We will never sell or share your data. Ever.

This page is our privacy notice

This notice covers missived.com and the hosted Missived service: the web app, desktop apps and API. Last updated: October 30, 2026. These details are a beta draft, under legal review. We'll tell you before anything material changes. Details marked [to be confirmed] are still being decided.

Missived is self-funded and privately owned. The operator is Longsword Security, LLC (a Texas limited liability company), doing business as Missived and its registered address is 1319 Quail Run, San Marcos, TX 78666. For privacy questions or requests, email [email protected] and a person will answer.

We decide how account information is used. The organisation running a workspace decides who can join, what people post, who can see it and which integrations it connects; we handle that content on its behalf to provide the service. Ask its Owner or Admin about that organisation's own uses. A Business workspace can ask for our Data Processing Addendum, in which its organisation is the controller and we are its processor; it is with counsel now. Ask [email protected]. For a copy of Missived run by another organisation on its own servers, that organisation's privacy notice applies.

What we collect, and where it comes from

• What you give us: your email, a password (stored only as a hash), optional name, profile picture, status, preferences and security settings; the messages, files, voice notes, pages, Tables, prayer requests and other content you create; and email addresses and names of people you invite. Prayer requests and other content may contain sensitive information such as faith or health details.

• Age: we ask for month and year of birth. We keep the year, the age it gave on that day, and when and how you told us, rather than your full birthdate. We don't ask for ID or a photo. Refused underage signups leave only a 24-hour retry hold in the browser, without what you entered.

• While you use Missived: session IP addresses, browser or app details, sign-in and last-use times; security and audit records; presence, last-seen time and Virtual Office position; who joined a call and when; and content-free technical logs used to operate and protect the service. Desktop update requests show the download server your IP address, version and operating system. Audio, video and screen shares pass through our own call server. We do not record calls.

• From your group and connections: invitations, roles and channel membership; content posted by integrations your workspace chooses; and the id, name, picture and encrypted access tokens of accounts you link. Optional streaming or gaming activity is off until you switch it on.

• Google sign-in: only if you choose it, Google gives us your name, verified email, account id and, for a Google Workspace account, its domain. You can remove it in Settings → Account & Security → Sign-in methods. We never receive your Google password.

• Microsoft sign-in: only if you choose it, Microsoft gives us your name, email address, account id and directory (tenant) id. You can remove it in Settings → Account & Security → Sign-in methods. We never receive your Microsoft password or your mail, files or contacts.

• Booking pages: when you book time with someone through a Missived booking page, what you type (your name, email and answers) goes to their workspace, which decides how long it keeps it. We use your email only to send that booking's code, confirmation, reminders and changes. You don't need an account, and after the meeting the link in your confirmation lets you remove your details.

• Tickets: when you email a workspace's Missived Tickets address (or use its help form), your name, email address, what you write and any files go to that workspace, which decides how long it keeps them; the workspace is in charge of that data and we handle it for them. We email you only the replies its team sends and the automatic notes it switched on (such as "we got your request"), through Resend, our email provider. No tracking pixels or tracked links, and you don't need an account. Ticket subjects, messages, notes, requester details and reply drafts are sealed at rest; our server can read them. Queues keep closed requests until deleted by default, or for 6, 12, 24, 36 or 60 months after closing. Raw mail and Spam last 30 days; held forwarding mail 7 days; form holds 1 hour. Portal contacts see only their own requests. A connected personal assistant can triage only with your separate Tickets consent; a reply always waits for your confirmation. Apps never read Tickets. The workspace can export ticket data and erase a contact with their conversation, internal notes and files.

• When you contact us: your email and what you send. An in-app bug report can include your description, steps, workspace and page, browser and screen details, recent error kinds and a screenshot you choose to add. The form explains the optional assistant and lets you keep the report with our team. The waitlist and Enterprise form are described above.

• When your workspace pays: an Owner or Admin who buys a paid plan pays on Stripe's checkout page. Stripe receives what they type there (name, email, card and billing address) and, from us, the workspace's id and name, the buyer's email, and the plan, size and number of paid users (for Business, the members who used the workspace in the last 30 days). We keep only Stripe's ids, the subscription's status, plan, dates and amounts. Missived never sees or stores card numbers.

• If you're a referral partner: the name or company name you give us, the agreement you accepted and when, your codes, your terms, and your monthly totals, statements and payments. For the workspaces that used your code we keep which code they used and the fees it earned you; we never show you which workspaces those are.

We collect no advertising identifiers, contact-book uploads or precise location.

AI

Missived has no built-in AI that reads, summarises or ranks your messages or files, and we never use workspace content to train models. Our servers run no AI features and never call an AI service. An assistant or app you choose to connect can access only what its permissions allow; you can disconnect it. See the MCP guide and its permission scopes.

