Built so only you can read what's private.

1. Where we are

Leave is on the App Store for iPhone (since October 19, 2026) and on Google Play for Android (since October 24, 2026). Right now:

• LIVE Anyone 18 or older can create an account in the iPhone app; an athlete aged 13 to 17 joins through an account a parent or guardian creates.
• LIVE What Leave holds about you is listed in the Privacy Policy: your account details, devices and consents, your plan, your public record, and your strands, contracts and files, which are stored encrypted. The Android email list holds only email addresses and the details the Privacy Policy lists.

In the iPhone app today:

• LIVE Sign-in with a six-digit emailed code. There's no password anywhere.
• LIVE The age gate: no one under 13, and athletes aged 13 to 17 only through a parent or guardian.
• LIVE Delete my account, in the app, with a typed confirmation.
• LIVE No analytics SDK, no advertising SDK, no advertising identifier, and no access to your location or contacts. The permission prompts are camera, photos, microphone, speech recognition, Face ID (or the Android equivalent) and notifications, each with a plain reason.

Each item below is marked with what is true today. When an item changes, we change its label and log it in the changelog.

2. The promise, and its limits

Leave is designed so your private details, your contracts, and your files are encrypted with a key only you hold, and stored copies can't be read by anyone at Leave, at Google, at our AI provider, or at any vendor. This is LIVE. While Leave works on something you ask for, your phone lends Leave's servers the keys that work needs, in memory; section 3 says how.

Here's what that promise doesn't cover, stated up front:

• While you're using Leave, the records you're working with are readable in our server's memory and in the AI model for the moment it takes to answer you. There's no way to explain a contract without reading it. Leave is built so nothing from that moment is written to its logs.
• Your AI chat keeps its own history under that provider's terms. Anything you type or say in ChatGPT, Claude, or Gemini stays in that chat, whatever Leave does. Athletes under 18 never share private data with an AI chat.
• Leave can see account metadata, which its database and graph database keep in plaintext:
  • Who you are: your name, email address, role and time zone, an athlete's date of birth, and your public record (display name, sport, position, team, school, class year, place, level, height, stats, follower counts, deals listed, and where each came from).
  • Your links: the names and email addresses of a linked Teammate, parent or guardian, or athletes, the invites you sent or received, and whether each link is active.
  • Your contracts: how many you have, the brand named on each (with its logo and colors), how many clauses Leave flagged, the exclusivity end date, whether it is an offer, file types and sizes, and the other dates reminders go from: payment dates and whether each was paid, deliverable due dates, when a contract ends, its notice days, whether it renews on its own, the signing date, the day a disclosure window ends and which rule it comes from, and the day you marked a deal reported.
  • Your Web: how many strands you have and where each came from (the app, Talk or an AI app), which public item (a brand post, a casting call, a news story) each Web thread links to and which of your strands it came from, and when your Web runs happened.
  • Your use of Leave: your plan, trial, credits and billing settings, the purchase notices Apple, Google and Stripe send us, how much you have used and what each use cost us, which contract a Talk turn was about, which AI apps you have connected and when they were last used, the consents you gave and when, a log of account actions (such as a phone added or a link ended), and your thumbs up or down on a reply.
  • Technical details: your phones' names, models and app versions and when each was last seen, and technical identifiers for sign-in sessions, notifications and store purchases.
  Never a contract's amounts or its clauses, and never the words of a strand, a Web thread or a Talk conversation. Support works from that alone. What we keep after an account is deleted is listed in the Privacy Policy.
• Lose every device and your recovery code, and your private data is gone. Nobody can recover it, including us. That's the point.
• Support can't "take a look" at a contract or anything you told Leave privately. They can see that a contract exists and its size.
• Your public record is public. Stats, rosters, and announced deals aren't encrypted, because they aren't secret.

3. How your key works LIVE

Every private item, whether a strand you told Leave, a contract's text, or a file, is encrypted with its own key. That key is locked twice, and both locks are needed to open it:

When you open the app, it unlocks only the items your session needs and hands our server those item keys for at most 15 minutes. The server can read what you're using now, never your whole account. A full copy of our database and backups can't read a single strand without your share. One gap, being fixed: when work goes on after you ask (reading a contract, a Web run, a Talk reply that opens one contract or thread), the keys that work needs are stored for that time, sealed to our cloud key, in our task queue or database, and copies can remain in the database's recovery logs for up to 7 days. Someone who also held our cloud key could open those copies.

LIVE Talk conversations stay on your phone, in a store of their own, encrypted with the same key as everything else Leave keeps there, and kept out of backups. Leave's servers read each message to answer it and don't keep it. Signing out deletes the store.

