Privacy Policy

Last updated 22 September 2026

Draft. Highlighted items are placeholders for your company’s details. Have a lawyer review this page before launch.

Leonard reads your code and your team’s requests so that he can do the work. This page explains what that means for personal information: what we collect, why, who else sees it, and what you can ask us to do with it.

1. Who we are and what this covers

“Leonard”, “we” and “us” mean [Company legal name], a [state] [entity type] located at [address]. This policy covers our website, the Leonard web app, the Leonard GitHub App, the Leonard Slack app, and the account, billing and support around them (together, the “Service”).

When a company signs up, that company is the controller of the code, issues and messages it connects to Leonard, and we process them on its behalf. If your company has a signed agreement with us, that agreement governs where it differs from this policy.

2. What we collect

• Account information: name, work email, company, role, and sign-in details from GitHub, Slack or another identity provider.
• Repository content: the source code, commit history, issues, pull requests and comments in the repositories you grant Leonard access to.
• Requests and messages: Slack messages that mention Leonard, the thread they sit in, GitHub issues assigned to Leonard, and requests made in the web app, including the names and handles of the people who wrote them.
• Work records: what Leonard understood, assumed, ran and changed for each task: commands, test results, build logs and the resulting pull requests.
• Billing information: plan, invoices and payment status. Card details are held by our payment processor, not by us.
• Usage and device data: IP address, browser, pages viewed, and error and performance logs.
• Support communications: anything you send us by email or chat.

Code sometimes contains personal information or secrets by accident. Leonard never fetches .env files or anything listed in .gitignore, but we ask that you keep personal data and credentials out of repositories you connect.

3. What Leonard can and cannot reach

Leonard only sees what you connect, and only with the permissions you approve on GitHub and Slack.

• GitHub: reads contents and metadata, and reads and writes issues and pull requests. He has no access to administration, members, secrets, workflows or deployments. His commits are authored as leonard[bot], never as a person.
• Slack: reads messages only in channels he has been added to, and acts only when mentioned. He does not read direct messages or private channels he isn’t in, and he doesn’t read files or email addresses.
• Merging: Leonard opens pull requests. He never merges them; a person does.

4. How we use it

• To run the Service: understand requests, work in your code, run your tests, and open issues and pull requests.
• To keep the record of each task that your team can review.
• To create and secure accounts, and to prevent abuse and fraud.
• To bill you and provide support.
• To fix problems and improve the Service, using usage and error data.
• To meet legal obligations and enforce our terms.

5. AI models and training

Leonard uses large language models from third-party providers to understand requests and write code. Your content is sent to those providers only to complete your tasks, under terms that do not allow them to train on it.

We do not use your code, issues or messages to train AI models, ours or anyone else’s, unless your company opts in in writing. We may use aggregated, de-identified usage statistics (for example, how long tasks take) to run and improve the Service.

6. Who we share it with

We do not sell personal information and do not share it for cross-context behavioural advertising. We share it only with:

• Service providers who help us run the Service: cloud hosting, AI model providers, payment processing, email, and error monitoring. The current list is at [subprocessors URL].
• Your own team: people in your organisation can see the tasks, messages and records inside it.
• GitHub and Slack: whatever Leonard posts is stored there under their own policies.
• Authorities or counterparties when the law requires it, to protect people’s safety or our rights, or as part of a merger, acquisition or asset sale, with notice to you.

7. Cookies

We use cookies needed for sign-in and security, and a small number for product analytics. Where the law requires consent for non-essential cookies, we ask first.

8. How long we keep it

• Working copies of your repositories are deleted within [24 hours] of a task finishing.
• Task records are kept while your account is active so your team can refer back to them, and deleted within [30 days] of account closure.
• Billing records are kept as long as tax and accounting law requires.
• Backups roll off within [35 days].

9. Security

Each task runs in an isolated container that is destroyed afterwards. Data is encrypted in transit and at rest, and access by our staff is limited and logged. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict some processing. Workspace admins can delete tasks and disconnect GitHub or Slack at any time from settings. For anything else, email [privacy@leonard.dev]. We will verify the request and reply within the time the law allows. We will not treat you differently for exercising these rights.

California residents have the rights above under the CCPA and CPRA, including the right to know the categories listed in section 2, the purposes in section 4 and the recipients in section 6. We do not sell or share personal information as those laws define it.

11. International transfers

We are based in the United States, and our providers may process data in other countries. Where the law requires it, we use approved transfer safeguards such as Standard Contractual Clauses.

12. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

13. Changes

If we make a material change, we will update the date above and tell workspace admins by email before it takes effect.

14. Contact

[Company legal name], [address]. Email [privacy@leonard.dev].

Terms of Service

Last updated 22 September 2026

Draft. Highlighted items are placeholders for your company’s details. Have a lawyer review this page before launch.

These terms are the agreement between your company and [Company legal name] for using Leonard. The short version: you own your code and everything Leonard writes for you, a person on your team reviews and merges his work, and you pay per Leonard each month.

