For security and procurement teams
Nothing here is gated.
No sales call, no NDA, no vendor portal, no form. Every document a security or procurement review asks for is on this page.
Common questions
- 01Where is our data processed?
- On the device. Model inference runs locally on the iPhone or iPad. Documents, chats, meeting notes and generated output are never transmitted to us and we hold no copy.
- 02What happens if you are breached?
- An attacker with full access to everything we operate would obtain pseudonymous subscription records, limited product analytics from two apps, and a support mailbox. No customer content, because none of it is ever sent to us.
- 03Do you train on our data?
- No — and we could not. Training would require receiving your data. There is no inference endpoint, no prompt log and no dataset.
- 04Where does the real risk sit, then?
- Your device controls. Passcode policy, encryption, MDM and remote wipe determine the confidentiality of content that never leaves the device.
Documents
- Data Processing AddendumArticle 28 processor terms with the SCCs and UK Addendum incorporated. Takes effect without a signature; a countersigned copy is available on request.
- SubprocessorsEvery third party involved, with role, data category and location. Some apps use none of them. 30 days' notice before any addition.
- Security OverviewTechnical and organisational measures, the data we hold, and how to report a vulnerability.
- AI DisclosureWhere inference runs, EU AI Act Article 50 transparency, model licences, and the limitations of on-device models.
- Privacy PolicyWhat we collect, what we do not, retention periods and your rights.
- US State PrivacyCCPA/CPRA category table, plus Virginia, Colorado, Connecticut, Texas and others.
Data flows, app by app
- Cloister AIUses analytics — see the policy for exactly which events.4 outbound
- Auto Brightness ClockNo analytics SDK of any kind.1 outbound
- Bilingual BabyNo analytics SDK of any kind.0 outbound
- Jesus — WWJDUses analytics — see the policy for exactly which events.3 outbound
- Best DadUses analytics — see the policy for exactly which events.1 outbound
Vulnerability reports
Acknowledged within 3 business days, with safe harbour for good-faith research.
contact@leapstudio.devA signed DPA
The published DPA takes effect without one. A countersigned copy is available on request.
Request a countersigned copy