The data controller is ToModern e.U. (Marc Jenni), Seitenstettengasse 5/37, 1010 Wien, Österreich — full company details are in our legal notice. You can reach us at support@leewyn.com for anything to do with your data.

When you visit leewyn.com or sign up on the landing page, we keep data collection deliberately limited.

• Email address. When you request early access, we store the email address you provide so we can let you know when Leewyn becomes available. We don't use it for unrelated marketing.
• IP address. Our signup endpoint may process your IP address to detect and block bulk or automated submissions. We do not use it for advertising or profiling.
• Anti-spam honeypot field. Our signup form contains a hidden field intended to detect automated submissions. If it is triggered, we reject the submission.
• Basic analytics (Plausible). We use Plausible to understand how people use this website. Plausible doesn't use cookies or persistent identifiers and runs the same way for every visitor, with or without cookie consent. Analytics may include information such as approximate location derived from IP address, referrer, page URL, browser, operating system, device type, screen size and country.
• Analytics (PostHog). We also use PostHog. Until you accept cookies, PostHog runs in a cookieless mode: no cookies or local storage, and no persistent, cross-session identity — just aggregate, anonymous event data. If you accept the cookie banner, PostHog switches to its normal mode and starts using cookies/local storage to recognise you as a returning visitor across sessions and to automatically capture on-page interactions (autocapture) in addition to pageviews.
• Advertising pixel (Reddit). If you accept the cookie banner, we also load the Reddit Pixel, which helps us measure how people who came from a Reddit ad use this site (e.g. whether they joined the waitlist) and report that back to Reddit in aggregate. It does not load, and Reddit receives nothing, until you accept.

We do not send your email address or another account identifier to Plausible, PostHog, or Reddit.

In addition to pageviews, we send a small number of website events to Plausible and PostHog: clicks on the "Get Leewyn" button and whether a landing-page signup was submitted, completed or failed. For failed submissions, we record only the general failure type, such as API or network failure, and not the submitted email address or the error contents. If you've accepted cookies, we also tell Reddit when a landing-page signup was completed, as a conversion event, without sharing the email address itself.

Our website is hosted by Vercel. As part of delivering and securing the website, Vercel may process technical information such as IP addresses, request information and server logs.

This is a different system from the website above, so it gets its own section. Leewyn works by becoming the device owner on your teenager's phone — the same kind of lock companies use on work devices — and enforcing rules locally, on the device itself:

• We don't route your teenager's traffic through our servers to filter it — blocking happens locally on the device.
• We don't see, log, or store which apps your teenager opens or which sites they visit. There's no browsing history, message content, call log, or location feed for us to collect, because we don't build one.
• We don't take screenshots and we don't generate screen-time reports that leave the device.
• The device-owner lock itself (what's blocked, that it can't be uninstalled or bypassed via safe mode/sideloading) is configuration data tied to the device and your parent account, not a log of your teenager's activity.

We'll need standard account details from you as the parent: your email address, and payment information for your subscription. Billing is handled by Paddle.com, who acts as the Merchant of Record for all Leewyn purchases. Paddle processes your email address, payment method, and billing address to complete the transaction, issue invoices, and handle applicable taxes; we don't see or store your full payment details ourselves. See Paddle's own privacy notice at paddle.com/legal/privacy for how they handle it, and our Terms & Conditions for billing, subscription, and refund terms.

• Running the landing page signup and letting you know when a spot opens.
• Keeping the signup form working for real people, not scripts.
• Understanding — in aggregate — how many people visit and what's working, so we can improve the site.
• Meeting legal obligations, if we're ever required to (e.g. responding to a lawful request).

We don't sell anything we collect or hand it to third-party marketing or data broker networks. The Reddit advertising pixel described in section 2 only ever runs after you've accepted cookies, and only to measure our own ad campaigns.

