Privacy Policy

At Null and Canon, we believe the people you meet belong to you. We built Leadbox so your leads live on your iPhone, with no account to create, and so you decide what's read and when. This policy explains what information Leadbox uses, how we use it, and the choices you have.

The short version

• Your leads stay on your iPhone, encrypted, with no account.
• Reading with AI is your choice, and what's read is never used to train AI.
• We don't sell your information and we don't show ads.
• You can export or delete everything, anytime.

Who we are

Leadbox is made by Abubakr and Rahim, who make apps as Null and Canon. We're responsible for your information under this policy (its "controller", in the words of the GDPR). You can reach us anytime at support@leadbox.example.

Information we collect

Your leads, on your iPhone

The people you file, with their details, notes, card photos, voice recordings, follow-ups and messages, are stored on your iPhone in an encrypted database. They're yours alone: there's no account, and we keep no copy on our servers. They're included in your iPhone's backup (iCloud or your computer), so they come with you to a new iPhone, and a backup file or export you save goes only where you choose.

What you choose to have read

With your permission, Leadbox reads cards and notes for you with the help of a third-party AI provider. When reading is on, the app sends what it needs to read to our server, which passes it to the AI provider and returns the answer: card photos, text you share, voice notes, what you describe in Search, and the notes a suggested next step or a drafted message is written from (with your name and what you do, if you've added them, so a message can say who it's from). Our server keeps no copy of what it passes on. The AI provider uses it only to give the answer, never to train AI, and holds images and text for up to 30 days for abuse checks, with no audio kept. Reading starts only after you say yes, and you can turn it off anytime in Settings, What Leaves Your Phone.

Feedback on a draft

When you give a drafted message a thumbs down and choose what was wrong, the app shares that draft, the reason, and what the draft was written from, so we can make drafts better. It includes nothing that identifies you or your iPhone, and never your past messages or a recording. A thumbs up shares only a count.

Information that keeps the service running

Our server knows each install by a random identifier, and uses Apple's App Attest to confirm that requests come from the genuine app. Against that identifier it keeps counts of reads and their cost, to keep each plan within its limits and the service free of abuse, and a log of each request (when, which feature, how long it took, and whether it worked) with the identifier scrambled. Request logs record how the service is working, never the content of a card, note, recording or message.

Purchases

Apple handles payment, so your card and Apple Account details stay with Apple. A subscription service receives the purchase record from Apple, with an anonymous identifier for your install, to tell the app which plan you have.

Usage and diagnostics

• Crash reports. When something goes wrong, a crash-reporting service receives what failed, the app and iOS versions and the iPhone model, without your leads, what was read, or your IP address.
• Usage. A product analytics service receives what happens in the app (a card scanned, a lead filed, a screen opened) and a few settings (your plan, how many leads you have, and who you meet most, if you said when you started using the app), against the same random identifier, with an approximate location (country and city) worked out from your IP address. It receives no one's words, names, numbers, notes or photos.
• Session replays. The same service records some sessions as replays of the screens, with every field, card photo and person's details masked. Search and the camera are never recorded.
• Apple Ads. If you found Leadbox through an Apple Ads campaign, Apple tells the app which campaign and keyword it was, once.

Permissions

Leadbox asks for each permission when you first use the feature that needs it, and uses it only for that feature: the camera to scan cards and badges, your photos to read the cards you pick, the microphone for voice notes (the words you see while recording are written on your iPhone by Apple's speech recognition), notifications for your follow-up reminders, and your calendar to read the name and time of the event you're at, to tag who you meet there. Add to Contacts uses iOS's own form, so Leadbox doesn't need access to your contacts.

How we use information

We use information only to:

• read cards and notes, suggest next steps and draft messages, when you've turned reading on;
• provide your plan and keep the service within its limits and free of abuse;
• fix problems and keep Leadbox reliable;
• understand how Leadbox is used, so we can make it better.

Where the GDPR or similar laws apply, we rely on your consent for reading and for each permission, on providing the service you asked for to manage your plan, and on our legitimate interest in keeping Leadbox secure, reliable and improving for crash reports, usage and replays.

Our commitments

• We don't sell your information or share it for advertising.
• We don't show ads or track you across other companies' apps and websites.
• What you scan or say is never used to train AI.

How we share information

We work with a small number of service providers, each for one job: reading (a third-party AI provider), running our server and this website (a hosting provider), managing your plan (a subscription service), and improving the app (analytics and crash-reporting services). Each uses information only to do that job for us, and protects it to the same standard as this policy. We may also share information when the law requires it, and if Leadbox ever changes hands, this policy continues to apply to your information.

International transfers

Some of our providers operate in other countries, including the United States, so information may be processed outside the country where you live. When it leaves the European Economic Area, the United Kingdom or Switzerland, it's protected by safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep information

• Your leads stay on your iPhone until you delete them or the app.
• What's read is passed on without a copy; the AI provider keeps images and text for up to 30 days.
• Feedback on a draft is kept for 90 days.
• Request logs and crash reports are kept for up to 90 days.
• Usage information and replays are kept for up to a year.

Security

Your leads are kept in an encrypted database on your iPhone, with its key held in the iPhone's secure storage, and everything that leaves your iPhone travels over encrypted connections. We collect as little as possible, so there's as little as possible to protect.

Your rights and choices

• Your leads, in your hands. Because there's no account, your information is on your iPhone, where you can see it, correct it, export it as a spreadsheet, contact cards or a backup file, and delete it anytime, in Settings, Delete Everything, or by deleting the app.
• Reading. Turn reading on or off anytime in Settings, What Leaves Your Phone, and type details in instead.
• Permissions. Change any permission anytime in your iPhone's Settings.
• Your privacy rights. Depending on where you live, you may have the right to access, correct, delete or port your information, to restrict or object to how it's used, and to withdraw consent. Write to us at support@leadbox.example and we'll respond within the time the law allows. You can also contact your local data protection authority.

Children

Leadbox is made for work and isn't directed to children under 13, or the minimum age in your country. We don't knowingly collect information from children, and if we learn we have, we'll delete it.

This website

This site uses no cookies. Our hosting provider processes the requests your browser makes, such as your IP address, to deliver the site and keep it secure, and counts visits with its privacy-first analytics, which uses no cookies and collects no personal information. Because neither this site nor Leadbox tracks you across other websites, every visit is treated the same way, whether or not your browser sends a Do Not Track signal.

Changes to this policy

When we update this policy, we'll post the new version here with the date it changed, and we'll mark significant changes clearly on this page.

Contact

Questions about privacy are always welcome: support@leadbox.example.