Privacy

Fireleaf is built to keep your work on your PC. This page says what stays there and the little that leaves it.

Last updated 29 October 2026

What stays on your PC

Your conversations, projects, files, memory and settings.
Your models, and everything a local model reads or writes.
Your plan: it is a signed file Fireleaf checks on your PC, with no call home to check it.

An account is optional. When you create one, Fireleaf sends your email address, your password, whether you want product emails and your Fireleaf version to our server at reforgedpcs.com.
Our server hands the email address and password to Supabase Auth, the service that holds our accounts, and sends you a confirmation email through our email provider. It keeps your email address, your product-email choice, your Fireleaf version and your plan, so the plan follows you to every PC. It does not keep or log your password; Supabase Auth keeps it so you can sign in.
When you sign in, Fireleaf sends your email address and password straight to Supabase Auth and keeps the sign-in token it gets back on your PC.
If you forget your password, or ask for a new confirmation email, Fireleaf sends only your email address to our server at reforgedpcs.com. If that address has an account, our server emails it a link through our email provider; it gives the same answer either way. You choose a new password on that page in your browser, not in Fireleaf. Our server hands it to Supabase Auth and does not keep or log it.
When you sign in, start the free trial or buy a plan, Fireleaf asks our server at reforgedpcs.com for your plan file. That request carries your account and nothing about your work.

When you send a message from Account in Fireleaf, we receive what you wrote, its subject and category, and the version of Fireleaf you use. We keep the message and our replies so you can read the conversation in the app.
Nothing else from your PC is attached: no files, screenshots or conversations.

At home, your phone talks to Fireleaf on your PC directly over your Wi-Fi. Nothing passes through us.
If you switch on Away from home, a companion page that is already open on your phone can also reach your PC through a relay that runs on Supabase. Every message is encrypted on your phone or PC before it leaves, so the relay cannot read your prompts, replies or approvals.
The relay does see that a phone and a PC are talking: a random channel id and the size and timing of each message. It does not keep the messages.

Only if you turn on Notifications in the companion page on your phone. Your phone's browser then gives Fireleaf on your PC an address at the browser's push service (Apple, Google, Mozilla or Microsoft, depending on the phone), which your phone sends to your PC encrypted, like every other message.
When Fireleaf needs your approval or a run ends, your PC sends the notification to that push service, which delivers it to your phone. Each notification is encrypted for your phone and contains no prompt text, replies or code: only "Fireleaf needs your approval", "Fireleaf finished" or "Fireleaf hit a problem", and an id for the thread. The push service sees that a notification was sent to your phone and when, but cannot read it.
No account is involved, with us or with the push service. Turn notifications off on your phone, or choose Forget this PC, and your PC stops sending them.

Usage statistics, only if you turn them on in Settings. They never include what you type or what Fireleaf writes.
Cloud models, only if you add one with your own key: the conversation you send to it goes to that provider, under the spending cap you set.
Downloads and updates: Fireleaf asks for model files and app updates (our update files are stored on Supabase), and the browser visits the pages you or Fireleaf open.

Payments are handled by Stripe in your browser. Fireleaf never sees your card.

Send us a message from Fireleaf, or reach us through reforgedpcs.com.