LeanTo™

Privacy Policy

Last updated: June 22, 2026

This Privacy Policy describes how Anvil Systems LLC (“Anvil Systems,” “we,” “us”) collects, uses, and shares information when you use LeanTo™ (the “Service”), available at leanto.dev. By using the Service, you agree to the practices described here.

1. Who we are

LeanTo is operated by Anvil Systems LLC, a Tennessee limited liability company. For privacy questions or to exercise your rights described below, contact us at support@leanto.dev.

2. What data we collect

We collect the following categories of information:

  • Account information. Your email address, display name, a hashed copy of your password (we never store the plaintext), and, if you sign in with a social provider, the provider name and the unique account identifier they share with us.
  • Workspace and board content. Boards, columns, cards, comments, attachments, labels, custom fields, and any other content you or your collaborators create inside the Service.
  • Usage logs. IP address, user agent string, request timestamps, requested URLs, and similar technical metadata generated automatically when you interact with the Service. We use this data to operate, secure, and troubleshoot the Service.
  • Billing information. Subscription plan, billing email, and invoice history. Card numbers and other payment instrument details are handled by our merchant of record (see Section 4) and are not stored by LeanTo.
  • Support communications. When you email us or submit a support request, we retain that correspondence so we can follow up with you.

3. How we use it

We use the information we collect to:

  • Provide, maintain, and improve the Service;
  • Authenticate users and protect accounts from abuse;
  • Process subscriptions, invoices, refunds, and tax obligations;
  • Send transactional email (account verification, password resets, invitation notices, billing receipts, security notifications);
  • Respond to support requests and other inquiries;
  • Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service; and
  • Comply with legal obligations.

We do not sell personal information. We do not use your workspace content to train machine-learning models.

4. Third parties

We rely on a small set of vetted service providers to operate LeanTo. Each one only receives the data needed to perform its role.

  • Paddle— merchant of record for subscriptions, payment processing, sales tax, and invoicing.
  • Resend— transactional email delivery (verification, password reset, invitation, billing notifications).
  • Fly.io— application hosting, networking, and deployment.
  • Neon— managed Postgres hosting for account and workspace data.
  • GitHub and Google— OAuth identity providers, used only if you choose to sign in with one of them.

We may add or change processors over time. Material changes will be reflected in the list above and announced through the Last-updated date at the top of this page.

5. Lawful basis for processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information under the following lawful bases set out in Article 6 of the GDPR (and the equivalent UK GDPR provisions). These map to the purposes described in Section 3.

  • Performance of a contract. Providing, maintaining, and securing the Service; creating and administering your account; storing your workspace and board content; and processing your subscription, invoices, and refunds.
  • Legitimate interests. Protecting accounts and the Service from fraud and abuse; detecting, investigating, and preventing security incidents; troubleshooting and maintaining usage logs; and improving the Service. We balance these interests against your rights and freedoms.
  • Legal obligation. Retaining tax and billing records for the periods required by law (see Section 7) and responding to lawful requests from authorities.

Where we rely on consent for a specific processing activity, you may withdraw it at any time without affecting processing that already took place.

6. Cookies and tracking

LeanTo uses only strictly-necessary cookies. We do not use any third-party analytics, advertising, or cross-site tracking cookies, and we do not load any analytics or tracking scripts.

  • Session cookie. A NextAuth session cookie keeps you signed in after you log in.
  • CSRF token cookie. A cross-site request forgery token cookie protects the login and sign-in flow from forged requests.
  • Local storage. We store small UI preferences (for example, your light or dark theme, via next-themes) in your browser’s localStorage. This stays on your device and is not transmitted to us as a cookie.

Because these cookies are strictly necessary to operate the Service and authenticate you, they are set without a separate consent banner. We set no cross-site trackers.

7. Data retention

  • Active accounts. We retain account and workspace data for as long as your account is active.
  • Deleted accounts. When you delete your account, we retain the data for up to 30 days to allow recovery from accidental deletion and to handle billing reconciliation, then we purge it from our production systems. Backups containing that data age out within an additional 30 days.
  • Billing records. Invoices and related billing records are retained for 7 years to satisfy U.S. tax recordkeeping requirements, regardless of account status.
  • Security logs. Authentication, request, and error logs are retained for up to 90 days unless required for an open security investigation.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email support@leanto.dev from the address associated with your account. We will respond within 30 days. We will not charge a fee for reasonable requests, and we will not retaliate against you for exercising your rights.

Many of these requests can be self-served from your account settings (for example, editing your profile or deleting your account).

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the following rights regarding the personal information we collect (the categories described in Section 2):

  • Right to know. Request the categories and specific pieces of personal information we have collected about you, the sources, and the purposes for collecting it.
  • Right to delete. Request that we delete personal information we have collected from you, subject to legal exceptions.
  • Right to correct. Request that we correct inaccurate personal information we maintain about you.
  • Right to opt out of sale or sharing. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of.
  • Right to non-discrimination. We will not discriminate against you for exercising any of these rights.
  • Authorized agent. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and ask you to verify your identity directly.

To exercise any of these rights, email support@leanto.dev from the address associated with your account.

10. Security

We protect your information with industry-standard controls, including:

  • bcrypt password hashing for credential-based logins;
  • HTTPS for all traffic between your browser and the Service;
  • Encrypted secrets and database connections at rest and in transit;
  • Role-based access control inside the Service so members only see boards they belong to;
  • Audit logs of authentication events and administrative actions to support incident response.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

11. International transfers

LeanTo is operated from the United States, and the data we collect is stored and processed in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States. Where required for transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or another lawful transfer mechanism with each processor listed in Section 4.

12. Children

This service is not directed to individuals under 16. By using LeanTo, you represent that you are at least 16 years old.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the Last-updated date at the top of this page. For material changes, we will provide additional notice through the Service or by email before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

14. Contact

Questions about this policy or our privacy practices? Email support@leanto.dev.