Privacy Policy

Leda is a personal AI assistant for households. This policy explains what data we collect, why we collect it, and how you can control it. We do not sell your data and we never will.

Account data: Your email address and password (hashed) when you create an account.

Household data: Information you and your household members provide to Leda — calendar events, shopping lists, meal plans, notes, clothing inventory, storage inventory, and any other content you choose to share.

Google integration (optional): If you connect your Google account, we store OAuth refresh tokens (encrypted at rest) to read your calendar and Gmail on your behalf. We read email metadata and recent messages only when you explicitly request it or when generating your daily digest. We never modify your Gmail.

Chat history: Conversations with Leda are stored per household to provide context for future interactions. You can delete your chat history at any time.

Device tokens (optional): If you enable push notifications on iOS or Android, your device push token is stored to send you notifications from Leda. You can revoke this at any time in your device settings.

Usage data: We track anonymized credit usage (token counts per AI call) for billing purposes. We do not log the content of individual AI exchanges beyond your chat history.

• To provide and improve the Leda service
• To generate your personalized daily digest and AI responses
• To process billing and manage your subscription
• To send you push notifications you have opted into
• To debug errors and improve reliability

We do not use your data to train AI models or share it with advertisers.

Leda uses the following third-party services to operate:

• Anthropic (Claude):Your chat messages are sent to Anthropic to generate AI responses. Anthropic's privacy policy applies to these interactions.
• Supabase: Your data is stored in a Supabase PostgreSQL database hosted in the United States. See Supabase's privacy policy.
• Vercel: Leda's web application is hosted on Vercel. See Vercel's privacy policy.
• Stripe: Payment processing for subscriptions and credit purchases. See Stripe's privacy policy.
• Google APIs: Used when you connect your Google account for calendar and Gmail access.

Your household data is retained as long as your account is active. If you delete your account, all associated data is deleted within 30 days. Chat history can be deleted at any time from within the app. Google OAuth tokens are deleted immediately when you disconnect your Google account.

All data is encrypted in transit (TLS 1.3) and at rest. OAuth tokens and BYOK API keys are encrypted using AES-256-GCM before storage. We use row-level security on all database tables so your data is only accessible to members of your household.

You have the right to:

• Access all data Leda holds about you (export available on request)
• Correct inaccurate data
• Delete your account and all associated data
• Disconnect Google integration and revoke OAuth tokens
• Opt out of push notifications in your device settings

To exercise these rights, contact us at alex@hurleyinc.com.

Leda is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with their information, please contact us.

We may update this policy periodically. We will notify you of material changes by email or via an in-app notice at least 14 days before the change takes effect. Continued use of Leda after that date constitutes acceptance of the updated policy.

Questions about this policy? alex@hurleyinc.com

Leda · https://app.leda.hurleyinc.com