When assisted bug reporting is enabled, the form explains it and lets you choose Send to our team only. The founder's Claude routine can fetch only assisted reports, stripped again of identifying details before review. It does not automatically collect message content. Please leave messages and sensitive information out of your description and crop or blur any screenshot in the browser before sending. Screenshots are encrypted in storage and removed 30 days after resolution; reports and their screenshots are also removed with your account. Anthropic is listed above. Feature ideas using the same privacy rules are planned, not available yet.

AI coding assistants help the founder build Missived. Claude also helped design and test the server upgrade procedure; the Console upgrade flow is designed to run within Missived with the founder's approval, without customer content and without requiring Claude. When we diagnose a problem, an AI assistant may look at server logs and error details only after IP addresses and identifiers are removed, and never message content. Read How we use AI for the full explanation.

Cookies and things kept in your browser

The web app uses an HttpOnly, SameSite=Strict refresh-token cookie on the API domain to keep you signed in, lasting up to seven days and replaced when used. Short-lived cookies hold sign-in and app-approval steps together; Google and Microsoft sign-in, and a workspace's own single sign-on, each use a ten-minute cookie removed when you return. An underage refusal leaves a 24-hour retry hold. Browser storage remembers your device, workspace and choices such as theme and voice settings. This website remembers your colour choice. These are for the service and your preferences, never advertising or tracking. A referral link (missived.com/r/…) sets a 90-day cookie on our API's domain holding only the code and the day you clicked; it's removed when your workspace first pays or you remove the code.

Why we use it, and the legal bases

Where GDPR or UK GDPR applies, these are the bases described in our draft:

• Contract: create and run your account; store, deliver, search and display content to its intended audience; run calls and meetings; send necessary codes and invitations; answer support requests; and run connections you or your workspace ask for; and bill a workspace for the paid plan it buys.
• Legitimate interests: keep the service running and secure, prevent abuse, investigate problems, keep audit records and answer enquiries. Our interests are protecting people and operating Missived.
• Consent and your settings: optional notifications, digests and accounts you link yourself. You can switch them off or disconnect them. Withdrawing consent doesn't change earlier lawful use.
• Legal obligation: comply with the law and valid legal requests, including keeping billing records.

For sensitive workspace content, the organisation is responsible for a lawful basis to collect it; we handle it to provide its service. The special-category legal basis is [to be confirmed] with counsel. We don't use data for advertising, profiling or automated decisions with legal or similarly significant effects. Without an email and sign-in details we can't provide an account; optional profile fields and connections are your choice.

Who can see it, and security

People you share content with can see it. Workspace Owners can open every channel in their workspace, including private ones; Owners and Admins can see its member details and audit records, including IP addresses. Direct messages and group chats are available only to their participants, except that if someone reports one of their messages, the workspace's Owners and Admins see that message (the report form says so). Notifications and digests you enable can contain message text; choose content-free notifications in Settings if that isn't what you want. Notifications and emails about direct and group messages say who sent them and how many, not what, unless you choose to see the text in Settings → Notifications. If a direct message, mention or reply to you is still unread after 15 minutes we email you about it (on by default; switch it off in Settings → Notifications or with the email's unsubscribe link). Replying to that email from your account's own address posts your reply as you in that conversation; we post only what you wrote above the quoted email, and refuse replies from any other address.

Shared categories. A workspace on Business or Ministry can share a category of chat, voice and Table channels with another workspace it chooses, and an Owner or Admin of that workspace must approve it. Messages, files and Table rows in those channels (or, for a shared view of a Table, only what the view shows) are then visible to the people both workspaces include, and anyone in a shared voice channel's call hears (and, with cameras, sees) everyone else in it. Calls run on our own media server, as all Missived calls do, and are not recorded. Each workspace sees the other's people by name and profile picture only, never their email address, and there are no direct messages between workspaces. Guests and people under 18 are never included, and apps and integrations stay out of shared channels. Either workspace's Owner or Admin can end the share; the workspace that started it keeps its channels read-only, and the other workspace keeps a read-only copy of what was shared in its own workspace. Messages in a shared category are kept until someone deletes them, as everywhere else in Missived. This is a workspace choosing to share with another organisation it approves, not us sharing your data.