1. Accepting these terms

By creating an account or using the Service, you agree to these terms on behalf of the company you represent, and you confirm that you are at least 18 and have authority to bind it. “You” means that company. If you have a signed agreement with us, it takes precedence where the two differ.

2. The Service

Leonard is an AI software engineer. He takes requests from Slack, GitHub issues and the web app, works in the repositories you connect, and opens pull requests. The Service includes the website, web app, GitHub App, Slack app and anything else we provide under the Leonard name.

3. Accounts

You are responsible for your workspace: who has access, the permissions you grant on GitHub and Slack, and keeping sign-in credentials secure. Tell us promptly at [security@leonard.dev] if you suspect unauthorised access.

4. Your content and Leonard’s output

You keep all rights in your code, issues, messages and other content you connect (“Your Content”). You give us a limited licence to use Your Content only to provide, secure and support the Service for you.

You own the code, comments and pull requests Leonard produces for you (“Output”). To the extent we have any rights in Output, we assign them to you. We do not use Your Content or Output to train AI models unless you opt in in writing.

5. Human review

Leonard can make mistakes. Output is a proposal, not a finished change: you are responsible for reviewing, testing and deciding whether to merge it, and for what you ship. Leonard never merges pull requests himself. Don’t rely on him for decisions where an error could cause injury, or for safety-critical systems, without independent review.

6. Acceptable use

You will not use the Service to:

• break the law or infringe anyone’s rights;
• build malware, attack systems, or get around security controls;
• connect repositories or channels you aren’t authorised to share;
• probe, overload or reverse-engineer the Service, or build a competing product from it;
• submit regulated data (such as health or payment card data) unless we have agreed to it in writing.

7. Third-party services

Leonard works through GitHub, Slack and AI model providers. Your use of GitHub and Slack is also governed by their terms, and we are not responsible for their availability or changes they make.

8. Plans, fees and payment

• You pay per Leonard, per month, at the price shown when you subscribe. Each Leonard works one task at a time. There is no per-seat charge.
• Subscriptions renew monthly until cancelled. Fees are charged in advance, are exclusive of taxes, and are non-refundable except where the law requires otherwise.
• A free trial, if offered, ends on the date shown. We won’t charge your card before then, and cancelling during the trial costs nothing.
• We may change prices with at least [30 days’] notice, effective from your next renewal.
• If payment fails, we may pause the Service after telling you.

9. Availability and changes

We work to keep the Service available but don’t guarantee it will be uninterrupted or that every task will finish. We may change features; if we remove something material you’re paying for, we will tell you in advance. Features labelled beta are provided as-is and may change or end.

10. Confidentiality and security

Each of us will protect the other’s confidential information with at least reasonable care and use it only for this agreement. We protect Your Content as described in our Privacy Policy.

11. Our property and feedback

We own the Service and the technology behind it. You get a non-exclusive, non-transferable right to use it during your subscription. If you send us feedback, we may use it without obligation to you.

12. Open source

Output may resemble or include open-source code. You are responsible for complying with the licences that apply to code you ship.

13. Ending the agreement

You can cancel at any time in settings; access continues until the end of the paid month. We may suspend or end your access if you materially breach these terms and don’t fix it within [15 days] of notice, or immediately where needed to prevent harm. After termination you can export task records for [30 days], after which we delete Your Content as the Privacy Policy describes.

14. Disclaimers

Except as expressly stated in these terms, the Service and Output are provided “as is”, without warranties of any kind, including merchantability, fitness for a particular purpose, non-infringement, or that Output will be correct or free of defects.

15. Limitation of liability

Neither party is liable for indirect, incidental, special, consequential or punitive damages, or lost profits, revenue or data. Each party’s total liability is limited to the fees you paid in the 12 months before the claim. These limits do not apply to your payment obligations, a party’s indemnity obligations, or liability that cannot be limited by law.

16. Indemnity

We will defend you against third-party claims that the Service itself infringes their intellectual property, and pay resulting damages. You will defend us against third-party claims arising from Your Content or your breach of section 6.

17. Law and disputes

These terms are governed by the laws of [State], without regard to conflict-of-law rules. We will first try to resolve any dispute informally for 30 days. After that, disputes go to the courts in [county, state], and both parties consent to their jurisdiction.

18. General

You must follow export control and sanctions laws when using the Service. Neither party may assign this agreement without consent, except to a successor in a merger or sale of substantially all its assets. Neither party is responsible for delays caused by events outside its reasonable control. If a provision is unenforceable, the rest still applies, and not enforcing a provision is not a waiver. These terms and the Privacy Policy are the entire agreement between us about the Service.

19. Changes to these terms

If we make a material change, we will tell workspace admins at least 30 days before it takes effect. Continuing to use the Service after that means you accept the new terms.

20. Contact

[Company legal name], [address]. Legal notices to [legal@leonard.dev].