Privacy Policy

Last updated: September 12, 2026

What we store

• Your phone number, used as your account identifier.
• A monthly usage counter per phone number, automatically deleted after roughly 40 days.
• For Plus subscribers: the link between your Stripe subscription and your phone number, kept while your subscription is active.
• If you use the signup form on this site: the number you enter is used once to send the welcome text, plus short-lived anti-abuse counters (your number and connection address, deleted after 24 hours).
• If you text FEEDBACK or use the contact form: the note you send (and, for the contact form, the name and email you optionally provide) is stored until we've read and acted on it, then deleted within 180 days.

We do not store your questions or answers on our servers - every message is answered on its own, on every plan, and no conversation history exists. The one exception is notes you explicitly send us via FEEDBACK or the contact form, as described above.

Who processes your messages

• Twilio carries the SMS traffic and, like all SMS providers, keeps message logs under its own policies.
• OpenAI processes your question text — and any photo you text in — to generate answers, under its API data policies (API inputs are not used to train models by default). For fact-heavy questions the answer may be produced with OpenAI's web-search tool; the question still goes only to OpenAI, same as any other answer. Photos are not stored by GumLeaf; like all MMS, they pass through Twilio under its own retention policies.
• Stripe handles all payment and subscriber information; we never see your card details.
• Cloudflare hosts the service infrastructure.
• Live-data lookups go to their sources with only the thing you asked about, never your identity: place names to Geoapify (the place you typed, nothing else), weather to the US National Weather Service and MET Norway (coordinates), tide times to NOAA (a station id), air quality to EPA AirNow (coordinates), train times to the MTA, BART, and 511.org (a station name), Norwegian departures to Entur (a stop name), and flight status to AeroDataBox and the FAA (a flight number).

What we don't do

• We do not sell or share your data with advertisers.
• We do not send you promotional texts unless you ask for them: by default you get answers to your questions and account notices, nothing else. Occasional offers (such as plan upgrades or referral rewards) go only to people who checked the separate, optional marketing box on our signup form or requested them by keyword (for example, texting REFER).
• We do not track you across other sites or services.

Text messaging (SMS)

• Consent: you opt in by texting GumLeaf first, or by submitting your number in the form on this site and checking the consent box for answers and account notices. Marketing texts require a second, separate, optional checkbox — leaving it unchecked never limits the service. GumLeaf never texts you unsolicited.
• Message frequency varies with your use: you receive one reply for each question you send, plus occasional account notices such as a welcome text or a subscription confirmation.
• Message and data rates may apply, depending on your mobile carrier and plan.
• Opt out by replying STOP at any time to stop all messages, or HELP for help. STOP is handled at the carrier level.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The only parties that ever handle your number are the service providers listed above (for example, Twilio to deliver the SMS), and only to operate GumLeaf.

Opting out and deletion

Text STOP to stop all messages (handled at the carrier level). To request deletion of the small amount of data we hold about your number, send a note through our contact form.

Changes

If this policy changes materially, the updated version will be posted here with a new date.