Privacy policy
The short version: we collect the minimum to make the super-app work, we never touch your Rockstar account, and we never sell what we have.
What we collect
When you join the waitlist, we store your email address, your referral code and position, and any referral code you used. The waitlist also stores a hashed IP address and browser user-agent string to help manage abuse. Waitlist records are stored in Supabase. Crew matching preferences save on your device and can be included in private workspace sync you choose. When you publish a crew, its name, handle, description, Discord invitation, platform, schedule, member count and recruitment preferences are stored in Supabase and shown publicly.
What we never collect
We do not ask for Rockstar credentials or access your console saves. We do not sell or trade waitlist data. The service providers described on this page process the information needed to operate accounts, workspaces, community features, the waitlist and email delivery.
Personal records and community posts
Stat tracking, session analytics, combat practice and garage goals use records you enter yourself. These save on your device; signing in lets you choose to save a private workspace in Supabase. Marketplace posts, session radar invitations and leaderboard submissions store the fields shown in their publish forms and display them publicly, including your chosen handle, evidence link and Discord invitation. Scores show whether a moderator has reviewed submitted evidence. We do not import live game telemetry.
Setup, bookmarks and saved searches
Guided setup stores your platform, matching timezone, chosen goals and dismissal state. Recommended tool pins and crew matching preferences are applied only when you save the selected setup options. Bookmarks store real crew or marketplace listing IDs and your chosen labels; saved searches store their names, directory filters and matching preferences. These work as guest saves on your device and are included in optional private workspace sync and backups. Refreshing bookmarks requests the current public listing; removed or hidden listings do not reveal private profile fields. Saved-search links include their criteria in the URL, so recipients can read those criteria.
Optional accounts and cloud saves
Email accounts use Supabase Authentication, which stores your email, password hash and display name. Discord sign-in is available only when configured and uses the profile data permitted by that provider. Session and refresh credentials use HTTP-only cookies. Your private cloud workspace contains the plans, records, drafts and preferences you choose to save or sync. Community posts created or claimed while signed in can be managed from another device. RSVP records associate your account with a session, but public listings expose counts rather than attendee identities.
Account security, export and deletion
Account settings provide an export of your account profile and account-linked website records, including the cloud workspace, owned listings and ledgers, crew activity, reports, appeals and inbox preferences. Active-session management stores your account and verified session IDs, a coarse browser/device label and creation, last-seen and revocation times. Optional authenticator setup uses Supabase TOTP; once enrolled and verified, authenticator verification is required for administrator access and sensitive account or authenticator changes. Email changes and account deletion also require your current password. Deletion removes the login and account-linked website data. Limited moderation action history remains with deleted account links detached and associated private review text removed. Browser saves remain until cleared; deleting an account does not remove a separate waitlist signup.
Private crew coordination
Joining a managed crew stores your account ID, display name, membership status and role. Join requests include the message you submit. Invitations, announcements, scheduling polls and vote selections are stored in Supabase. Active crew members can see the managed roster, announcements and aggregate poll results; each member can review their own selections. Owners and leaders can review pending requests and manage memberships according to their role. Public crew profiles expose member counts rather than the private roster or vote choices. Website membership does not connect to or change an in-game crew.
Activity inbox, reports and appeals
Account activity notifications and their read state are stored privately in Supabase. You can manage inbox entries and choose enabled categories or event types in the app. Activity updates are delivered inside the website, without external email or browser push. Reports store the reason, details and optional evidence you submit; signed-in reporters can follow their own reports. Affected owners can review relevant decisions and submit eligible appeals with private notes and optional evidence. Authorized moderators review these records and retain an action history. Private reports, appeals and review text are not displayed in public directories.
Private administration and anonymous tool totals
Authorized administrators can view separate waitlist and account signup records, export the current page as CSV, and review aggregate account activity and tool usage. Access requires a confirmed account on a server-configured account-ID or email allowlist, plus authenticator verification when enrolled. Anonymous tool counters store only a UTC day, tool name and opening or failure totals; they retain no request, account or session identifiers, IP addresses, user-agent strings, questions, plan contents or error text. Counting is enabled by default. Turn off “Include this device in anonymous tool totals” in My Leonida to opt out. This device preference can be included in your private workspace sync and backup. Signed-in session records are separate from these anonymous counters.
Shared expense ledgers
Publishing a ledger stores its member names, contributions, expenses and transfers in Supabase. It is accessible to its owner and anyone holding an unexpired invitation. View and edit invitations have separate permissions and can be revoked. Invitation credentials are stored as hashes on the server; use care when sharing the link. Ledger data does not process payments.
Co-Pilot assistance
Local planning reads saved records on your device without sending them to an AI provider. When you enable configured AI assistance, your question and the relevant site reference are sent through Vercel AI Gateway to the configured model provider. A bounded summary of your session totals, five recent plan names and garage goals is included only when you select the records-sharing option. The app does not persist your chat on the server. Provider retention follows the configured service's policies. Conversation history stays in the current tab unless you export it.
Voice rooms
Joining a voice room requires your microphone permission. Supabase stores your chosen display name, room membership and temporary connection messages so participants can connect. Audio uses WebRTC between participants, or through a configured TURN relay, and is not recorded by this app. Connection messages can include network addresses; peers and STUN or TURN providers may receive them. Room invitations grant access to anyone with the link. Presence expires after 45 seconds without an update; stale presence and connection messages are removed when rooms are joined. Connection messages expire from cleanup after 10 minutes. A temporary HTTP-only cookie authorizes your room connection.
On-device storage
Setup preferences, listing bookmarks, saved searches, recent tools, anonymous-counting preferences, crew preferences, community drafts, saved plans and builds, personal session and combat records, vehicle comparisons, race times, map favorites, garage goals and guide checklist progress use local storage. Publishing as a guest sets an HTTP-only management cookie; signing in can claim those posts for cross-device management. Clearing an unclaimed cookie removes guest management access. Shared planning links contain the plan in the URL, so recipients can read it. An optional service worker caches public pages and assets for offline use; it does not cache account pages, admin pages or API responses. A referral code may be remembered in session storage. Clear entries through your browser's site-data settings. These tools do not set advertising cookies.
Welcome emails are sent through Resend when email delivery is configured. The message includes your signup number and referral link and is addressed to the email you provide. You can request waitlist removal by replying to a welcome email or contacting the address below. Crew and community owners can remove their listing from the browser they used to publish it.
Children
iloveleonida is intended for an adult GTA audience and is not directed at children under 13.
Contact
Questions or removal requests: privacy@www.iloveleonida.com.
Last updated 2026-10-08