Privacy Policy
Leafa is a home inventory app, for iPhone, iPad, Android phones and tablets, and on the web: you record your places, the things kept in them and their photos, and share them with the people you live with. This page explains what Leafa stores, why, and what you can do about it.
Who we are
Leafa is made by Honeyside, which is responsible for your data. For anything about your data, write to leafa@honeyside.it.
What we store
Your account
You sign in with Apple. Apple gives us an identifier for your Apple Account and, if you choose to share them, your name and email address (which can be an Apple private relay address). We use them to sign you in and to show your name to the members of your households.
On Android you sign in with Google instead, and on the web you can choose either. Google gives us an identifier for your Google Account, your name and your email address, which we use in the same way. A Google sign-in is a separate Leafa account from an Apple one, even for the same person; the two can share a household.
Your inventory
The places, items, quantities, tags, notes and photos you add, and the households you create or join. They are stored on your device (in the web app, in your browser) and on our server, so they sync between your devices and with your household.
Usage records
For each day you use Leafa we record the date, the app version and whether it runs on an iPhone, an iPad, an Android phone or tablet, or in a browser. We use this only to count how many people use Leafa and which versions are still in use.
Security
Your sign-in sessions (stored only as hashes) and short-lived counters that stop abuse, such as too many sign-in attempts. A counter can include your IP address and is deleted within an hour.
Cookies and browser storage
The web app sets a cookie that keeps you signed in. It is strictly necessary, contains only a random sign-in token, is sent only to our sign-in service and expires after 180 days or when you sign out. When you choose a language (with the language link on this site, by opening the web app from it, or in the web app’s settings), a second cookie remembers it: it contains only the language, such as “en”, and expires after a year. Leafa sets no other cookies, on the web app or on this site.
The web app keeps a copy of your households’ inventory and photos in your browser’s storage, so it opens quickly and works offline. It stays on that browser until you sign out or delete your account, which removes it.
When you sign in on the web, the sign-in page loads Sign in with Apple from Apple’s servers and Sign in with Google from Google’s servers; each sign-in window opens on Apple’s or Google’s website.
Ads and tracking
Today Leafa shows no ads, contains no advertising, analytics or tracking SDKs, and doesn’t track you across other apps or websites. We don’t look at your photos or inventory, except when you ask us for help with them.
Leafa may show ads in the future: our own, those of partners, or ads delivered by third-party advertising services built into the app. Before that happens we will update this policy to name those services and say what data they receive and why. Ads that use your personal data or track you across apps will only run with your consent, asked through Apple’s App Tracking Transparency prompt and, where the law requires it, a separate consent request; you can refuse or withdraw it at any time.
Who can see your data
Everyone in a household sees its places, items and photos, and the names of its members. Apart from them, only we can access it, to run the service. Your data is kept on servers in the European Union, in Milan (Italy). Apple handles Sign in with Apple, and Google handles Sign in with Google, under their own privacy policies.
How long we keep it
As long as you have an account. When you delete a photo, its file is deleted from the server right away. When you delete a place or an item, it disappears from every device; the server keeps it, marked as deleted, so that all devices learn about the deletion, until the household itself is deleted.
You can delete your account at any time in Settings › Delete account. This deletes your account, your sessions, your usage records and every household you are the only member of, with everything in it. A household you share passes to another member, and what you added to it stays there for them.
If you no longer have the app, write to leafa@honeyside.it from the email address of your Leafa account (or tell us that address and the name on the account) and ask us to delete it. We delete it in the same way within 30 days and reply to confirm.
Why we may use it
To provide the service you signed up for (your account and inventory), and for our legitimate interest in keeping Leafa secure and knowing how much it is used (security and usage records).
Your rights
You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Write to leafa@honeyside.it. If you think we handle your data unlawfully, you can complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).
Children
Leafa isn’t directed at children under 14.
Changes
If this policy changes, we update this page and the date at the top.