• New phone? It gets no private data until a phone you already use approves it, or you enter your recovery code. Every new sign-in notifies your devices.
• LATER Your Talent Teammate is told about a new sign-in too.
• Destructive actions (delete, export, changing your Teammate) need Face ID (or, on Android, your fingerprint, face or screen lock) on a device that already holds your share. Each of these confirmations is signed by the phone and accepted once: since October 30, 2026, a copy of one can't be used again. LIVE
• Screenshots. Private screens are kept out of screenshots and recordings: on Android with Android's own setting, on iPhone with a cover that makes them come out black.
• LIVE Deleting without your key. A phone that does not hold your key can only ask for deletion, after a code sent to the account's email. The request waits 7 days, every approved phone and the account's email are told, and using Leave on an approved phone cancels it. For an athlete aged 13 to 17 the parent or guardian is told and can cancel it. An account with no approved phone at all is deleted with the emailed code alone.
• LATER Rotate and revoke your key, in Profile. Deleting your account today deletes your records and their keys on Leave's servers; a separate Revoke that makes everything unreadable while you keep the account is a later version.

4. Who can see what

"No" means the design keeps stored data unreadable without your key, so Leave cannot read it; it isn't just against the rules. While you're using Leave, the server holds only the keys for what you're using, for at most 15 minutes. For work that continues after you ask for it (reading a contract, a Web run), your phone's grant travels with the queued job still sealed, is opened only by the server instance that does the work, and expires on Leave's servers 15 minutes after your phone made it. If we're ever legally compelled to hand over data, we can only hand over what we can read, and we'll report the request in our transparency report. Athletes aged 13 to 17 can't unlock private data for any AI chat.

5. AI

• LIVE Models: Gemini 4 Argon and Gemini 3.8 Flash, both by Google, running in Google Cloud (Vertex AI). No other AI company runs Leave's models. A scanned page you choose to send is read by Google Cloud's Document AI. Leave's search of the public web for opportunities uses Google Search through the same Google Cloud service. A search carries your market, your sport and up to three short topics Leave's AI writes from your strands, each checked before it is sent to hold no name, school or team; a strand itself is never sent. When you ask Talk about something on the open web, the same check runs on one short topic written from your question, and the answer is kept only in your conversation on your phone. What a live search finds is shown only to you, not to a Teammate or an AI assistant, and is kept for at most two years.
• LIVE Retention by Google: Google Cloud's automated checks look for abuse of its AI services. If a check flags a prompt, Google may keep that prompt and its answer for up to 90 days, solely to check for abuse, and a person may then look at it. Prompts that aren't flagged aren't kept for this, as the Privacy Policy says. We asked Google to waive this for Leave and Google declined, so Leave is not zero-retention. Live web searches may be kept by Google for up to 3 days to fix problems, without being linked to you or to Leave. Google Cloud's prompt caching, which can keep the start of a request for up to 24 hours to answer repeats faster, is turned off for Leave.
• LIVE No training: your data is never used to train or fine-tune any AI model, by us or by our providers.
• LIVE Speech and documents start on your phone. Voice is transcribed on the device; Talk sends text, never audio. A contract is read on the device where possible and uploaded encrypted. To explain it, Leave's servers open it in memory, with the key your phone lends for that work, and send its text to Google's model; a scan goes to Google's text recognition only after the app asks you.

6. Vendors

Every company that touches Leave data, and exactly what it gets:

LIVE Crash reports go to Leave's own servers, never to a crash-reporting company. A report is numbers and fixed values: where in the code an error happened, the app build, and on iPhone the iOS version and the phone model. It covers errors in Leave's own app code; a crash in the phone's system code isn't reported. It has no field that can hold text, and a switch in Profile turns it off. What the app saves on the phone is encrypted with a key in this phone's Keychain; the one exception is the crash-report queue, which holds only code locations and build numbers.

No advertising companies, no data brokers, no Google Analytics. We'll update this list before any vendor changes, and log it below.

7. Your controls

8. Infrastructure

How the servers are locked down:

