Privacy Policy

Last updated October 26, 2026

This policy explains what personal data LeapSteps collects, why we collect it, who processes it for us, how long we keep it, and the choices you have. It covers the LeapSteps apps for iPhone, iPad, Android, Mac and Windows, and this website, leapsteps.ai.

LeapSteps is provided by ZestRoot Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office at 861-5307 Victoria Drive, Vancouver, BC V5P 3V6, Canada ("we", "us"). We are the controller of the personal data described here.

1. The short version

• We collect what we need to run your account and keep your goals and tasks in sync.
• We don't sell your personal data, and we don't show ads. The app and this website contain no advertising and no third-party analytics trackers.
• When you use an AI feature, the text or recording needed for that request is sent to AI providers to produce the result.
• If you connect an AI assistant to your account, it can read and change your tasks, goal steps and Do timer, but only after you allow it on our website, and you can disconnect it at any time. It can archive or delete tasks only after you confirm in the app.
• You can delete your account in the app at any time: open Settings and choose Delete account. Our account deletion page explains how to ask by email instead, and what we keep afterwards.

2. What we collect

Account information

Your email address and name, and a password if you sign up with email. Passwords are stored by our sign-in provider as a one-way hash, so no one can read them. If you sign in with Apple, Google or Microsoft, we receive your name, email address and, if the provider shares it, a link to your profile photo. If you use Apple's Hide My Email, we receive the relay address instead of your own. We also record your plan (Free or Pro), your trial dates, and when you accepted our Terms of Use.

Your content

What you create in LeapSteps: goals and their long-term, mid-term and short-term steps and notes; tasks, subtasks, comments, lists, labels, due dates, reminders and repeat settings; and projects and their objectives.

Teams and invitations

When you invite someone, we store their email address and send them an invitation email that includes your name and the project's name. When they join, you and they can see each other's name and email address.

Voice recordings

When you use voice capture, the app records your voice and sends the recording to our servers to be turned into text and then into tasks. We don't keep the recording after it has been transcribed. The app keeps a temporary copy on your device.

AI assistants you connect

When you connect an AI assistant from another company to LeapSteps, we store which assistant it is (the name it gave itself and an identifier), when you allowed it, and which of your devices its changes go to. Tasks it is working on show its name, and we note which tasks it finished. When it asks to archive or delete tasks, we store the request: which tasks, which assistant, and your answer. We also count the changes and requests it makes, to apply daily limits.

Device and usage information

• A random identifier the app creates when it's installed. We use it to keep the Free plan on one device and to prevent repeat free trials. It isn't an advertising identifier.
• Your device's platform, such as iOS or Windows.
• Records of how you use features: when the app opens, sign-ins, uses of AI and voice features, invitations sent, tasks assigned, the steps you take when you first set up the app, and which version of a screen you saw when we compare two versions. We use them to apply daily usage limits, to understand which features are used, and to learn what helps people reach their goals.
• How you found LeapSteps: your answer, if you give one, to "How did you hear about LeapSteps?" when you first set up the app, including any words you add when you choose Other. On Android and Windows, also the site or campaign name that the app store passes to the app when you install it. We use them to learn which channels bring people to LeapSteps, and they're deleted with your account.
• Your progress: XP, levels and achievements.
• Technical logs kept by our hosting providers, including IP addresses, to run and protect the service.

Purchases

If you subscribe to Pro, we receive your subscription status, the product you chose, and the dates of purchases, renewals and cancellations from Apple, Google or RevenueCat. We never receive your card number or other payment details: Apple, Google or Stripe handle payment.

Support messages

What you write to us. Feedback sent from the app also includes your app version, operating system version, language and plan, so we can find the problem. It reaches our support inbox by email, with your sign-in address so we can reply. If you report something another user shared with you, the report includes that content and their name.

The waitlist on this website

If you ask us to email you when LeapSteps is out on a device, we store your email address, the devices you chose, the date you asked and which version of the waitlist promise you agreed to.

Visits to this website

To learn which version of a page works better and how well the site works for visitors, this website counts page views, openings of the waitlist form, sign-ups and clicks on store links. On our free tools it also counts presses of the Print button, pictures added to a vision board and focus sessions started on the timer, only that they happened: what you type, the pictures you choose and your timer settings never leave your browser. With each count it sends the page, which version of it you saw, the device a button was for, and the site or campaign link that brought you here (only its domain or campaign name). Our server adds the kind of device you're using, such as a Windows computer or an Android phone, which it reads from the standard information your browser sends, and the country your connection comes from, which our host Cloudflare works out from your IP address. We don't keep your IP address.

