LeechGuard

Privacy Policy

Last updated: October 24, 2026

This Privacy Policy explains how Watchwise LLC (“we,” “us,” or “our”) collects, uses, stores, and protects your information when you use the LeechGuard application (“Service”). By using LeechGuard, you agree to this policy.

1. Information We Collect

Account information

When you create an account, we collect your email address and authentication credentials. If you sign in with Google, we receive your name, email, and Google profile ID from Google’s OAuth service. If you verify your phone number, we collect your mobile number.

Content you register for protection

Assets, images, face profiles, monitored channels, and infringement records you add to your account are stored in our cloud database.

Face and biometric data

If you use face monitoring, you submit a reference photo of yourself. This photo is processed to identify potential unauthorized uses of your likeness. See Section 3 for full details.

Scan and enforcement records

Scan results, detected infringements, takedown requests, counter-notices, and associated audit logs are stored in your account.

Usage data

We collect standard app usage logs (feature interactions, error events) to diagnose issues and improve the Service. We do not collect advertising identifiers or behavioral tracking data.

Your country

When you send your first takedown, we ask which country you live in, suggested from your phone’s region setting. We use it only to choose the right takedown route for you: which law applies, who sends the notice, and any legal deadline. You can change it at any time under You > Country.

Takedown notices and your authorization

LeechGuard sends takedown notices for you as your authorized agent, from notices@leechguard.com. In most cases your name is not put on them. Where the law that applies requires the person to be named, the notice carries the name you type when you sign, and the app tells you so before you sign. In some countries, for now, you send the notice yourself from your own email, and LeechGuard only prepares it. A request to remove an intimate image never includes the image itself.

Before LeechGuard sends anything, you authorize it: you tick a box and type your full name, which LeechGuard treats as your electronic signature. For each authorization we record the text you agreed to (with its language and version), whether the notice carries your name, the name you typed, the time, your IP address and device, and the notice it covers. We keep this record, with a copy in our notices mailbox, as proof that you authorized us. Beyond the notices described above, your name is shared with a recipient only where the law requires it, for example in a counter notice process or under a court order.

Agency seats

If an agency you work with gives you a LeechGuard seat, it sends us your email address so we can invite you, and optionally its own id for you. When you claim the seat you sign an authorization for LeechGuard to send copyright notices in your name; we keep the text you agreed to, the name you typed, the time, your IP address and device, and every later withdrawal, as described above for other authorizations. The agency sends us your videos, or you add them yourself. We take each video once, keep three still frames and an audio fingerprint of it, and delete the video itself straight away. The frames and fingerprint are kept until the video is removed or the seat ends, and are used only to find copies of that video. The agency's team sees the seat, the videos and what is found, and chooses which notices are sent. A seat never includes face or likeness scanning.

Gmail access (accounts connected before October 2026)

LeechGuard no longer sends notices through Gmail. If you connected your Gmail account before, the only Gmail data we hold is an encrypted OAuth token with the send-only scope, which is no longer used. You can disconnect it at any time in Account Settings, which revokes access and deletes the token. We never read, store, or index your inbox.

2. How We Store Your Data

LeechGuard uses Supabase, a cloud database platform, to store your account data. Your data is hosted on servers in the United States. All data in transit is encrypted via HTTPS. Data at rest is encrypted by Supabase.

You can delete your account and all associated data at any time through app settings. Deletion is permanent and processed within 30 days, except where retention is required by law (e.g., fraud prevention, legal holds).

3. Biometric and Face Data

Face monitoring processes facial recognition data, which may constitute biometric information under applicable law, including the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifiers Act (CUBI), and EU GDPR Article 9.

By enabling face monitoring:

4. Third-Party Services

The following services may receive or process your data as part of delivering LeechGuard’s functionality:

We do not share data with these services beyond what is necessary for the stated function. We do not permit third parties to use your data for advertising or to sell it to others.

Google API Limited Use Compliance. LeechGuard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google APIs for Sign in with Google. LeechGuard no longer sends notices through Gmail; for accounts that connected Gmail before October 2026, the only Gmail data we hold is an encrypted OAuth token with the send-only scope, kept until you disconnect it and no longer used. Google user data is never read or stored beyond what is described here, and is never used, in raw, aggregated, or derived form, to develop, improve, or train any generalized or foundational AI/ML models, nor transferred to any third-party AI/ML service for such purposes.

5. How We Use Your Information

We do not use your data to train AI models. We do not sell your data.

6. Automated Processing

LeechGuard uses automated systems, including AWS Rekognition facial recognition and Anthropic’s Claude AI, to classify scan results. Takedown notices use LeechGuard’s fixed wording; in app versions before 2.0, Claude also drafted them. Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce significant legal effects. In LeechGuard, all enforcement actions require your explicit initiation or Quiet Mode consent. You may disable Quiet Mode at any time to resume manual review of all actions.

7. Your Rights

All users:

EU / EEA users (GDPR): In addition to the above, you have the right to:

California users (CCPA/CPRA):

To exercise any of these rights, contact us at contact@leechguard.com. We will respond within 30 days.

8. Children’s Privacy

LeechGuard is not intended for users under 13 years of age. Users who enable adult content monitoring must be 18 or older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Data Retention

We retain your data for as long as your account is active. When you delete your account, your personal data is permanently deleted within 30 days, with one exception: records of the authorizations you signed for LeechGuard to send takedown notices for you, and of the notices sent, are kept for as long as they may be needed to establish, exercise, or defend legal claims about those notices. Anonymized or aggregated usage statistics that cannot identify you may be retained indefinitely.

10. Security

All data transmissions use HTTPS. Database data is encrypted at rest by Supabase. We do not store payment credentials. Payments are handled by Apple and Google directly.

11. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. We will notify you of material changes through the app or by email. Your continued use of LeechGuard following notice constitutes acceptance of the updated policy.