Privacy Policy — English version. Last updated: July 31, 2026. Deutsche Fassung.

Privacy Policy — Leonality

Status: Published
Last updated: July 31, 2026
Version: 1.0
Language: English

This version is intended for end users and is written in clear, plain language.
The German version is available at https://leonality.com/de/privacy.html.

1. Data Controller and Contact

The data controller within the meaning of the GDPR is:

Kai Kluftinger
Sole proprietor
Im Großacker 4a
79249 Merzhausen
Germany

Contact:

• Email: info@leonality.com
• Imprint / legal notice: https://leonality.com/imprint.html

A data protection officer has not been appointed (no statutory appointment obligation).

Competent supervisory authority:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
Website: https://www.baden-wuerttemberg.datenschutz.de

2. Scope of this Privacy Policy

This Privacy Policy applies to:

• the Leonality app (iOS/Android),
• the website at leonality.com,
• communication with us by email.

Additional privacy notices of third-party providers (e.g. Apple App Store, Google Play, Apple/Google sign-in) apply in addition where you use those services.

3. What Personal Data Do We Process?

Depending on how you use Leonality, we may process in particular:

• account data (e.g. email address, login information, optional display name),
• app content (e.g. goals, tasks, journal and review texts, planning context),
• settings and usage preferences (including optional profile details for AI features),
• data for synchronization between devices,
• AI-related inputs and outputs,
• limited product analytics (without direct user identifiers in event records),
• voluntary error reports and feedback,
• data relating to optional marketing emails,
• Premium / purchase status and entitlement information,
• website access data (server logs).

We only process personal data that is necessary for the relevant feature or that you provide voluntarily.

California / CCPA–CPRA: We do not sell your personal data, nor do we share it with third parties for cross-context behavioral advertising.

4. Use With and Without an Account

You can use Leonality locally as a guest without a registered account. In that case, your app content (e.g. goals, journal) is stored only on the device; cloud sync, account-based AI, and marketing emails are not available. Limited product analytics without a user ID may still be sent to us for stability measurement (see “Product Analytics”).

A registered account is required for cloud synchronization, AI features, and account-related management.

Available sign-in methods:

• email and password,
• Sign in with Apple,
• Sign in with Google.

Account-related functions include in particular sign-out, password reset, and account deletion via in-app self-service (Account & Login → Delete account).

Providing your data is neither legally nor contractually mandatory. Without providing account data, however, you cannot use cloud-based features, device synchronization, or server-side AI services.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / steps prior to entering into a contract), and where applicable Art. 6(1)(f) GDPR (security / error prevention).

5. App Content, Local Storage, and Cloud Sync

Leonality works offline-capable. Data may be stored locally on your device. If you use an account and sync is active, relevant data is also stored in the cloud (Supabase, region Central EU / Frankfurt) so you can switch devices and use Leonality on multiple devices.

This includes in particular:

• goals, sub-goals, and tasks (charts),
• journal and daily review entries,
• preferences and app settings,
• planning and context information,
• AI / coaching results stored in the app.

When using multiple devices or editing offline, sync conflicts may occur. In that case, the most recently updated version generally prevails.

Legal basis: Art. 6(1)(b) GDPR.

6. AI Features

Leonality offers AI-assisted features for planning, structuring, and reflection. When you actively trigger an AI feature, selected content may be transmitted via our server infrastructure to the AI provider — e.g. goal/task context, journal or review texts, and optional profile details you have stored.

Please note that you decide under your own responsibility what information you enter in free-text fields. We ask you not to enter unnecessarily sensitive personal data (such as health data).

Important:

• AI responses are automatically generated suggestions.
• AI responses may be inaccurate or incomplete.
• Leonality is not a medical, psychological, psychiatric, or other emergency / advisory service.
• No automated decisions producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR take place.

Transparency under the EU AI Act (Regulation (EU) 2024/1689): We hereby inform you that when you use our AI features, you interact with an artificial intelligence (AI) system. Suggestions and texts are generated automatically. You retain full control at all times over accepting, editing, or deleting this content. The app also informs you through a first-use notice, labels, and hints next to AI actions (Art. 50(1) and (5) AI Act).

Legal bases:

• Art. 6(1)(b) GDPR for AI features you request,
• where applicable Art. 6(1)(f) GDPR for operational security, abuse prevention, and cost control.

AI provider / recipient: Mistral AI — DPA, data storage, subprocessors

7. Product Analytics

We collect limited statistical usage data to improve stability and product quality (e.g. app opens and use of certain features based on predefined event names).

In analytics event records we store no user ID, no email address, and no app content. The data is not used to create individual personality profiles.

To avoid double counting, timestamps of individual events may be stored temporarily on your device to a limited extent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improvement and operational security).

Right to object: You may object to this processing at any time (see “Your Rights”, Art. 21 GDPR).