Your account rep (Business). A Business workspace may have a named Missived account rep: Missived staff, not a member of your workspace. A rep sees only the workspaces assigned to them, and only account details: the workspace's name, plan, size, paid seats and usage counts (how many people were active, never who), storage, its Owners' and Admins' names and email addresses, billing status without amounts or card details, and whether bug reports were sent and when (the report's words only after confirming it's them; screenshots stay with our engineers). A rep never sees your messages, files, calls, meetings, Tables, channel names or member list. Each time a rep looks at your workspace it appears in your workspace's audit log with a "Missived" badge (views once a day; every look at addresses or a bug report). A rep's emails come from Missived with a reply-to address at missived.com and carry no tracking. These are Missived's own account records, like billing, and no new company handles them. Once a day we work out a health score from the same counts (how many people were active, setup steps done, open bug reports, billing status), so your rep knows when to check in; it never uses messages, words or what any one person did. Your rep's notes about your account are encrypted, seen only by the reps looking after it, and deleted a year after the workspace leaves Business.

Owners and Admins see their rep, exactly what the rep can see and the numbers as the rep sees them in Org Settings → Your Missived contact. An Owner can switch on "Don't contact us unless we ask" (the rep stops check-ins and answers only what you send; billing, security and legal email is unaffected) and choose which Owners and Admins hear from the rep. A rep may email the workspaces they look after a short message: a service message (a change, an outage or something you need to do) or an update (news and tips). Each one goes to each person separately from the rep at Missived, with no tracking, and also shows in Activity; an update skips workspaces that opted out, and its unsubscribe link stops updates for you. A workspace export includes these settings and messages (missived-contact.json).

If an Owner accepts a "Missived Support" space, it is a shared category between your workspace and ours, with one channel for chat, files and calls with your contact. It works like any shared category (you choose who in your workspace can reach it and can end it at any time) but doesn't count toward your plan's shared categories. When it ends you keep your read-only copy; ours is deleted two years later.

Our platform console has no tool for reading your messages, files or calls and no way to log in as you. People maintaining our servers could technically access stored data, but only do so when needed to fix a problem you ask us to investigate, protect the service or comply with the law. The companies that handle data and the integrations you choose are described above. We disclose information under valid legal requirements, including legally required child-safety reports.

Connections are encrypted in transit. Uploaded files are encrypted before storage, except public profile pictures and workspace icons. Messages are encrypted at rest in every workspace, under that workspace's own key, and message search works without storing the words. This is not end-to-end encryption: our servers hold the keys to provide the service. End-to-end encryption for direct and group calls, then direct messages, group chats and meetings is on our roadmap; what's encrypted today lists every part and who can read it. Email to our provider is always sent encrypted. Passwords are hashed; two-step sign-in, email codes, session controls and rate limits protect accounts. Backups are separately encrypted. No system is perfectly secure. Report a concern to [email protected]. If a breach affects personal information, we'll tell affected people and workspace Owners without undue delay and notify regulators where the law requires.

How long we keep information

• Workspace content: until its author, an Admin or workspace deletion removes it. There is no automatic expiry today. Deleted message text leaves the database immediately and backups within 60 days; outgoing-event records may hold it for up to seven days. Attached files are queued for removal from storage, with retries. We keep the latest message version, without an edit history.
• Meetings: guests, their meeting chat and files are removed 90 days after archive. Meetings archive automatically 14 days after they end. Table cell history lasts 30–365 days by plan; private replies from apps last 15 minutes.
• Bookings: a booker's answers are removed 90 days after the booked meeting is archived, or sooner when the workspace sets a shorter time. A time held while someone enters their code is deleted once the code expires.
• Account and profile: until account deletion, scheduled seven days after you ask, with a chance to cancel. Data-download files are encrypted and removed after seven days. Workspace deletion has a 14-day notice and cancellation window before its content is removed. Deleted information leaves encrypted backups within 60 days.
• Sessions and notifications: sessions last until sign-out, revocation or expiry (seven days without web use). Expired sessions and remembered devices are deleted 30 days after they expire. Push subscriptions last until sign-out, you switch them off, or delivery says they are gone.
• Office layouts: when an Owner or Admin saves a floor's layout, the layout it replaced (rooms, decor and table places — no names of people) is kept for seven days so it can be restored, then deleted automatically.
• Account reps (Business): the daily health counts are kept 13 months; staff reminders 90 days; a rep's notes and check-in records a year after the workspace leaves Business (deleting the workspace removes them at once). Messages from your rep, and who received them, are kept a year.
• Workflows (Business): what each step of a run used and gave is kept for the workspace's history window (30 days at most, never under 7), then deleted; the list of runs (when, how it went, no content) 90 days. A deleted workflow and its runs go 90 days after it's deleted, and workflow notices after 30 days. An approval and its answers go with its run. A workflow's email to members is kept 7 days after it was queued; what a webhook sent a workflow is deleted as soon as the run starts (7 days at most if it never does). Workflow secrets and allowed addresses stay until an Owner or Admin removes them or the workspace is deleted.
• Security and audit records (sign-ins, admin actions, security alerts, workspace audit logs): one year, then deleted automatically. Server logs hold no message content and are kept for at most 30 days.
• Bug reports: one year after they're sent, then deleted automatically. Screenshots are removed 30 days after resolution, and your reports and screenshots are removed with your account. Underage-account reports are sealed and removed 90 days after a decision.
• Billing: a workspace's subscription record (Stripe ids, plan, status, dates and amounts) stays while the workspace exists and goes with it; records of Stripe's notifications are removed after 30 days. Stripe keeps invoices and payment records under its own retention, as tax and accounting law requires; how long we must keep billing records ourselves is [to be confirmed].
• Referral partners: a partner's statements, fees and payments are kept for seven years after the year they were paid, as tax and accounting records ([to be confirmed]); everything else about a partner is removed a year after the program ends for them. A workspace's link to the code it used is removed when the workspace is deleted. Unused referral marks expire after 90 days.
• Enquiries: Enterprise form entries last one year or until earlier deletion. Unconfirmed waitlist addresses last seven days from the last confirmation email we sent, and never more than 14 days from the first time the address was entered; confirmed ones stay until you remove yourself, we delete them, or a setup code is sent and used. The EU / UK interest list works the same way: unconfirmed addresses follow the same seven / 14-day rule, confirmed ones until you remove yourself or we delete them. Email you send us (support, privacy or legal questions) is kept for two years, or less if you ask. Linked-account activity clears when it ends.

