Privacy

This page says what the Leaf instance at leaf.aligera.ai stores about you, where it keeps it, and who sees it. This Leaf is operated by Aligera. Its administrators decide who has an account. For anything on this page, contact Aligera.

What Leaf stores

• Your account: your name and email, and the id Google gives your Google account (its subject id) once you sign in with it. Your preferences, such as your time zone.
• What you and your agents write: the items, fields, comments and links in the spaces you belong to.
• The history of changes: every change to a space is recorded with who made it, through which agent, and when, so it can be shown and undone.
• Sessions and tokens: the sign-in session of your browser and the tokens of the agents you connect, stored only as hashes, never as the secrets themselves, with the names you give those connections.
• A security log of account actions: accounts created, tokens issued or revoked, account recovery.

The server's logs hold ids, routes, timings and errors, never what you write. To limit abuse, the server counts requests per IP address in memory for one minute; those counts are never stored.

Signing in with Google

Leaf asks Google only for the openid, email and profile scopes. From Google's answer it keeps your Google account's id, its verified email and your name, and nothing else. It keeps no Google token, so it cannot act in your Google account, and it never reads your mail, files, calendar, contacts or any other Google data.

AI agents

Leaf itself calls no AI model. When you connect an agent, such as Claude, it reads and writes only what that connection allows: the spaces you pick, read-only if you choose, and never more than you can see yourself. What the agent's provider does with what it reads is under that provider's terms.

Where your data lives

On this instance's server, in its own database. Every night the database is backed up, encrypted on the server before it leaves, with a key that is not kept on the server. The encrypted backups are stored with Backblaze B2 in its EU Central region. Each one is kept for 90 days and then deleted, and cannot be deleted by anyone during its first 30 days.

Before each update of Leaf, the server also takes a copy of the database. It stays on the server, readable only by whoever administers the server, until the next update succeeds.

Once a month an administrator restores the newest backup on their own computer to check that it can be restored, in a temporary database that is deleted when the check ends.

Who sees it

What is in a space is seen by the members of that space and by the agents they connect. Members of a space you share see your name and email, and the names of your agents that wrote there. The administrators who run the server can reach the database. Leaf does not sell your data or share it with anyone. It has no advertising, analytics or tracking. Google is involved only in signing you in, and Backblaze only holds the encrypted backups, which it cannot read.

Cookies

Only those needed to sign in: the session cookie, which keeps you signed in for up to 30 days, and, while a Google sign-in is under way, a cookie that lasts 10 minutes. No other cookies, and none from anyone else.

A copy of your data, and erasing it

• A copy: ask the administrators, who can export a whole space as plain JSON.
• Deleting in Leaf archives: items are archived, not deleted. An archived item is hidden, can be restored, and its history is kept.
• Erasing for good: ask the administrators. Leaf has no built-in erasure yet (a dedicated tool is planned), so today they do it by hand. Erased data leaves the backups as they expire, and the copy taken before an update when the next update succeeds.

For a copy, an erasure or any question, contact Aligera.