8. Error Reports and Feedback

You may voluntarily send error reports and feedback. Depending on the report, the following data may be processed:

• your message,
• technical context for troubleshooting (e.g. app version, platform, screen context),
• account reference (user_id) so we can follow up or reproduce issues.

Legal bases:

• Art. 6(1)(b) GDPR (handling your request),
• Art. 6(1)(f) GDPR (troubleshooting / quality assurance).

9. Marketing and Product Emails (Optional)

If you expressly consent, we may occasionally send you product and marketing emails.

The process uses double opt-in:

1. consent in the app,
2. confirmation via email link,
3. sending only after confirmation.

You can unsubscribe at any time (unsubscribe link in emails, app settings, or contact info@leonality.com).

Legal basis: Art. 6(1)(a) GDPR (consent).
You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Email delivery provider (marketing / DOI): Resend, Inc. — DPA

10. Premium, Purchases, and App Stores

Premium features may be unlocked via in-app purchases or subscriptions. Payment is processed through the Apple App Store or Google Play. We generally do not receive full payment data (e.g. full credit card numbers), but mainly status and transaction information as needed for unlocking, support, and abuse prevention.

To manage subscriptions and entitlements we use RevenueCat, Inc. (USA). RevenueCat processes, among other things, app user IDs, purchase/subscription status, and device-related purchase information on our behalf.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

For transfers to the USA: Where providers are certified under the EU–U.S. Data Privacy Framework (DPF), the European Commission’s adequacy decision serves as the basis for the third-country transfer. In addition or alternatively, we use the EU Standard Contractual Clauses (SCCs) via the respective provider DPAs.

Store and purchase processors:

• Apple App Store / Google Play (payment, store account),
• RevenueCat — DPA (incorporated into the terms of use).

11. Local Notifications

Leonality may show local reminders on your device (e.g. daily or weekly prompts). These notifications are managed on-device; no third-party push service is used for reminders.

You can adjust or disable notifications in the app or in your operating system settings.

Legal basis: Art. 6(1)(b) GDPR (feature use), and where applicable Art. 6(1)(a) GDPR when device permission is expressly granted.

12. Website, Server Logs, and Cookies

When you visit the website, technical access data (e.g. IP address, time, page requested, browser information) may be processed in server logs.

Cookies and similar technologies: The website does not set tracking, advertising, or analytics cookies and does not use non-essential storage access within the meaning of Germany’s TDDDG (Telecommunications Digital Services Data Protection Act; formerly TTDSG). Fonts and stylesheets are self-hosted (no request to Google Fonts or an external CSS CDN when the page loads). A cookie banner for marketing tracking is therefore not required.

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation of the website).

Website hosting: Vercel Inc. (USA / EU CDN) — DPA (auto-incorporated with account)
Email sending (marketing, internal operational notifications): Resend, Inc. — DPA
Email mailbox (receiving info@): Zoho Mail (Zoho Corporation) — DPA

13. Recipients, Processors, and International Transfers

To provide Leonality we use service providers, in particular for:

• hosting / backend and authentication,
• AI processing,
• email sending and receiving mailboxes,
• purchase / subscription management (Premium),
• website hosting.

Where processors outside the EU/EEA are involved or access from third countries is possible, we ensure appropriate safeguards. Where providers in the USA are certified under the EU–U.S. Data Privacy Framework (DPF), the European Commission’s adequacy decision serves as the basis for the third-country transfer. In addition or alternatively, we use the EU Standard Contractual Clauses (SCCs).

Current processor overview:

14. Retention and Deletion

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations (Art. 5(1)(e) GDPR).

Important distinctions:

• Export: In Settings you can export available data (e.g. charts and selected content). The export does not necessarily include every data type.
• Device reset: A local reset removes app data on that device; cloud data remains as long as the account exists.
• Account deletion: Deletes the cloud account and related cloud data within technical and legal limits. An active store subscription is not cancelled automatically. You may need to reset local data or uninstall the app separately. Backup residual periods remain reserved.

15. Your Rights (Data Subject Rights)

Under the GDPR you have in particular the following rights:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on legitimate interests (Art. 21 GDPR),
• withdrawal of consent (Art. 7(3) GDPR),
• complaint with a supervisory authority (Art. 77 GDPR).

Special notice on the right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interests) — for example product analytics or website server logs. If you object, we will no longer process the personal data concerned unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Contact for all data subject rights: info@leonality.com

16. Children and Minimum Age

Leonality is not directed at children. The minimum age for use is 16 years.

Users under 16 may use Leonality only with parental or guardian consent. App Store age ratings (Apple / Google) may apply in addition.

17. Data Security

We implement appropriate technical and organizational measures to protect personal data (e.g. access controls, transport encryption, role-based permissions, data minimization).

Despite these measures, no data processing can guarantee absolute security.

18. Changes to this Privacy Policy

We may update this Privacy Policy if features, legal requirements, processors, or processing activities change.

The current version will be made available in the app and/or on the website.