Privacy Policy
Leap is a bucket list app that helps you collect dreams, plan them with AI, and share them with friends. This policy explains what personal data we collect, why, who we share it with, and the rights you have. We try to keep it plain and short.
1. Who we are
The controller of your data is Jonas Mencl, a self-employed person (OSVČ), Pelzova 1514, 156 00 Praha 5 – Zbraslav, Czech Republic ("Leap", "we", "us"). Contact us for anything about your data at leapapp.support@gmail.com.
2. What we collect
| Data | Why |
|---|---|
| Account: email address, password (stored hashed by Firebase Authentication), or your Apple sign-in identifier (and the email or private relay address Apple gives us) | To create and secure your account |
| Profile: display name, username, photo, banner colour or image, bio, accent colour, home city and its coordinates, currency, interests and travel preferences, character choices (look and accessories) | To show your profile, personalise plans, and let friends find you |
| Your content: bucket list items, notes, steps, photos, memories and ratings, visibility settings | To provide the app. Items you mark "friends" or "public" are visible to those audiences |
| Friends: friend requests, friendships, invite codes, blocks and reports | To run the social features and keep the community safe |
| AI requests: the item title and details, your city, currency, preferences, and chat messages you send to the assistant | To generate plans, ideas and answers (see section 4) |
| Location: your location only when you tap "use my location". We store the city and coordinates you save in your profile or on an item | To plan travel from where you are |
| Purchases (when subscriptions launch): purchase status and a purchase identifier. Apple handles payment; we never see your card | To unlock paid features |
| Technical: request logs and rate-limit counters kept by our cloud provider | Security, abuse prevention, and keeping the service running |
We do not use advertising, ad identifiers, third-party analytics, or cross-app tracking, and we do not sell your data.
3. Why we may process it (legal bases)
- Contract: to provide the app you signed up for (account, lists, friends, AI plans).
- Legitimate interests: security, abuse prevention, moderation, and fixing problems.
- Consent: location (you grant it in iOS and can revoke it any time), camera and photo access, and push notifications.
- Legal obligation: where the law requires us to keep or disclose something.
4. Who we share data with
We use service providers (processors) that act on our instructions:
- Google Firebase / Google Cloud: authentication, database (Firestore, EU region), file storage, and our server functions (EU region).
- Google Gemini: when you ask for an AI plan, ideas or chat, the relevant text is sent from our server to Google's Gemini API, which may use Google Search to ground answers. We do not send your email or password. Do not put sensitive personal information in item titles or chat. We do not use your content to train our own models.
- Apple: Sign in with Apple and, when available, in-app purchases.
- RevenueCat (planned, for subscriptions): receives your purchase status and an anonymous app user ID.
Other users see what you choose to share: your profile, and items set to friends or public. Private items are visible only to you. We may disclose data if required by law or to protect people's safety.
Some providers may process data outside the EU/EEA. Where they do, we rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
5. How long we keep it
- Your account data and content stay until you delete them or your account.
- When you delete your account, we delete your profile, items, friendships, invite codes, blocks, and uploaded files. Copies in backups and logs expire within about 30 days.
- Reports about content or users may be kept for a limited period to protect the community and to meet legal duties.
- AI plan results may be cached on our servers (keyed by the request, not your identity) for up to 30 days.
6. Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, objection, and a portable copy of your data, and withdraw consent at any time. You can edit most of your data in the app, and delete your account in Settings → Delete account. For anything else, email leapapp.support@gmail.com; we reply within one month. You also have the right to complain to your data protection authority (in the Czech Republic: Úřad pro ochranu osobních údajů, uoou.gov.cz).
7. Children
Leap is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has an account, contact us and we will delete it.
8. Security
Data is encrypted in transit and at rest by our cloud provider, access is controlled by per-user security rules, and AI keys stay on our servers. No system is perfectly secure, so please use a strong, unique password.
9. Changes
If we change this policy in a meaningful way, we will tell you in the app before it takes effect. The date at the top shows the latest version.
10. Contact
Jonas Mencl (OSVČ), Pelzova 1514, 156 00 Praha 5 – Zbraslav, Czech Republic
leapapp.support@gmail.com