Last updated
November 7, 2026

Privacy Policy

Leafling helps you create, run, and improve personal apps through chat on your iPhone or iPad.

Information You Provide

Leafling may store your conversations, drafts, prompts, generated app files, version history, AI connection status, and model preferences locally on your device.

ChatGPT OAuth tokens and user-provided OpenAI API keys are stored in the iOS Keychain on your device. Basic connection/account metadata and model preferences are stored locally. A saved API key is not filled back into its input field.

AI Requests

When you send an AI message, Leafling sends your message and relevant conversation context to OpenAI through the connection you selected: your ChatGPT account or your own OpenAI API key. If you ask it to create or edit an app, relevant project files may also be sent. When you explicitly use an AI feature inside an example or saved app, the content you choose to process may be sent to OpenAI through that connection. Unsent drafts are stored locally and are not sent as AI requests.

In Leafling 1.5.5 and later, you can choose ChatGPT sign-in or provide your own OpenAI API key and Model ID in Settings. Earlier versions use ChatGPT sign-in. ChatGPT sign-in uses the existing secure web sign-in flow. A personal API key is used only by the native app for authenticated requests to the official OpenAI API; it is not exposed to generated app pages. Saving, switching, or removing connection settings does not send an AI request. Your chosen account’s access, usage limits, and billing apply.

Reviewed task data in internal test builds

This section describes the shared-data internal test candidate 1.5.6 (4). It does not mean these actions are available in the public App Store version.

Where these actions are enabled, you review the records and fields, or edit the text, before approving what is returned to the requesting chat or personal app. Original media is handled locally by these actions and is not automatically attached to their AI results. The text, selected fields, and structured results you approve may be included in further requests through your current AI connection, or used by the requesting app. Local processing therefore does not make the whole workflow offline. Saving a video copy to Photos or creating a reminder still requires your confirmation.

Approved results, selected local media copies or references, and operation receipts can be stored on your device. Access is scoped to the relevant chat or app page. Completed chat results can survive later turns and an app restart while their references remain valid. A reference expiring makes it unusable; it does not instantly erase chat history, saved step results, or separate records kept to prevent repeated saves. Cleanup is checked during use or scope removal; it is not guaranteed to run in the background at an exact expiry time.

Leaving an app page revokes that page’s shared-data references. Deleting a chat revokes its shared-data access and requests removal of its chat-scoped caches and checkpoints. These actions do not undo a save you already confirmed, or guarantee deletion of separate write receipts, saved-app copies, or content already sent to AI. A save already underway may still finish after you leave; later shared-data steps for that ended scope are stopped.

Reviewed-data support

Local Project Storage

Conversations, drafts, saved apps, and version history are stored locally on your device. Leafling does not publish your generated apps to a public marketplace or server.

Optional iCloud Key-Value Storage

Some personal apps can use Leafling’s iCloud key-value bridge to store text values in the iCloud account signed in on the device. When you choose a feature that uses this bridge, those values may be synchronized by Apple to your other devices with iCloud enabled. This does not automatically sync your Leafling conversations, app files, or version history.

Cloud storage is separate from local project storage and is not a public app listing. Availability depends on your iCloud account and device settings.

Device Permissions

Some built-in examples or generated projects may request iOS permissions, such as camera, photo library, microphone, speech recognition, location, calendar, reminders, motion, or Face ID access.

Permission prompts are shown by iOS and are controlled by you. Leafling requests these permissions only when you interact with a feature that needs them.

Photo-library queries follow your iOS authorization. Choosing an item through the system photo picker provides that selected content; it does not grant full-library access.

Motion & Fitness Data

Leafling may read step count or distance estimates from the device pedometer only after you explicitly interact with an example or generated project that requests Motion & Fitness access.

Personal apps may also use supported accelerometer, gyroscope, orientation, or battery updates. Continuous subscriptions operate while the personal app is open and Leafling is in the foreground. They stop when you leave the app page or put Leafling in the background; they do not restart automatically.

Leafling does not use Motion & Fitness data for advertising, analytics, tracking, or sale.

Usage Analytics

Leafling may send limited usage analytics to PostHog Cloud to help us understand whether core flows are working. These events can include app launch, foreground, tab selection, onboarding, example preview, Use This, project creation, chat submission status, agent run result, app open, app share, .leafling import result, key Bridge API outcome, ChatGPT sign-in outcome, model tier selection, paywall, and purchase or restore results.

Usage analytics use an anonymous install identifier and basic technical context such as app version, build number, device model, OS version, locale, and time zone. Leafling does not send prompts, project names, generated app files, ChatGPT emails, OAuth tokens, OpenAI API keys, Bridge parameters, photos, contacts, calendar data, location, or other permission payloads in usage analytics.

Website Analytics

On this website, optional analytics run only after you choose Allow analytics. You can refuse or withdraw through Analytics choices. We also respect Do Not Track, Global Privacy Control, and an explicit analytics=off link option. Refusing does not block downloads or other site features.

With your permission, we send page-visit and App Store-link click events to PostHog Cloud. Each event contains only an approved page path, predefined channel/campaign/content labels, the click location, an internal-test flag, a timestamp, and a random identifier held in memory for that page visit. We store only your analytics preference in this browser; we do not store a visitor identifier, set analytics cookies, fingerprint your device, record sessions, or automatically capture other interactions. Counts therefore describe opted-in events and page visits, not unique people.

We do not send full URLs, query strings, referrers, free-form tracking values, account details, or page content as analytics properties. Network requests necessarily reach PostHog with network information; we disable geographic enrichment and person-profile creation and do not use network information to match website visits to app installations.

Approved App Store links may include Apple’s provider and campaign labels after you allow analytics. Apple’s aggregate campaign reports are separate from website counts and anonymous iOS usage events. We do not join them into individual journeys or infer which person installed or purchased the app. Earlier links without these labels cannot be attributed retroactively.

After you allow analytics, links between this site’s public pages retain only approved channel, campaign, and content labels so reading an example does not change the recorded source. These links contain no visitor identifier, and we do not save attribution labels in cookies, local storage, or session storage. Refusing or withdrawing restores the site’s original links. Explicit analytics-off and internal-test link options remain in place when you move between public pages.

Tracking and Advertising

Leafling does not include third-party advertising or cross-app tracking in the current version.

Support

For privacy questions or support requests, contact: limwihing@gmail.com