When you tap a button to get the app, the link to the app store carries the domain or campaign name that brought you here, and nothing that identifies you. It shows us which sites and campaigns lead people to the app.

The site also measures how quickly each page loads and responds. It sends only whether each measure was good, needs improvement or poor.

To count how many different people visit each day, our server turns your IP address and browser type into a scrambled code that changes every day. It keeps only that code, which can't be turned back into your IP address, and deletes it after the day ends (UTC), so a visit can't be linked to visits on other days.

Apart from those codes, which last no more than a day, we keep only daily totals. They contain nothing that identifies you, and nothing about the counts is stored on your device.

What we don't collect

We don't collect your location (beyond the country of a website visit, described above), contacts, photos or calendar, and we don't use advertising identifiers.

3. How we use it

If you're in the European Economic Area or the United Kingdom, the law requires a legal basis for each use. The table shows ours.

We don't use your content to train AI models, and we don't make decisions with legal or similarly significant effects about you by automated means.

4. AI features

These features send the following to AI providers when you use them:

• Goal drafting: the goal you describe and the details you add.
• Task ideas: your goals, the titles of your recent tasks and any instruction you add. For a project, also its objectives and recently finished tasks.
• Subtasks: the task's title, its existing subtasks and any instruction you add.
• Voice capture: your recording, and then its transcript.

We send these requests through OpenRouter, which passes each one to a company that hosts the AI model we use. For goal drafting, task ideas and subtasks, OpenAI also checks the request and the result for harmful content.

You decide whether to share. AI features send nothing until you allow it. Before your first AI request, the app asks whether to share this data with AI. It names what is sent (the goal you describe, your task titles and notes, or your voice recording) and who receives it (OpenRouter, the companies that host our AI models, and OpenAI, which checks for harmful content). Content is sent only after you tap Allow, and we record on your account when you did. You can turn sharing off at any time in Settings > AI features. Once it's off, the app makes no new AI requests, and it asks again the next time you use an AI feature.

The providers we use don't train AI models on your requests. They may keep a request for a short time to run their service and prevent abuse.

We don't store your AI requests or their results, except what you choose to keep, such as tasks you accept. If a voice recording produces no tasks, our server log may keep a short excerpt of the transcript to help us fix the problem. Logs are deleted after 7 days.

AI output can be wrong. The Terms of Use explain how to use it.

AI assistants you connect. You can connect an AI assistant from another company to your LeapSteps account. Nothing is shared until you sign in on leapsteps.ai and choose Allow on the page that names the assistant. After that, it can read your tasks (with their subtasks and comments), your goals and goal steps, and your Do timer, and change them: add and edit tasks, complete tasks and goal steps, add comments, and start or stop the timer. It can also ask to archive or delete tasks, but nothing is archived or deleted until you confirm in the LeapSteps app.

We send an assistant only what it asks for while you use it, in answer to the requests it makes for you. LeapSteps never sends it anything on its own. What it receives is handled by that company under its own privacy policy, not ours, so check its settings for how it keeps your conversations.

To disconnect an assistant, open Settings and choose Connected AI apps, then Revoke. It can't reach your account through LeapSteps after that, and any access it was already given expires within an hour.

5. Who we share it with

We don't sell your personal data or share it for targeted advertising. We share it only as described here.

Service providers

These companies process personal data for us, under contracts that limit them to providing their service:

Apple, Google and Microsoft

If you sign in with them or buy through their stores, they process your data under their own privacy policies.

Other LeapSteps users

Teammates see your name and email address. People in a project you share see the project, its tasks and their comments, and people you assign a task to can see that task. When you share a progress poster, it goes only where you send it.

AI assistants you connect

An assistant you connect receives the content it reads for you. It acts for you, not for us, so it isn't one of our service providers, and its own privacy policy applies.

Legal reasons and business changes

We may disclose data when the law requires it, or to protect the rights and safety of our users or others. If LeapSteps is merged or sold, your data may transfer to the new owner, who must follow this policy or tell you first.

6. Where your data is processed

Our main database is in the United States, and our providers may process data in other countries. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

If you're in Canada: your personal information is stored and processed outside Canada, including in the United States. While it's there, courts, law enforcement and national security authorities of that country may be able to access it under their laws.

