, IP, success/failure | Rate-limiting and lockout | 30 days, then deleted |
| Invite records | Track who was invited by whom | Unused invites expire after 14 days |
| Audit log — who ran which query, in which module, against which selector, from which IP, and the result | Accountability. This is a deliberate control: LONG GLASS records what it was used for. | Retained indefinitely and append-only. See section 10. |
| Subscription record — plan tier, seat limit, status, renewal date, and the Stripe customer and subscription identifiers | Run the paid subscription and decide whether the account has access | Life of the account; deleted when the account is deleted |
Payment details. LONG GLASS never sees, handles or stores your card number. Card entry happens on Stripe's own hosted checkout page, and Stripe holds the payment method. What comes back to us is the subscription record above — identifiers, plan and status — plus the email address you give Stripe. Cancelling your LONG GLASS account does not by itself cancel a Stripe subscription; see section 10.
We do not collect analytics about how you use LONG GLASS, we do not profile you, and we do not sell or share any of this with anyone.
Anyone may apply for access using the request form. Applying is not an account, and most applicants will never have one.
| What we hold | Why | How long |
|---|---|---|
| Name, email address, organisation (optional) | Identify and contact the applicant | Kept with the decision — see below |
| Your stated purpose — what you intend to use LONG GLASS for | This is the vetting decision itself: an administrator reads it and approves or declines | Kept with the decision |
| Confirmation that you attested to lawful use | Record that the undertaking was given | Kept with the decision |
| IP address and timestamp of the application | Abuse prevention and rate-limiting on a public form | Kept with the decision |
An application is reviewed by a person, not automatically. The record is retained with its outcome (approved or declined) so there is an account of who was granted access and on what stated basis — the same accountability principle as the audit log. If you are approved, an invite is emailed to you and the application record is linked to the invite that was issued.
If you would like your application record deleted, ask at the contact address in section 13 and say which email address you applied with.
When an analyst runs a query, LONG GLASS collects whatever the queried sources return about the person or entity named. Depending on the module and the source, that can include:
Two of those categories deserve to be called out plainly. Criminal-offence data is subject to additional restrictions under Article 10 UK/EU GDPR, and breach data concerns information that was disclosed without the subject's consent in the first place. Both are handled under section 9.
Source. We do not obtain this information from the subject. It comes from public records, publicly accessible websites, and third-party data providers (section 6).
Retention. A search result is not kept unless the analyst saves it. Running a query does not create a permanent record of what it returned. Results begin as unfiled working material, and an analyst keeps a case by filing it into a folder. Anything still unfiled after seven days is deleted, along with the entities, claims, evidence and snapshots beneath it — and with every finished product any module saved into it, such as an assembled dossier or a link chart. This is deliberate data minimisation: LONG GLASS holds what an analyst decided was worth keeping, not everything it has ever seen.
A module does not keep a second copy of its own output. Work is saved into the case and nowhere else, so deleting the case deletes the work — there is no per-module store that outlives it.
A case the analyst has filed is held until they delete it. When an analyst's account is deleted, their filed case records are not destroyed with it — they become administrator-only until reassigned, because silently destroying investigative records is not a decision an account deletion should make.
The audit log is separate and is not affected by any of this. It records that a query was run, by whom, in which module and against which selector — and it survives the deletion of the results. That distinction is the point: we do not keep what we found, but we do keep a record of having looked, because that is what makes LONG GLASS accountable for how it was used. See section 10.
LONG GLASS sends query terms to third-party sources in order to retrieve results. It transmits only what is needed to run the query — typically the selector the analyst entered. Those providers operate under their own privacy policies and will generally log the request.
