Leaf Viewer by Ontiqo

Privacy Policy

Last updated 22 October 2026

1. Scope

This policy applies to the Leaf Viewer application (Leaf) and the website at leafviewer.app (the Website), both provided by Ontiqo Pty Ltd (ACN 701 340 418, ABN 38 701 340 418) of Daylesford, Victoria, Australia (Ontiqo, we, us).

2. The application

Leaf does not collect personal information. It has no analytics, telemetry, crash reporting or update check, and nothing in a document can make a network request. Documents opened in Leaf, and their names, are never transmitted from your computer. The only exception is the licence of a copy downloaded from the Website, described in section 4; copies from the Microsoft Store and the Mac App Store make no network requests at all.

  1. Documents. Leaf reads a document and displays it. It does not write to a file it opens, create a copy, upload anything or index your disk. It reads the file you ask it to open; while you browse in its Open panel, it also reads the folders shown there and previews the files in them. To draw a document in a typeface that Microsoft Office has downloaded to your computer, it reads that font.
  2. Settings. Leaf stores only your own settings: accent colour, zoom, text size, page width, typeface, line wrapping, sidebar and film size, the folder you last opened a file from, and a list of up to twelve recently opened documents (each with its path, name and the time it was opened) so that it can offer to reopen them. They are stored on your computer, in Leaf’s folder in your user profile, are not synchronised, and are removed when Leaf is uninstalled.
  3. Passwords. A password entered to open a locked document is used to open that document and is then discarded. It is not saved, logged or transmitted. While you browse inside a locked archive it is held in memory, so that each file need not ask for it again, and is discarded when you leave the archive.

3. Technical measures

  1. Leaf’s display engine runs under a content security policy of default-src 'none', which prevents it from contacting any address. Scripts, stylesheets, fonts and images may load only from within the installed application or from the document being displayed. A request from a document, such as a tracking pixel in an HTML file or SVG, is refused before it is made.
  2. Documents are sanitised before display. Scripts, event handlers, embedded frames and javascript: links are removed from every file, whatever its format.
  3. If you click a link in a document, Leaf passes that address to your default web browser. Leaf does not follow the link itself, and nothing is sent until you click.

4. Licences for downloaded copies

A copy downloaded from the Website works for 14 days without a licence, and nothing is sent while it does. If you buy Leaf, enter a licence key or sign in to an Ontiqo account, Leaf then contacts our licence servers:

  1. with a licence key: the key, an identifier for the activation, your computer’s name (so that you can recognise it in your list of computers), and the operating system, processor type and Leaf’s version, sent to Polar (polar.sh), which issues and checks the keys, when the key is entered and about once a day after that;
  2. with an Ontiqo account: a key Leaf makes for this computer and a signed request, sent to account.ontiqo.com about once an hour while Leaf is open, under the Ontiqo privacy policy;
  3. when you buy: the purchase is made on ontiqo.com in your web browser, and Leaf asks only whether it has completed.

A licence keeps working offline for 30 days. No document, file name or folder is ever sent.

5. Your Ontiqo account

You may sign in to Leaf with an Ontiqo account, the one account for every Ontiqo app; you never need to, and a licence key works without one. A licence bought while signed in belongs to the account and unlocks Leaf on up to 10 of your computers. The Ontiqo account service keeps:

  1. An account identifier and when the account was created.
  2. How you sign in. For Google, Apple or Microsoft: the user ID that service gives the app, and the email address it gives, which your account shows. For Sign in with Apple, also a token Apple issues so that your Apple sign-in can be revoked when you delete your account. For email: your email address, and, while a 6-digit code is waiting to be used, a hash of it, when it expires, how many tries it has had, and counts of recent codes so that they can be limited. Leaf signs in by email with a code; if you set a password in an Ontiqo app that offers one, a salted hash of a value your computer derives from it is kept, never the password.
  3. For each computer signed in: an identifier made on the computer, its public key, the app, the computer’s name, its platform, when it was added and when it last signed in.
  4. Purchases: the product, when it was bought, whether it is still active, and the purchase’s identifier from where it was bought (the Mac App Store, the Microsoft Store or Polar).

Purchases from the website are made through Polar (polar.sh), the merchant of record, which holds your email address and payment details under the Polar privacy policy; Ontiqo does not receive your card details. Your account at ontiqo.com/account shows your purchases and computers, and lets you remove a computer or delete the account. Deleting it deletes your Ontiqo account for every Ontiqo app: everything above that identifies you is erased at once, Apple sign-in tokens are revoked and every computer is signed out. A record of each purchase is kept without a link to you, so that a store purchase can be restored to a new account. Your files are never part of the account. The account service is also covered by the Ontiqo privacy policy. Cloudflare hosts it and handles request data under the Cloudflare privacy policy. To ask a question or for a copy of what is kept, write to support@ontiqo.com.

6. The Microsoft Store

Leaf is distributed through the Microsoft Store. Download, payment (if any) and updates are handled by Microsoft under the Microsoft privacy statement. Microsoft is the merchant of record.

Microsoft provides publishers with a reporting page, from which Ontiqo can see:

  1. the number of installations, by country, Windows version and device type;
  2. aggregate crash and hang reports, if Windows sent any;
  3. ratings, and the text and display name of any review you choose to publish; and
  4. payout totals, if Leaf is sold for a price.

This information is aggregated, except a review, which is public. Ontiqo does not receive your name, email address, payment details or IP address. This information is reported by Windows and the Microsoft Store, not by Leaf.

7. The Website

The Website consists of static pages hosted on Cloudflare Pages. It uses Cloudflare Web Analytics, which sets no cookie. It has no tag manager and no other embedded third-party content.

Cloudflare, as host, processes standard request logs, including IP addresses, to deliver the Website and protect it from attack, under the Cloudflare privacy policy. We do not read those logs and have built nothing on them.

8. Support requests

If you contact us, we hold your email address and the contents of your message for as long as it takes to resolve the matter. We do not add you to a mailing list; there is none. Requests made through the form at ontiqo.com/support are delivered to us by email through Purelymail and are also subject to the Ontiqo privacy policy.

9. Children

Leaf is suitable for any age. It collects no information from anyone, including children.

10. Changes

If this policy changes, the date above changes with it. If Leaf were to gain a feature that requires the network, that feature would be described in this policy first, would be optional, and would be off until you turned it on.

11. Contact and complaints

Privacy enquiries may be sent to privacy@leafviewer.com, or to Ontiqo Pty Ltd, Daylesford, Victoria, Australia. If you are in Australia and are dissatisfied with how a privacy matter was handled, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).