• Consent — you submitting the landing page's signup form, and you accepting the cookie banner, which is what turns on PostHog's full analytics mode and the Reddit advertising pixel (Art. 6(1)(a)). You can withdraw this at any time, as described in section 11.
• Legitimate interest — abuse prevention on the signup form, and cookieless, aggregate analytics via Plausible and PostHog's pre-consent mode (Art. 6(1)(f)). We've weighed this against your privacy and kept collection to the minimum needed.
• Legal obligation — where the law requires it of us (Art. 6(1)(c)).

We apply this same standard to every visitor, regardless of where you're located — not just to visitors in the EU/EEA.

We use a small number of service providers to operate Leewyn:

• Vercel — hosts and delivers leewyn.com and may process technical request and server information necessary to provide and secure the website.
• Neon — hosts the PostgreSQL database in which early-access email addresses and related signup data are stored. Our database region is Frankfurt, Germany.
• Plausible — provides privacy-focused, cookieless website analytics.
• PostHog — provides website analytics; runs cookieless until you accept cookies, described in section 2.
• Reddit — receives conversion events from the Reddit Pixel, but only after you accept cookies, described in section 2. See Reddit's own privacy policy at reddit.com/policies/privacy-policy.
• Paddle — acts as the Merchant of Record for Leewyn subscriptions and processes payment information (email, payment method, billing address) as described in section 3 above.

These providers act as service providers or processors where applicable and may use their own subprocessors to provide their services.

Some of our service providers are based outside the European Economic Area or may involve processing outside the EEA. Where GDPR requires safeguards for such transfers, the relevant provider uses recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses.

We do not sell personal data, share it with advertising networks or data brokers, or use it for behavioural advertising.

We may also disclose information where required by law or in connection with a merger, acquisition or transfer of the business, subject to applicable data-protection requirements.

• Early-access email addresses: until we have offered you access to Leewyn, you withdraw your consent, or you ask us to delete your address.
• IP addresses used by our signup system for abuse prevention: retained only for as long as reasonably necessary to detect and prevent automated abuse and then deleted.
• Analytics data: retained according to the configuration of Plausible and PostHog and deleted or aggregated when it is no longer needed for website analytics.
• Reddit Pixel conversion events: only sent once you've accepted cookies, and retained according to Reddit's own policies.

Technical logs generated by infrastructure providers such as Vercel may be retained by those providers for limited periods for security, reliability and abuse-prevention purposes in accordance with their applicable policies.

We use encrypted HTTPS/TLS connections between your browser and our services and restrict access to personal data to what is necessary to operate Leewyn.

Our database provider and hosting provider use technical and organisational security measures intended to protect the systems they operate.

No online service can guarantee absolute security, so we deliberately minimise the personal data we collect and retain.

This website — the landing page you're reading about right now — is meant for parents and guardians, not children, and we don't knowingly collect personal data from children through it. The Leewyn app itself is different: it's designed to run on a teenager's device, installed and controlled by their parent, under the local-only model described in section 3.

We don't currently respond to browser Do Not Track signals. Instead, you control tracking directly through the cookie banner described in section 2: nothing beyond cookieless, aggregate analytics runs until you accept it, and PostHog's full analytics mode and the Reddit advertising pixel never load unless you do. You can decline, or withdraw consent at any time, as described in section 11.

Under the GDPR, you can ask us to access, correct, delete, or export the data we hold about you, restrict or object to how we use it, or withdraw consent at any time — none of that affects the lawfulness of anything we did before you asked. Email support@leewyn.com and we'll sort it out ourselves, not via a support queue. If you think we've gotten something wrong, you can also complain to the Austrian data protection authority (dsb.gv.at).

If we change how we handle your data, we'll update this page and move the "Last updated" date at the top. For anything material — a new processor, a new purpose — we'll say so plainly here rather than burying it in legal language.

ToModern e.U., Seitenstettengasse 5/37, 1010 Wien, Österreich — support@leewyn.com. Email us to review, update, or delete anything we hold about you.