Privacy
Last updated 15 September 2026
Used without an account, LeaveSafe reaches no server at all. The open-source daemon watches your machine and talks to your phone over your own network, and nothing on this page applies to it. Everything below is about the optional account, which exists so that a device can be reached from somewhere other than the same room.
Who is responsible
The data controller is SoftBlock Solutions Ltd, company number 16526424, registered in England and Wales, with its registered office at Suite 9331, 5 Brayford Square, London, E1 0SG, United Kingdom. Anything on this page can be asked about at support@softblocksolutions.com.
What an account is
An account is a sixteen-digit key and nothing else. There is no e-mail
address, no user name, no password and no recovery question — there is
nothing to recover an account to. What is stored is a keyed hash of
the key, for looking it up, and an argon2id verifier, for
checking it. The key itself cannot be reconstructed from either.
What is stored
| Record | Contents | Why |
|---|---|---|
| Account | A keyed hash of the master key, an argon2id verifier, status, device limit, creation and last sign-in times | To recognise the key you present without holding the key itself |
| Device | A name you chose, device type, platform, an installation identifier, the application version, a notification token, creation and last-seen times | To list your machines, and to let one be revoked without disturbing the others |
| Device state | Whether it is armed and one word about each sensor, with the time it was reported | So a watching device can see what an armed machine is doing. Written only while armed |
| Session | A hash of a refresh token, and its expiry | To keep you signed in without storing a password there is none of |
| Payment | Which store a pack was bought from and the reference it gave that purchase, how many days it was worth, and the date the account was paid until afterwards | To add the time you paid for, to refuse the same receipt twice, and to take the time back if the store takes the money back |
| Trial | A keyed hash of an identifier your device reports, and the date it was given its free fortnight | So the fourteen days are given once per device rather than once per account. See below — this is the one record that outlives the account |
What is not stored
- No e-mail address, name, telephone number or postal address.
- No location. The open-source daemon has an optional location feature which is off by default and, when switched on, is not reported to this service.
- No analytics, no advertising identifier, no profiling, no automated decision-making.
- No advertising network, no crash reporter and no analytics provider, in the application or on this site. The processors are the two companies whose phones this runs on, doing the two jobs named above and nothing more. Google: Firebase Cloud Messaging carries every notification, and Google Play sells the packs on Android and takes the payment. Apple: a notification bound for an iPhone goes on from Firebase to the Apple Push Notification service, which is what puts it on the screen, and the App Store sells the packs on an iPhone and takes the payment. Either store sees the purchase; what reaches us is the reference it gives that purchase, never a card and never a name. Nothing is passed to anyone else.
- No cookie is set by this website, and it stores nothing in your browser.
What the phone application can reach
Nothing on your phone. The application asks for no camera, no location, no microphone, no Bluetooth, no contacts and no files, because it needs none of them: it is the end that watches. The six sensors belong to the program on the computer being watched, and no version of this application on any phone reads hardware of its own.
That is a fact about the product rather than a promise about our conduct, which is the more useful kind: a permission that is never requested cannot be misused.
Notifications
A device hands the service a notification token so that it can be reached when the application is not open, and notifications are sent: the notice that a machine you are watching has raised its alarm or gone quiet. The token goes to Google's messaging service to deliver that notice — and, for an iPhone, on from there to Apple's push service — which is the one place anything about you leaves this service, and what it carries is which device to wake, not what it saw.
How long it is kept
Until you delete the account. Deleting it removes the account record and, with it, every device, session, device state and payment record belonging to it. There is no archive and no soft delete. See deleting your account.
One row that stays
The free fortnight is given once per device, and the record of that is the single thing deletion does not take with it: a keyed hash of an identifier your phone reports — the Android id, or Apple's identifier for this vendor — with the date it was granted. Nothing else is in that row: no account, no device name, no link back to anything you deleted.
It is kept because a trial that a reinstall renews is not a trial. The identifier itself is never written down: what is stored is a one-way hash under a server-side secret, which cannot be reversed and cannot be recognised by anyone who does not hold that secret. If you would rather it were removed as well, write to us — and understand that removing it makes this device eligible for another fourteen days.
Where it is
On a rented server in the European Union. The controller is in the United Kingdom, so that is a transfer out of the UK, and it is covered by the adequacy decision the UK maintains for the EEA. What leaves that server is what the processors above need and nothing else: a notification token and the notice to deliver, and the receipt a purchase is checked with. Google and Apple are in the United States, and what reaches them goes under the safeguards each of them maintains for transfers out of the UK and the EU. No analytics provider, no advertising network, and nobody who is not doing one of those two jobs.
Your rights
Under the UK GDPR you may ask whether your data is processed and get a copy of it, have it corrected or erased, restrict or object to processing, and ask for it in a portable form. There is no automated decision-making here to object to, and no profiling.
If you are in Türkiye, Article 11 of Law No. 6698 gives you the same substance and we answer requests on that footing too: whether your data is processed, what and why, who it has been passed to at home or abroad, correction or deletion, notification of that to anyone it was passed to, objection to a conclusion drawn by automated analysis alone, and compensation for unlawful processing.
You can also complain to a regulator. Ours is the UK Information Commissioner's Office at ico.org.uk; in Türkiye it is the KVKK. We would rather you wrote to us first, but it is your right either way.
Write to support@softblocksolutions.com. Because an account carries no name and no address, we cannot identify you from one: a request has to be made from the application, or accompanied by the account key. We will say so rather than answer a request we cannot attribute — guessing would be the privacy failure, not the caution.
Children
LeaveSafe is not directed at children under 13, and collects nothing that would identify one.
Changes
The date at the top of this page is the date it last changed. A change that widens what is collected will be announced in the application before it takes effect.