7. How long we keep it

• Your account and content: while you have an account. Items you delete disappear from all your devices. We keep them on our servers, marked as deleted, so the deletion reaches every device, and erase them when you delete your account.
• AI assistants you connect: the record of which assistant you connected and the device it uses is kept until you delete your account; after you revoke an assistant we keep only when you revoked it. The name on tasks it worked on or finished stays with those tasks. Its requests to archive or delete tasks are kept until you delete your account; they hold no task titles. The counts of its changes and requests are kept like the app's other usage records.
• When you delete your account: we erase your account and content from our database right away, then email you a confirmation. Copies in our backups are overwritten within 7 days.
• What we keep after you delete your account:
  • A record that a free trial was used: the device identifier and a one-way hash of your email address, so the same person can't start repeat trials. Kept for 3 years after the trial.
  • Purchase records, as long as tax and accounting law requires, which in Canada is 6 years after the end of the tax year they relate to.
  • Content that belongs to other users: if you answered someone's invitation, your name and email stay in their invitation records, and comments you wrote on their tasks stay without your name.
  • The confirmation email we send when you delete your account: our email provider keeps a record of it, with your address, the time and whether it was delivered, for 30 days.
• Data on your devices: deleting your account doesn't erase what the app stored on your devices. Uninstall the app to remove it.
• Invitations: expire after 14 days, and we keep the record with the inviting account.
• The waitlist: we delete your request for a device once we've emailed you that LeapSteps is out on it, or sooner if you ask.
• Scrambled visitor IDs on this website: deleted after the day ends (UTC).
• Support messages: for 2 years.
• Technical logs: for 7 days.

8. Your rights and choices

In the app

• Edit or delete your goals, tasks and other content at any time.
• Stop sharing data with AI: open Settings and, under AI features, turn off Share data with AI. The app then makes no new AI requests until you allow it again.
• Disconnect an AI assistant: open Settings and choose Connected AI apps, then Revoke.
• Delete your account: open Settings and choose Delete account. Our account deletion page explains how to ask by email instead, and what we keep afterwards.
• Turn off microphone and notification access in your device's settings. Voice capture and reminders need them; the rest of the app works without them.

By email

Email support@leapsteps.ai from the address you sign in with to:

• get a copy of your personal data, in a portable format;
• correct data you can't change in the app;
• delete your data, or leave the waitlist;
• object to, or ask us to restrict, how we use your data;
• withdraw consent you've given.

We'll answer within one month and may ask you to confirm your identity first. Depending on where you live, these are legal rights, and you can also complain to your data protection authority.

Canada

We handle personal information under British Columbia's Personal Information Protection Act and Canada's Personal Information Protection and Electronic Documents Act. You can ask to see the personal information we hold about you, and to correct it. Our Privacy Officer is responsible for how we handle it; you can reach them at support@leapsteps.ai. If you're not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

California residents

You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights. We don't sell or share personal information as the California Consumer Privacy Act defines those terms, and we don't use sensitive personal information to infer characteristics about you. An authorized agent can make a request for you, with proof of your permission.

9. Cookies, tracking and storage on your device

This website sets no cookies and uses no advertising or third-party trackers. It stores only three things on your device: your choice of light or dark appearance, if you pick one; a note not to count your visits, if you ask for one; and, on the page where you connect an AI assistant, your sign-in, kept in that browser tab and gone when you close it. The appearance choice and the note stay in your browser and are never sent to us. It counts visits and measures page speed only as described in section 2. The app contains no advertising or third-party analytics tools.

The app stores your content, settings and its device identifier on your device, so it works offline and syncs when it can.

10. Security

Data is encrypted in transit between the app, our servers and our providers. Each account can read only its own data and what others have shared with it. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your data, we'll notify you and the authorities as the law requires.

11. Children

LeapSteps isn't meant for children under 13, or under the minimum age of digital consent where you live. We don't knowingly collect personal data from them. If you believe a child has given us personal data, email us and we'll delete it.

12. Changes to this policy

When we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.

13. Contact us

Email support@leapsteps.ai, or write to ZestRoot Inc., 861-5307 Victoria Drive, Vancouver, BC V5P 3V6, Canada.

LeapSteps isn't currently offered in the European Union, the European Economic Area or the United Kingdom.