01 / Access
Who sees your lead
Story leads are not public. The board, the feed, and lead detail are visible only to the newsroom’s verified journalists (Leed staff can moderate a tip’s text, never its source). Those pages show the story, its location, a public-interest summary, beat tags, and a signal word. Nothing on them says who sent it.
Your submission receipt shows you triage progress and a signal tier without exposing anything publicly.
Sherlock’s research searches public sources using the tip’s text, never your identity. Locations are looked up with OpenStreetMap and stored only at neighborhood level.
Services that process tips for Leed: Anthropic (reading the tip text and research, with emails and phone numbers removed first; a newsroom can run its own model instead, and then no outside AI reads its tips), OpenStreetMap (location lookup), Resend (alert emails) and Twilio (text messages). A link sent by text message is kept in Twilio’s message logs.
02 / Identity
What stays private
Your name, how to reach you, your files and your messages are locked in your browser before they’re sent, with keys Leed never holds. A verified journalist can ask to reach you; you accept or decline with your codename, and only accepting unlocks who you are for that newsroom. How it works, and its limits, are on the security page.
03 / Retention
How long each kind of data is kept
- Raw intake conversation
- The verbatim intake transcript expires after 90 days by default. The normalized newsroom lead can remain while it is active or needed for editorial and safety review.
- Story lead fields
- Title, body, location, non-contact source display metadata, AI summary, beat tags, and vote totals are visible to verified journalists while the lead is active or needed for newsroom review. They are not published to the open internet.
- Who the source is
- A name and how to reach you are locked in your browser before they're sent; Leed stores only the locked copy, which no one at Leed can open. It opens for a reporter only after you accept their request, and it's deleted after 180 days without activity on your tip.
- Alert email and phone number
- If you ask for email alerts, or send a tip by text message, Leed keeps that address or number readable so it can reach you. It's deleted after 180 days without activity on your tip.
- Evidence files and messages
- Files and relay messages are locked to the newsroom's approved devices before they leave your browser. Messages are deleted after 180 days; files after 365 days, sooner if the newsroom keeps them on its own server and deletes them there.
- Rate-limit records
- A one-way code made from your internet address, changed every day, kept for at most two days so the intake can't be flooded.
- Sensitive and held leads
- Spam, PR, serious accusation, privacy, minors, whistleblower, medical, legal, or otherwise sensitive leads can be held for human review before discovery.
- Audit and safety records
- Admin actions, reports, and moderation decisions are retained so newsroom owners can explain why a lead was held, restored, removed, or routed.
Customer newsroom contracts may set shorter retention periods. A source can permanently delete the lead, evidence, and receipt directly from their private source desk.
04 / Requests
Review, correction, export, or deletion
A source, newsroom owner, or authorized administrator can request review, correction, export, or deletion. Include the tip link or enough context to locate the record.
For urgent source-safety, legal, takedown, account, or access issues, write to hello@leed.media. Production customers name an owner for incident response before launch.