Security

Data in transit

The website, the app and our API are served over HTTPS. Sign-in, session traffic and file uploads are encrypted in transit.

Your account

If you sign up with a password, we store it only as a bcrypt hash, so nobody at Leren can read it. If you sign in with Google or Discord, they handle the authentication and we never see your password. Signing in gives your device a token rather than a cookie, and signing out or clearing your app data removes it.

Screen sharing

Screen sharing never starts by itself. You pick the window or screen, your system asks you to confirm, and you can stop at any moment. Each turn’s screenshot is sent to answer the question you asked. A screenshot captures whatever is in that window, so close anything private before you share.

Your files and recordings

Audio, screenshots and uploaded files are stored on our servers, not in a public bucket, and are served only through an authenticated route that checks the file belongs to you. Session history can be switched off in Settings, which deletes the tutoring sessions stored on your account.

Access

A small number of people at Leren can reach the systems holding personal data, and that access exists to run and fix the service. Our internal dashboard is limited to counts and labels, and shows no transcripts, audio or screenshots. Our team works from the United States and Japan, so access happens from both.

Error monitoring

We use Sentry to tell us when the server hits an error. It is deliberately configured not to send personal data, and request bodies, cookies, authentication headers and query strings are stripped before anything leaves our server.

Third parties

We keep our third-party surface small. There is no advertising, no ad tracking and no third-party analytics anywhere in Leren; the usage figures we look at are our own. The providers we do use, and what each one receives, are listed in our privacy policy.

If something goes wrong

If we discover a security breach that affects your personal information, we will tell you without undue delay, explain what happened and what we are doing about it, and notify the authorities where the law requires us to.

Reporting a vulnerability

If you believe you have found a security issue, please email security@tryleren.com before disclosing it publicly, and give us a reasonable chance to fix it. Please include enough detail to reproduce the issue. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and do not access or modify data beyond what is needed to demonstrate the problem.

Please do not run automated scanning that degrades the service, access other people’s accounts or data, or use social engineering against our team or users.