Languageen-CAEnglish (Canada)
Download for MacDownload for LinuxSee the downloads
LegalVersion 2.0.0, in force from 2026-10-10

Privacy policy

This policy explains what personal information is handled, by whom and why, when you use:

  • the Leathercase website at leathercase.app, including the user guide at leathercase.app/guide/;
  • the Leathercase desktop app.

In short:

  • The website sets no cookies and collects no email address itself.
  • The app has no account and no telemetry, and it uploads nothing on its own.
  • Your writing leaves your computer only if you connect an AI agent of your own and let it read your stories.

This policy has not been reviewed by a lawyer. If anything in it is unclear or seems wrong, write to [email protected].

We are based in British Columbia, Canada. This policy is written first for Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and for the provincial laws that apply alongside it. Section 9 covers the laws of other places where people use Leathercase.

1. Who is accountable

Leathercase is made by André Amâncio de Moraes, who is accountable for your personal information. He is also the person in charge of the protection of personal information, as Quebec’s Law 25 requires, and the person accountable under PIPEDA.

Write to [email protected] for any question or request about your information.

2. How we handle personal information

We follow PIPEDA’s ten fair information principles:

  1. Accountability. One person answers for how your information is handled (section 1).
  2. Identifying purposes. We say why we collect each item before or when we collect it (sections 3 and 4).
  3. Consent. We collect, use and disclose personal information only with your consent, except where the law allows otherwise. You may withdraw consent at any time, subject to legal or contractual limits.
  4. Limiting collection. We collect only what the stated purpose needs.
  5. Limiting use, disclosure and retention. We use information only for the purpose it was collected for, and keep it only as long as that purpose needs (section 6).
  6. Accuracy. We keep the information we hold accurate enough for its purpose. You may correct it.
  7. Safeguards. We protect information with measures that fit its sensitivity (section 11).
  8. Openness. This policy describes our practices in plain words.
  9. Individual access. You may ask what we hold about you and get a copy (section 9).
  10. Challenging compliance. You may complain to us, and then to the Privacy Commissioner of Canada or your provincial commissioner (section 9).

3. The website

What the site collects

Information Collected by Why Basis
Connection data: IP address, time, page requested, browser Cloudflare, Inc., which carries the site’s traffic, and GitHub, Inc., which hosts it on GitHub Pages To serve the site and protect it from abuse Implied consent for a service you request; legitimate interest under the GDPR (art. 6(1)(f)) and LGPD (art. 7, IX)
Visit counts (see the list below) Umami Cloud, run by Umami Software, Inc. To know how the site is used and which downloads are needed, so we can improve the app and the site Implied consent for non-sensitive, aggregated measurement; legitimate interest under the GDPR and LGPD
Your language choice Your browser (localStorage), never sent to us To show the site in the language you picked Your request; strictly necessary
Emails you send to [email protected] Cloudflare, Inc., which forwards them, and Google LLC, which holds our mailbox To answer you Your request; legitimate interest under the GDPR and LGPD

Analytics without cookies

The site uses Umami Cloud, on its free plan, hosted in the United States. Umami:

  • sets no cookies and stores nothing on your device;
  • does not store your IP address. It uses it briefly to tell one visit from another and to find the country, then discards it;
  • does not track you across sites or build a profile of you;
  • gives us only totals;
  • counts nothing if your browser sends Do Not Track.

The events counted are:

  • page views, with the page and the language of the page;
  • the referring site;
  • the country;
  • the device type and browser;
  • clicks on a download button, with the operating system, the processor type (for example Apple silicon or Intel), the file format and the version;
  • choosing a language in the language menu, with the language chosen;
  • clicks on a link to the newsletter or to patronage;
  • clicks on a workshop’s Register button, with the kind of session (for example workshop or patron Q&A).

No event carries your name, your email address, anything you typed, or an identifier that follows you.

What the site does not do

  • It sets no cookies.
  • It has no forms and asks for no email address.
  • It loads no fonts, scripts or images from third parties, except the Umami counting script. Fonts are served from the site itself.
  • It shows no advertising.
  • It sells no information.

Downloads

Download links go to GitHub, which serves the installers from the public repository Leathercase/leathercase-releases. GitHub receives your IP address and browser details when you download. See GitHub’s privacy statement.

The newsletter, the workshops and patronage

The site links to services that run under their own privacy policies. We receive from them only what they show their account holders.

  • The newsletter runs on Substack, Inc. The site’s buttons open Substack, which asks for your email address there. Substack sends each issue with the sender’s name and a working unsubscribe link, as Canada’s Anti-Spam Legislation (CASL) requires, and keeps the record of your consent. We see the list of subscribers Substack keeps for us.
  • The workshops. You register for a workshop by subscribing to the newsletter; the link to each session is sent by email. The email names the service the session runs on. That service receives what you share when you join, under its own privacy policy.
  • Patronage. Patron sessions are open to patrons. Becoming a patron happens on the patronage service the site links to, Patreon or GitHub Sponsors, which handles your payment and details under its own privacy policy. We receive what that service shows the person you support, such as your name or username and your tier.

4. The desktop app

The app is designed so that we receive nothing from it.

