Library and original files
Text, notes and reading positions stay with their document until it is removed. Archive hides a reading from your active library; it does not delete it. Uploaded originals remain in private storage while associated with a reading. Deleting a reading schedules related stored files for background cleanup, which may retry after a storage failure.
Audio cache and usage
Generated audio is automatically removed from our servers after 7 days from creation, except for accounts with an agreed retention exception. Listening again does not restart that period. Your texts, notes, progress and account remain. Copies already downloaded to your device remain under your control. Audio can be generated again within your current allowance. Cleanup runs in the background and retries storage failures.
A private temporary copy of completed audio supports recovery after an interrupted upload. It is removed after successful publication or becomes eligible for cleanup after 24 hours while the worker is running.
The generation usage journal remains after clearing audio or deleting a document, so deletion does not refund consumed characters. Regenerating a cleared sentence uses the current allowance again. Generation records are retained for account usage accounting. Routine operational audit events are kept for 14 days; administrative decisions are kept as needed to enforce and review restrictions.
Temporary uploads and email links
Unfinished uploads expire after 15 minutes and become eligible for cleanup. Email confirmation links last 24 hours and password-reset links last 30 minutes. Encrypted queued email content is removed after acceptance, final failure, cancellation or expiry. Email-action metadata is removed seven days after link expiry while the email worker is running.
Dictation and pronunciation feedback
The recognition service removes temporary dictation audio after processing, including failures. The iOS app removes its local recording after success, cancellation or closing the voice-input view; a failed recording can remain locally for retry while the view stays open. A transcript becomes library content only when you save it.
Voluntary pronunciation reports include a selected word and a short excerpt. Deleting the source document alone does not remove the stored report. Account deletion removes reports still linked to the account. No automatic age-based expiry for these reports has been implemented; contact the privacy address about removal.
Analytics
Daily rotating visitor pseudonyms used for approximate unique counts are removed after 32 days. Aggregate daily page, country and device counts remain for historical reporting. No document ID or query string is kept in the analytics path.
Security records
To prevent abuse, we record account identifiers, event times, restriction reasons and a protected reference to the connection address. Security signals are kept for 30 days; administrative restriction records are retained while needed to enforce or review a restriction. These records are separate from product analytics and do not contain your reading text or passwords.
Accounts, backups and requests
The iOS app and website offer account deletion with a 7-day recovery period, confirmed with a password or fresh authorization from a connected Apple or Google account. Sessions end immediately. Before the displayed deadline, sign in and explicitly cancel deletion to retain your account and library. After that deadline, recovery is disabled; the cleanup worker removes the account, library, preferences, contributions and linked pronunciation reports, then queues original files and generated audio for storage cleanup. Older app versions offering immediate permanent deletion do not provide this recovery period. Audit records can remain separately. Complete self-service export is not implemented. Ask privacy@leafread.io about a LeafRead data request. Provider backups and diagnostic systems follow the relevant retention settings and obligations. Deletion from the active service does not imply immediate erasure from those systems. Limited records may remain where needed for an unresolved security incident, dispute or legal obligation.