Privacy

Noetic Leap keeps two things: what you write down, and what you confirm about it. This page says where those go, who else handles them, and how to have them removed.

Updated 14 October 2026

What you hand us

Sign-in asks for one thing — an email address. Everything else is optional and written by you.

• The address. Used to sign you in and to send what you asked for. You can also start as a guest, which leaves us with nothing but a token.
• How you want to be known. Nickname, country, gender, the year you were born. There is no picture upload anywhere in this product: the mark on your account is a colour you pick and your initials, kept as text.
• Your entries. What you write is kept exactly as written, because every line of a result has to be traceable back to a sentence you actually typed. That is the point of the archive, not a side effect of it.
• Payment records. Your balance, what each reading used, orders, refunds, subscription state, and the customer reference our payment provider issues.

What we build from it

A reading comes back with several versions of what your situation might mean, and you mark each one — accurate, partly right, not right, or missing something. What stays after that is your decision, not ours.

• The readings, including the ones you rejected. A rejected reading is a record of having been misread, and deleting it would flatter the next one.
• Every wording you corrected, kept as a pair: what it said, what you changed it to, and when.
• Only what you confirm enters your archive. Nothing joins it by default.
• From what you confirm: themes, patterns, and a slow picture of how your judgement moves. Each of those carries the lines it came from, and each can be withdrawn.

What we do not take

• No card number. The payment provider holds that and sends us the fact that a charge succeeded.
• No password. Sign-in is a six-digit code that is gone after one use, or after 10 minutes, whichever comes first.
• No advertising trackers, no third-party analytics, nothing that follows you to another site. On your device the app keeps two things only: your sign-in token and the entry you are still writing.
• None of your sentences appear in our billing records. Those records show which step of a reading happened and how much text went in and came out — enough to bill honestly and to trace a failure — and nothing you wrote.

Who else touches your words

A reading needs more than this one server. Each party below sees part of it, and none of them sees everything. They are named by the address they answer at, read from how this deployment is configured — so the list moves when a supplier does, instead of staying politely vague.

• Drafting the readings. The words of the entry you submit go to the service at ws-7q15zpdz3phfgyff.cn-beijing.maas.aliyuncs.com, which drafts the readings and sends them back. We do not use your entries to train anything and we do not sell them. What that provider keeps on its side is governed by its own terms; ask us and we will tell you what we know.
• Matching your archive. A reading also looks for the older entries that resemble this one, and that comparison runs on numbers rather than sentences. The same service above makes those numbers, under a separate account and key of ours; the numbers are stored here, in your archive.
• Payments. Stripe sells on our behalf as merchant of record: they invoice you, take the card details, handle the tax, and pass us the result. On that part they are a separate controller with their own privacy notice.
• Mail. The service at smtp-relay.brevo.com sends your sign-in code and any reminders you have switched on. It sees the address and the message, and nothing else.
• Where it lives. Your entries, readings and account sit on one server we rent — Oregon, United States. It may be in a different country from yours, and the service above may sit in a third. That is not made lawful by you reading this page: the transfer happens because the work you asked for cannot be done without it, and it carries the least it can. Ask us at the address at the foot of this page and we will tell you, for each party, where the data goes and on what basis.

How long things stay

• A sign-in code: 10 minutes, or until it is used.
• A signed-in device: 30 days, then it asks again.
• What each reading cost: 180 days, then only the totals remain.
• Your entries, readings and archive: until you delete them. Nothing you wrote expires on its own.
• After you close the account: everything is gone within 30 days, and signing in during that window cancels the deletion.

The switches that are yours

Settings has four privacy switches, and each one changes what we do rather than what you merely see:

• Save entries — off means a reading is shown and then forgotten; nothing is written to your archive.
• Confirm before saving — nothing enters the archive until you say so, which is how it works by default.
• Link across entries — off stops the app drawing lines between separate occasions, so patterns stop accumulating.
• Reminders — off until you turn it on, and it only ever mails you about a thread you left open.

Taking a copy, and deleting it

One export gives you the whole of it as a readable file: your profile and settings, every entry as typed, every reading with your verdict, your corrections, the archive, the patterns and the lines behind them, the history of how your answers moved, your notices, and everything you have paid. Anything a later version of this app begins storing comes with it, because the export is built from what the service actually holds rather than from a list that can forget something.

Closing the account offers that export first, then waits 30 days before removing anything, so a decision made badly can be undone by signing back in. Deletion works the same way: everything that points at you is removed, along with your sessions and any unused codes for your address. Two things survive it — the record that your deletion happened, and the security records about your account, both kept with your identity stripped out so the aggregate safety numbers stay true without naming you.

Your rights, in plain terms

We are the controller of what you submit; Noetic Leap runs this service. Whatever country you are in, these are ours to honour: to show you what we hold, to correct it, to erase it, to hand it to you in a usable form, and to stop a specific use of it. The export and the archive screens do most of that without asking anyone. If you think we have got it wrong, write to the address at the foot of this page. You can also complain to your local data protection authority, and we would rather hear it first.

Keeping it safe

The connection is encrypted end to end, sign-in tokens are per device and expire, codes are single-use, and where guessing would pay we limit how often anyone can try. Nothing is unbreakable, so the two things actually worth doing are yours: sign out on a device that is not yours — signing out releases only that device — and close the account properly if you are leaving for good.

Children

This is written for adults working through their own situations, and it is not for anyone under 16. That floor is stated rather than checked: the birth year is a field you may leave empty, and a guest session never asks for one. We do not knowingly hold a child's entries; if one turns up, tell us and it is deleted without argument.

If this changes

A change that matters to you is posted here with a new date, and we say so in the app and by email before it takes effect. Read with this page: Terms of use and Refunds.

Anything here to ask about: localpartners@tutanota.com.