Your rights and choices

Use Settings to edit your profile, sign out sessions, manage two-step sign-in and notifications, and disconnect accounts, apps or assistants. Digest and missed-message emails have unsubscribe links. Settings → Security offers Download my data and Delete my account. You can delete your own messages.

Depending on where you live, you may have rights to access, correct, delete or get a portable copy of your information; restrict or object to its use; withdraw consent; and use an authorised agent. We won't discriminate against you for exercising those rights. Email [email protected] from your account's address, or tell us which account you mean. We may ask you to confirm it's you. Requests are free; we answer within 30 days (45 days where California law applies), and tell you if more time is needed. You may complain to your local data-protection authority, the UK's ICO or the California Privacy Protection Agency, as applicable.

Seven days after an account-deletion request, we sign you out and remove your profile, sign-in and security details, sessions, devices, subscriptions, linked accounts, tokens, settings and memberships. A workspace where you were the only person is deleted too. Shared messages, including DMs, and other shared workspace records stay for the people in the conversation, with messages shown as “Deleted user”. Delete your messages first or ask us to remove them. If others use a workspace where you are the only Owner, transfer ownership or delete it first. Requests about content a workspace controls may be passed to its Owner; we'll tell you when that happens.

For California readers: we don't sell or share information for cross-context behavioural advertising and haven't in the past 12 months. Sensitive information is used only to provide the service. The categories, sources, purposes and recipients are described on this page; we make no profiling inferences.

Where your information goes

Our servers are in Virginia in the United States. Cloudflare operates a global network, and providers above may handle data outside your country. Using Missived outside the US involves transferring information to the US. Missived is currently offered from the US for US-based use. We don't offer EU or UK data residency today, and we don't have the arrangements that would need (such as transfer agreements or an EU / UK representative). We aren't claiming any certification or signed transfer arrangement. If there's enough interest we'll add EU / UK data residency and the paperwork it needs: join the list. Ask [email protected] about international processing.

Changes to this notice

We'll update the date when this notice changes. For a material change, we'll tell every account holder by email and in the app at least 30 days before it takes effect. We will never change our promise to allow selling your data or sharing it for advertising, AI training, data brokers or partners. Questions and requests go to [email protected].

Electronic signing and timestamp authorities (coming soon)

E-signatures remain off pending legal review. The signing record includes the documents, recipients, consent, adopted signatures and field values, authentication steps, times, IP addresses and browsers. Completed files and certificates are encrypted at rest. When timestamping is configured, DigiCert (or the self-hoster's configured RFC 3161 authority) receives only a SHA-256 hash of the seal signature, a random nonce and the server's IP address; no document content or signer details leave for timestamping. Signing emails use our existing email provider on a separate sender subdomain and category. We store delivery outcomes and pause workspace sending on bounce or complaint spikes. A sent envelope stays with the workspace that sent it, as signed, even after the sender or a signer deletes their Missived account, because it is the other people's record too; deleting the workspace deletes its envelopes. See How Missived e-signatures work.

Optional upload scanning infrastructure

ClamAV runs on our own box. Its freshclam process downloads signatures from ClamAV’s mirrors (the mirror sees the server IP and update request, no user content). Uploaded files never go to a cloud scanner. It remains off until the approved app box upgrade.