  • No account, no telemetry, no crash reports. The app does not send us usage data, analytics or error reports.
  • Your files stay on your computer. The app reads your writing where it is and writes its own small files beside it. Those files are as private as the folder you keep them in. If you sync that folder with a service such as iCloud Drive, Dropbox, OneDrive or Google Drive, that service’s privacy policy applies to it.
  • Update checks. Only when you ask, or at launch if you turn that on (it is off until you do), the app sends one request to GitHub to read the latest release, and downloads an update only when you choose to. GitHub sees your IP address. Nothing about you or your writing is sent.
  • Meaning search. Only if you choose to download it, the app fetches a language model once, from Hugging Face. After that it runs on your computer and sends nothing. Hugging Face sees your IP address.

Agents you connect

You can connect AI agents that run in other apps, such as Claude Desktop or Cursor, through the Model Context Protocol (MCP). Leathercase listens for them on your computer only, never on the network. When you connect one:

  • the agent reads what you allow it to read, including your stories;
  • that content may be sent to the agent’s provider and handled under your agreement with that provider, not ours;
  • we do not receive it and we are not accountable for that handling.

The app keeps a log of what each agent did. The log stays on your computer.

5. What we do not offer yet

Leathercase has no paid service today. If one is offered, this policy will say, before it starts, what that service handles and who processes it.

6. How long we keep information

We keep personal information only as long as its purpose needs it:

  • connection logs as Cloudflare and GitHub set them;
  • analytics as totals without personal information;
  • the newsletter until you unsubscribe;
  • your emails to us as long as we need them to answer you and follow up, then we delete them.

When information is no longer needed, we delete it or make it anonymous.

7. Transfers outside Canada

Our service providers store and process information outside Canada, mostly in the United States:

  • Cloudflare (traffic to the site, and forwarding email);
  • GitHub (hosting and downloads);
  • Umami Software (analytics, in the United States);
  • Substack (the newsletter);
  • Google (our mailbox).

Information held in another country is subject to that country’s laws, and its courts, police and security agencies may be able to obtain it. We choose providers that commit to protecting information to a standard comparable to Canada’s.

For people in the EU, the UK and Brazil, transfers rely on adequacy decisions or on the providers’ standard contractual clauses (GDPR art. 46; LGPD art. 33).

8. Who receives information

Recipient Role Information
Cloudflare, Inc. Carries the site’s traffic; forwards email sent to [email protected] Connection data; the emails you send us
GitHub, Inc. Hosts the site and the downloads Connection data
Umami Software, Inc. Counts visits Totals without personal identifiers
Substack, Inc. Runs the newsletter Email address, consent record
Google LLC Holds our mailbox The emails you send us and our replies

We do not sell or rent personal information. We do not share it for advertising.

9. Your rights

In Canada

  • PIPEDA. You may ask whether we hold personal information about you, get access to it, and have it corrected. You may withdraw consent. We answer within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
  • British Columbia and Alberta. We are based in British Columbia, so its Personal Information Protection Act governs what we collect within the province, and PIPEDA what crosses a border. Each province’s Personal Information Protection Act gives rights similar to PIPEDA’s. You may complain to the province’s Information and Privacy Commissioner.
  • Quebec: Law 25. You also have the right to have information de-indexed or deleted where the law allows, to data portability, and to be told when a decision about you is made only by automated processing. We make no such decisions. You may complain to the Commission d’accès à l’information du Québec.

To use any right, write to [email protected].

Elsewhere

Depending on where you live, you have some or all of these rights: to know what information we hold, to get a copy, to have it corrected or deleted, to restrict or object to its use, to take it elsewhere, to withdraw consent, and to complain to a data protection authority.

  • EU and UK: GDPR and UK GDPR. You have every right listed above. You may complain to your local supervisory authority.
  • Brazil: LGPD. You have the rights in art. 18: confirmation, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent. You may complain to the ANPD.
  • California: CCPA/CPRA. You may know, delete and correct. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information.
  • Japan: APPI. You may ask us to disclose, correct or stop using your information.
  • South Korea: PIPA. You may access, correct, delete and suspend processing.
  • China: PIPL. You may know, decide, access, copy, correct and delete, and you may ask us to explain our processing.
  • Taiwan: PDPA. You may access, copy, correct, stop processing and delete.

10. Children

The site and the newsletter are not directed at children.

  • Who may sign up. Do not subscribe to the newsletter or register for a workshop if you are under 16, or under the age of consent where you live, without a parent’s or guardian’s consent. In Quebec, consent for a child under 14 is given by the person having parental authority.
  • Brazil. In Brazil, information about children and adolescents is processed only in their best interest, with the consent LGPD art. 14 requires.
  • Information collected by mistake. If we learn that we hold a child’s information without that consent, we delete it.

11. Security

We protect the information we hold with measures that fit its sensitivity. No method of transmission or storage is perfectly secure. If a breach creates a real risk of significant harm to you, we notify you and the Privacy Commissioner of Canada, and in Quebec the Commission d’accès à l’information, as the law requires, and we keep a record of every breach.

The app’s design protects your writing better than any server could, because your writing stays on your computer. Its safety there depends on your computer and the services you choose.

12. Changes to this policy

We publish changes on this page with a new version number and effective date. If a change matters, for example a new use of your information, we say so on the site and ask for your consent where the law requires it.

13. Language

This policy is written in English. On a page of the site in another language, it is shown in English, and the page says so. If a translation is published later, it is made by an AI model and says so, and the English text prevails where they differ, except where local law requires otherwise. If you live in Quebec and want this policy in French, write to [email protected].