What we hold, and what we cannot read.
Last Chair is built so that the least possible is known about you, by us or by anyone who might one day get past us. This page says plainly what that amounts to.
- We never ask for a bank or brokerage login.
- Your household is encrypted on your device. We store ciphertext.
- We know your email address, and when and from where you signed in. Little else.
- We do not sell, share or advertise against your data.
- Export everything at any time; delete everything in one step.
What we collect
An email address, used to send one-time sign-in links, the generic monthly reminder if you turn it on, and notices about your membership. Session records: when a sign-in happened, from what kind of browser and the IP address it came from, so sessions can expire and be revoked. A sign-in cooldown: to limit how many links go to one address, we count recent links against a keyed hash (an HMAC) of the address, never the address itself, and clear the count once its window ends. Account settings: the label you chose for the sign-in screen, whether the monthly reminder is on, and for each passkey you add its public key and your household key sealed under it. An encrypted document holding your household, along with its size, version number and the time it was last written, so it can sync between your devices. A waitlist address, if you leave one on the overview page, kept until you ask us to remove it or until we no longer run a waitlist.
What we cannot read
Accounts, balances, holdings, properties, mortgages, spending, goals and every figure derived from them are encrypted in your browser with a key derived from your passphrase. The key never leaves your device. We cannot read the document, we cannot reset the passphrase, and a copy of our database would not help anyone read it either. The security page describes the mechanism.
Price and fee lookups
When your statement opens, your browser asks our cache for the prices and expense ratios of the public symbols you hold, in batches, with no cookie and no account identifier attached. We keep those symbols in the cache so the nightly refresh can price them for everyone. The cache is not linked to you. Our own lookups go to public market-data sources and carry only the symbols.
Payments
Membership is billed by Stripe. Your card details go to Stripe, not to us; we hold a Stripe customer reference, the plan you chose and whether it is active. Stripe's own privacy terms apply to the payment.
What we do not do
No bank or brokerage connections, no aggregators, no credentials, no account numbers, no Social Security numbers. No advertising, and no tracking scripts or cookies on any page: visits to the public pages are counted on our server as hourly totals by page, linking site, country and type of device, and nothing is kept about the visitor, no address, no identifier, nothing that ties one visit to another. No sale or sharing of personal data with third parties beyond the services needed to run Last Chair: Cloudflare for hosting, the database and sending email (Resend only as a backup, if we ever switch it on), Stripe for payments. Each of those sees only what its job requires.
Your controls
Export the whole household as JSON and CSV from Settings at any time. Delete everything in one step; that removes the encrypted document, your memberships and your sign-in record from the server and the copy on your device. Turn the monthly reminder on or off whenever you like. Write to us at the address below to be removed from the waitlist.
Retention and changes
We keep what is listed above for as long as you have an account. Deleting removes it from our database at once; our database provider's backups, which hold your household only as ciphertext, expire within 30 days after that. If this page changes in a way that matters, we will say so on it and by email to members. Questions go to privacy@lastchair.app.