Privacy Policy

Last updated: October 27, 2026

1. Introduction

Longlost LLC dba Joint Price ("we," "us," or "our") operates jointprice.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Information you provide directly:

Email address (for authentication and communications)
Your name and company name (optional, provided per Discovery)
Counterparty name, company name, and email address
Prices you enter (minimum fee or maximum budget, and any optional limit on the joint price)
Scope of work descriptions (scope name and description)

Information collected automatically:

IP address (recorded at account registration, Discovery consent, and decline events)
Browser user agent (recorded at consent and decline events)
Date, IP address, and visit count each time an invited counterparty opens their own Discovery page (used to check a disputed submission and to detect abuse)
Session cookie (a single cookie for authentication; see Section 9)
Aggregate page view data (via Fathom Analytics, cookieless, no personal data collected)
How you first arrived at the Service: the campaign tags on the link you followed, the page you landed on, and, if a search engine or AI assistant sent you, that site's name (never the address of the page you came from). Recorded once, when your account is created.

Information we do not collect:

Physical addresses, phone numbers, or government IDs
Payment card numbers (Stripe handles all payment data; we never see or store card numbers)
Your browsing on other websites (beyond the name of a search engine or AI assistant that sent you to us, described above), or any data used to track you across the web

3. How We Use Your Information

To calculate and deliver joint prices (the core service)
To authenticate you via email sign-in links
To send transactional emails related to your Discoveries (invitations, notifications, confirmations)
To maintain consent records (which version of our Terms and Privacy Policy you agreed to, and when)
To detect and prevent fraud and abuse (rate limiting, and checking a disputed submission)
To improve the Service through aggregate, anonymous analytics
To understand how people find the Service (the arrival information described in Section 2)

4. Confidentiality of Price Data

Your private prices and limits are never directly disclosed to the other party in a Discovery. Only the calculated joint price is shared with both parties. However, users may be able to infer a submitted value from the joint price.

Price data is stored securely and is not shared with third parties except as required to operate the Service (e.g., database hosting).

We do not sell your personal information. We do not share your information for targeted advertising. We share information only with the following service providers, solely for the purposes described:

Stripe: Payment processing. We send your email and Discovery metadata to Stripe. We store only Stripe session and payment intent identifiers.
Postmark: Transactional email delivery. We send recipient emails, names, and Discovery details necessary for email content.
Fly.io: Cloud hosting. Application data is hosted in Fly.io's infrastructure.
Fathom Analytics: Privacy-first, cookieless analytics. Fathom receives aggregate page view data only. No personal information is shared.

We may also disclose information if required by law, court order, or governmental authority, or in connection with a merger, acquisition, or sale of assets (with notice to affected users).

6. Data Retention

We retain different categories of data for different periods:

IP addresses and browser user agents: Automatically deleted after 90 days.
Counterparty page-visit dates and counts: Retained with the Discovery. The IP address recorded with them is deleted after 90 days.
Error tracking data: Automatically deleted after 30 days. Error records may include your IP address, browser details, and the page you were on.
Sign-in links: Links you request from the sign-in page expire after 15 minutes and are single-use. Links we include in Discovery emails expire after 7 days.
Session cookie: 30-day maximum age (browser-side).
Account and Discovery data: Retained while your account is active or until you request deletion.
How you found us (arrival information): Retained with your account. When your account is deleted, it is kept without anything that identifies you.
Consent records (timestamps and references to legal document versions): Retained indefinitely to demonstrate that consent was obtained.
Legal document versions (the text of our Terms and Privacy Policy): Retained indefinitely and cannot be modified.

Deleted or expired data may remain in our encrypted database backups for up to 60 days; these backups are not used to operate the Service and expire on a rolling schedule.

7. Account Deletion

You may request deletion of your account by contacting support@jointprice.com. Requests will be processed within 30 days. When your account is deleted, your personal information will be anonymized such that you are no longer identifiable.

The following information is retained after account deletion:

Financial and transaction records, retained for 7 years for tax compliance
Consent proof (timestamps, legal document version references, acknowledgment text), retained indefinitely to demonstrate consent was obtained
Anonymized Discovery records, because the counterparty has a legitimate interest in their own transaction history
How you found us (see Section 2), kept without anything that identifies you

8. Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS with HSTS), signed session cookies, and rate limiting. However, no method of transmission over the internet is 100% secure.

9. Cookies

The Service uses a single session cookie (_joint_price_key) for authentication. This cookie is signed and has a maximum age of 30 days. It is an essential cookie required for the Service to function. Before you create an account, this cookie may also hold how you arrived at the Service (see Section 2). Two further signed cookies are used only in an internal testing mode that ordinary visitors never reach.

We do not use tracking cookies, advertising cookies, or third-party cookies. Our analytics provider (Fathom Analytics) is cookieless.

10. Your Rights

You have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your account and associated data (see Section 7)
Request a copy of your data in a portable format

To exercise these rights, contact us at legal@longlost.llc.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date on this page. Each Discovery captures the exact version of this Privacy Policy you agreed to, so changes do not retroactively apply to prior Discoveries.

13. Contact Us

Questions about this Privacy Policy should be sent to legal@longlost.llc.

Longlost LLC, 11 S Angell St #319, Providence RI 02906