Privacy policy

Last updated 24 August 2026

LebEx is built so that the people running it cannot read your private messages. That is a design decision, not a promise about our conduct, and the rest of this page explains where it holds and where it does not.

Your messages

Private messages are encrypted on your phone and decrypted on the other person's. The keys are generated on your device and never leave it, so there is nothing on our side to read, hand over, or lose. We can see that a message moved between two accounts, and roughly when. We cannot see what it said.

Signing out wipes the keys on that device. Messages already on it become unreadable, which is the point, and it means a signed-out phone is not a copy of your conversations.

What is public inside the app

Posts, comments, communities, place listings, landing answers and vouches are not private. They are written to be read by other people in your city, they carry your name, and moderators can see them. That is the point of all six: an answer nobody can read helps nobody, and an anonymous vouch is a star rating. Do not put something in one of them that belongs in a message.

Your progress through the landing is not

How far you have got with each of the twelve steps — residency, a bank account, a passport renewal — is readable by one person, and that is you. It is not on your profile, it is not derivable from anything public, there is no total and no leaderboard, and a moderator cannot see it either. Whether somebody has sorted out their immigration status is not a social signal.

What we hold

An account needs an identifier, so we hold whichever you signed in with: an email address, an Apple relay address, or a phone number. Your display name, username, the city you are in and the town you are from, if you filled those in. A profile photo if you added one.

Signing in with Google tells Google that you use LebEx, because their code runs on your phone to do it. Sign in with Apple tells Apple the same, and lets you hide your real email address from us. A phone number means an SMS, which your carrier can see.

Your address book

Never uploaded, and the app never asks for it. People find each other by username, an invite link or a QR code. Harvesting a phonebook is a permanent cost paid by everybody in your contacts, none of whom agreed to it.

Where you are

A city and a country, and nothing finer. There is no field anywhere in our database that could hold a coordinate, so a modified app could not publish your precise location even if somebody built one. You can also keep your city off your public profile, or stay out of the people directory entirely, from Settings.

Who you know

Places are ranked by whether you have messaged the person who vouched for them. That is worked out on your phone, from the conversations already on it, and is never sent anywhere. We do not build a graph of who knows whom, and there is none to leak.

Notifications

A notification says that something arrived. It does not carry the message text, because we have never seen it, and it deliberately leaves out who sent it. Notifications appear on lock screens, which is exactly when somebody other than you is most likely to be looking.

This website

No analytics load until you say yes. If you decline, nothing is loaded and we remember the refusal so the banner stops asking. You can change your mind from the footer at any time. We do not run advertising or third party trackers here.

Deleting your account

Settings has a delete option. It removes your profile, releases your username, deletes your devices and their queued messages, and takes you out of the communities you joined. Messages already delivered to somebody else's phone are on their phone, and we cannot reach them.

Children

LebEx is for people aged 13 and over. It has no features directed at children.

Contact

Questions, or a request about your data: hello@kodefoundry.com.