Roughly 160 distinct upstream sources are reachable across LONG GLASS. The ones that receive personal data about a subject fall into these groups:
| Group | Examples |
|---|---|
| Identity and people-search providers | People Data Labs, Endato, ThatsThem, TruePeopleSearch, Whitepages, Influencers.club |
| Breach and credential-exposure data | Have I Been Pwned, DeHashed, LeakCheck, XposedOrNot, Hudson Rock, IntelX, ProxyNova |
| Reverse-image and face search | TinEye, FaceCheck.ID, PimEyes, Lenso, Google Lens, Yandex, Baidu |
| Search-engine access | Serper, SerpAPI, Brave Search, DuckDuckGo, Bing, Mojeek, Marginalia |
| Social and messaging platforms | LinkedIn, Facebook, TikTok, Reddit, Bluesky, Mastodon, Telegram (t.me, TGStat, Telemetr), Keybase, Gravatar, Linktree |
| Courts, corrections and sanctions | CourtListener, Federal Bureau of Prisons, FBI, NSOPW, state court systems (AL, CT, OK, TX, WI), OpenSanctions, UN, OFAC/OFSI |
| Regulatory and financial disclosure | SEC EDGAR, FEC, GLEIF, ProPublica, ICIJ Offshore Leaks |
| Indicator and infrastructure reputation | VirusTotal, urlscan.io, GreyNoise, GitHub, DNS resolvers |
| Web archives | Internet Archive Wayback Machine |
One disclosure deserves its own paragraph. The reverse-image search feature in Glass Eye works by uploading the supplied image to litterbox.catbox.moe, a third-party temporary file host, so that image-search engines can fetch it by URL. The image is placed on a public host with a self-expiring link. Do not use that feature with an image you are not willing to have leave our infrastructure.
The remaining upstream sources — market data, mapping and geospatial layers, weather and seismic feeds, aircraft and vessel tracking, blockchain nodes, malware feeds and news — receive no personal data about subjects.
Two processors handle data about analysts and applicants, not subjects. They are listed separately because they are the only third parties that receive information about *you* rather than about someone you looked up:
| Processor | What it receives | Why |
|---|---|---|
| Stripe | Your email address and the payment details you enter on Stripe's own checkout page, plus the subscription record it creates | Taking and managing subscription payments. Stripe is the payment processor and acts under its own privacy policy. |
| Google (Gmail) | The email address and name of an applicant, and the message sent to them | Delivering the approval or decline email for an access request. Outbound mail is sent through Google's mail servers. |
No subject data is sent to either of them.
International transfers. Most of these providers are in the United States.
LONG GLASS sets two cookies, both strictly necessary:
lg_session — your sign-in session. HttpOnly. Expires after 12 hours.lg_csrf — cross-site request forgery protection. Expires after 12 hours.There are no analytics cookies, no advertising cookies, and no third-party tracking. Every stylesheet, font and script LONG GLASS serves is hosted by us; no page loads assets from a content-delivery network or any other external origin, so browsing LONG GLASS does not disclose your IP address to a third party.
For analysts: performance of a contract (providing your account), our legitimate interests in securing the service (sign-in logging, rate limiting, audit), and legal obligation where one applies.
For subjects: our legitimate interests, and those of our clients, in conducting lawful investigation, due diligence, fraud prevention and security research — balanced against the subject's rights and freedoms. Criminal-offence data is processed only where a lawful condition under Article 10 and applicable national law is met.
Notice to subjects. Article 14 normally requires that we tell a person when we obtain their data from somewhere other than them. We rely on the exemptions in Article 14(5) — that direct notice would be impossible or involve disproportionate effort, and that notice would defeat the purpose of a legitimate investigation — and we publish this policy in their place. This is a deliberate position, not an oversight.
Analysts agree, as a condition of holding an account, that they will not use LONG GLASS or anything it produces:
These prohibitions are enforced by contract and recorded against each query in the audit log. Breaching them ends the account.
If you are an analyst, you may ask us to access, correct, export or delete your account information, or to restrict or object to processing.
If you are a subject, you have the same rights in respect of information we hold about you, subject to the limits below. Contact us at the address in section 1. We will ask for enough information to be confident of your identity, and we will respond within one month.
Three honest limits:
If you are a California resident, you may also request disclosure of the categories of personal information collected and the categories of third parties it was disclosed to, and you may request deletion, subject to the same limits. We do not sell personal information and we do not share it for cross-context behavioural advertising.
Access requires a password and, where enabled, a second factor. Sessions are short. Records are owned per-analyst and access is denied by default rather than granted by default. Every query is logged with the account that ran it. Our security posture is documented in the repository's SECURITY.md and enforced by an automated test suite that fails the build when a control is missing.
No system is perfect. If you find a vulnerability, tell us at the address in section 1 and we will not pursue you for reporting it in good faith.
We will update the "last updated" date above when this policy changes. Where a change materially affects how we handle your information, we will tell account holders directly.
Vulcan Inc. Dallas, Texas, United States Longglasssupport@gmail.com
Privacy questions, data-subject requests, access-application questions and security reports all go to that address.