• LIVE Stored data stays in the US. An organization-wide policy blocks creating anything outside US locations. AI requests go to Google's global endpoint (see Vendors).
• LIVE No keys to leak. Service-account keys are banned by policy; deploys authenticate without stored secrets.
• LIVE Only reviewed code runs. Every server image is signed by the build pipeline, and Google refuses to run anything unsigned. The deploy policy is described in the public design documents.
• LIVE Logs even the founder can't erase. They go to a separate storage bucket with a locked 400-day retention: nobody, including the account owner, can shorten it or delete them.
• LATER Google access logged and needing our approval (Access Transparency and Access Approval). Not on yet; it needs a Google Cloud support plan Leave doesn't have.
• LIVE Private database, private network. The database has no public address. The knowledge graph runs on a confidential VM inside the private network.
• LIVE Rate limits at the edge and per account. A web application firewall limits every public endpoint by connection, and each account has its own limits. App attestation is being switched on step by step: for now it reports rather than blocks. Every account action still needs a signed-in session, and private data needs a key on the athlete's phone. Flood alerts reach the team by SMS. The website limits how often one address can open its store links and a few other busy pages in a short time, and the team gets an email if Cloudflare sees an attack on the site.
• LIVE Nothing private in logs. Request bodies, transcripts and strand text are kept out of logging, and no personal data goes in URLs. IP addresses are logged and kept 30 days, for security.

9. Athletes under 18

• LIVE Nobody under 13. The app refuses a birth date under 13.
• LIVE Athletes aged 13 to 17 use Leave through an account a parent or legal guardian creates, and that adult is their required Talent Teammate.
• LIVE No AI chat can read a minor's private data. The server refuses it.
• LIVE No profiles of people who haven't signed up. Leave looks up your public record when you create an account, never before. What Leave keeps about someone without an account is only what an account holder gives it: an invite's email address and first name, and the name of the other side of a contract.
• LIVE Leave never looks up a public record for an athlete under 18. The athlete enters it, and the parent or guardian can read it.
• LIVE Age checks keep only what they need. An athlete's date of birth is kept while the account is open, to apply the 13 and 18 rules, and is used for nothing else. A parent's, guardian's or Talent Teammate's is checked once for 18 or older and not kept.
• LATER Leave for Brands, when it opens, shows an athlete aged 13 to 17 only when a parent or guardian turned on "Open to brands" and the state allows high school NIL. Payouts go to the parent or guardian's Stripe account. Nobody under 13 ever appears.

10. This website, today LIVE

• HTTPS only, with HSTS, a strict Content Security Policy, and no framing by other sites.
• No cookies. Visits are counted with Cloudflare Web Analytics, which sets no cookies and doesn't follow you around the web. Fonts are served from this site.
• The waitlist record never stores your IP address. It's used for a few minutes to limit sign-ups from one connection, then dropped.
• DNSSEC signs the domain's DNS records, so nobody can forge them.
• CAA records allow only named certificate authorities to issue certificates for the domain.
• Email from leaveyouragent.com is signed (DKIM), and DMARC tells mail providers to quarantine anything forged in our name.

Known gaps we're closing

• DNSSEC is on and the domain is signed; the link that lets resolvers verify it (a DS record at the .com registry) is being published, which can take up to a day.
• DMARC is set to quarantine forged mail. After a week of clean reports it moves to reject it outright.
• The domain is submitted to the browsers' HSTS preload list and waiting to be included in a browser release.

You can check the headers yourself with securityheaders.com or SSL Labs.

11. Check it yourself

• LIVE The design documents are public: the architecture and security plan, the API contract, the AI chat (MCP) design, and the iOS app's security plan, at github.com/…/leave-security. Every change has a public history.
• LIVE Transparency report: as of October 24, 2026, Leave has received zero government or third-party requests for user data. We'll publish a report twice a year.
• LIVE The encryption code on your phone is open source at github.com/LeaveYourAgent/leave-crypto (Apache-2.0): the iPhone and Android code that makes and holds your key share, encrypts your records and lends keys to the server, with the test vectors both apps and the server are held to. It is a copy of those files from the apps; a store download can't be rebuilt byte for byte from it, but the code can be checked against the vectors and this page.
• LIVE A security review and testing plan is in progress (started October 24, 2026). Its findings and fixes are logged here as they land.
• LATER Independent penetration test after funding, then yearly, with the findings and fixes published here. There hasn't been one yet.
• LATER Bug bounty after the first penetration test.
• LATER SOC 2 after funding: Type 1 first, then Type 2, ahead of Leave for Teams and Leave for Brands. No audit has started.

12. Report a vulnerability

If you find a security problem in Leave, email security@leaveyouragent.com. The full policy, what is in scope and what you can expect, is at /security/disclosure. Good-faith research that follows it is authorized, and we won't pursue legal action over it. Machine-readable contact details are at /.well-known/security.txt.

Security at Leave is led by Christopher Ian Horne, founder and Chief Technology Officer of Leave Your Agent Inc. Reports come to him directly. People who reported a problem are thanked, with their permission, at /security/thanks.

13. Changelog

Questions about anything on this page: chris@leaveyouragent.com. Leave is software. It is not an athlete agent and does not negotiate, represent or arrange deals. It organizes public information and explains terms. Not legal, tax or financial advice.