Privacy

Effective [DATE]. Plain words on purpose; the short version is that your vault is the only copy, and you can read, export or delete the whole of it from the app.

1. Who we are

By Your Leave is run by [ENTITY], [ADDRESS], United Kingdom. We are the controller of the personal data described here. Write to hello@byyourleave.com for anything in this page.

2. What we hold

• Your account. Sign in with Apple gives us an opaque per-app identifier and nothing else: we do not ask Apple for your name or email. That identifier opens your vault. We also keep a sealed token so that deleting your vault ends the sign-in at Apple.
• Your facts. What you add to the vault: an address, a birthdate, sizes, notes, the pages agents keep about your projects. Each fact carries a class and a policy that you set.
• Grants and receipts. Every ask an agent makes, your answer, and a verbatim record of what the vault did on your behalf, including refusals.
• Your goals and the work on them. Goals you write, the questions agents ask about them and your answers, tasks and documents.
• Connected accounts. If you connect Google Calendar, the token Google issues is kept sealed (encrypted at rest) and used only for the named operations you approve. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• Signed-in sites. If you sign into a website through the vault's browser, we keep that site's session cookies, sealed, one per site. What you type during the sign-in is passed through and never stored, logged or shown to a model.
• Mail aliases. For each alias we keep who it was made for, which agent holds it, and the sender domains that wrote to it; the mail itself is forwarded to you, not kept.
• Payments. If you set up payments, Stripe holds the cardholder; we keep the cardholder id and, per approved purchase, the last four digits of the single-use card. We never store a full card number.
• Push. A device token so that asks can reach your phone.

No analytics, no trackers, no advertising identifiers. The web pages set no cookies.

3. Why, and on what basis

• Running the service (contract): holding your facts, carrying out what you approve, writing the receipts.
• Security and abuse prevention (legitimate interest): rate limits, the record of who asked for what.
• We do not use your data to train models, and we do not sell it.

4. Where

Everything lives on Cloudflare's network in a store that belongs to you alone, pinned to the European Union. Our processors are Cloudflare (hosting, mail routing, the browser), Apple (sign-in, push notifications), Google (only if you connect a Google account) and Stripe (only if you set up payments).

5. Agents

An agent you connect sees only the facts you have shared with it, and only to the extent each fact's policy allows. Anything that sends, books, pays or reveals waits for your answer unless you have said it may proceed. The agent never holds the value of a sensitive fact: addresses go out as one-time links, email through aliases, money as a single-use capped card. Agents are not ours; their own handling of what you let them read is governed by their makers' terms.

6. How long, and deletion

• Receipts are kept for 90 days, then purged automatically.
• Everything else stays until you delete it. Deleting a fact, an alias, a connection or a site removes it at once.
• Deleting your vault from the app removes everything, ends the sign-in at Apple, and deletes any stored Google token. We do not revoke that token at Google for you; you can do so under your Google account's connected apps.

7. Your rights

Under UK GDPR you can ask for access, correction, erasure, portability, or object to processing. The app does most of this directly: every fact is editable, Export gives you the whole vault as JSON, and Delete removes it. For anything else, email us. You can also complain to the Information Commissioner's Office at ico.org.uk.

8. Security, children, changes

Credentials we hold for you are encrypted at rest with a key that is not stored beside the data. Transport is HTTPS throughout. The service is not for anyone under 18. When this page changes we update the date at the top; a material change is announced in the app before it takes effect.

This page describes the service as built. If something here does not match what the app does, tell us and we will fix one or the other.