How it works

What happens after you tap Share.

A plain account of what runs where: on your phone, on our server, and at the AI provider that does the reading. What leaves your phone, and what never does. And what happens to a Dig Deeper before you see a word of it.

Describes The Lede 1.0.5 for iPhone and iPad, and our server as it ran on November 3, 2026. Last updated November 3, 2026. The privacy policy is the binding record of what we collect; this page explains the machinery behind it.

Part 1 of 3

From the share sheet to the desk.

The Lede has no feed and no browser of its own. Everything starts when you share an article to it.

On your phone: You tap Share

The share extension takes the headline, the web address and the article’s text from the page Safari has open.

Web address, headline, text

Our server: It checks there’s an article

At least 500 characters of text, or it fetches the public page itself.

Headline and text. The web address too, only for a Dig Deeper or an opinion piece.

Our AI provider: The desk reads it

A new headline for what it argues, its beat, and the author’s strongest honest case.

Deletes the text within 30 days, unless it flags a piece for safety review or the law requires a longer hold. Our contract bars model training on your text.

The brief

Our server: A cache that deletes itself

A one-way fingerprint and the brief, for 14 days at most. Never the article’s text.

The brief

Your iCloud: Saved to your iCloud

Your library lives there. It never reaches our server.

Figure 1. Saving an article. The tinted column is yours: your phone and your iCloud. Everything to its right is ours or our provider’s. The ember dot marks the one step where AI does the work.

You share. In Safari, the share extension takes the article’s text from the page Safari has open, with its headline and web address. The app has no browser inside it, so it keeps no cookies and no sign-ins of its own. From other apps it usually gets only the link.
Our server checks there’s an article. It uses your phone’s text when there are at least 500 characters of it. If there aren’t, or it only has a link, it fetches the public page itself. It never signs in anywhere, and it doesn’t go through archive sites to get past a paywall.
The desk reads it. Our AI provider gets the headline and the text and writes the brief: a new headline for what the piece actually argues, its beat, and the author’s strongest honest case. When a piece is filed in its publication’s opinion section, the brief is built from the reporting underneath it, and shows you the reporting it used.
The brief comes back to your phone and is filed in your own iCloud. Our server keeps a one-way fingerprint and the brief in a cache that deletes itself within 14 days, so the same article isn’t read twice. It never keeps the article’s text.
Dig Deeper starts when you tap it. The server searches for research and reporting around the piece, and the desk writes from what it finds. Part 3 is how that is checked.

The app holds no keys to our AI or search providers and runs no model. Every call to the AI provider and to the search providers is made by our server, never by your phone.

Part 2 of 3

What leaves your phone, and what doesn’t.

There is no account: no name or password to create, and the app never asks for your email, apart from a Kindle address you choose to save.

What	Goes to	How long it’s kept
The article’s web address, headline and text	Our server	The text is never stored. A one-way fingerprint and the brief sit in a cache that deletes itself within 14 days (7 for a Dig Deeper). The raw web address is never kept in our databases.
The headline and text	Our AI provider	Deleted within 30 days, unless it flags a piece for safety review or the law requires a longer hold. Our contract bars model training on your text.
The web address	Our AI provider	Only for a Dig Deeper, or when the piece is opinion or commentary.
The headline	A web search provider	For some stories, to gather context.
A random device identifier and an Apple push token	Our server	While the app is installed and registered. The device’s secret is stored only as a one-way hash.
Usage data, keyed to that identifier and an opaque iCloud identifier	Our server	Up to 13 months, then deleted automatically. Never your name or email, never sold.
A subscription you buy	Apple, which tells our server about a trial, renewal, cancellation or refund	The Apple transaction identifier, while the subscription is active and for a limited period after.
Your library: articles, briefs, highlights, reading history	Your own iCloud	It never reaches us.

Table 1. Everything that leaves your phone when you use The Lede, where it goes, and how long it’s kept. Drawn from the privacy policy, which names each provider.

The steps we take

No browser inside the app. In Safari, capture runs in the page you have open. The Lede keeps no cookies and no sign-ins of its own.
Raw page text is dropped. If the share extension can only get a page’s raw text rather than the article, that text never goes to our AI provider. It is dropped on your phone and again on our server, because a signed-in page can carry your account name.
Fingerprints, not articles. Our server keeps a one-way fingerprint of the text and of the web address, never the article’s text and never the raw web address, which passes only briefly through our host’s operational logs.
Your library is yours. Your saved articles and highlights live in your own iCloud, not on our servers. We never receive your library.
Results go only to the phone that asked. A finished Dig Deeper is pushed only to the device that requested it. Each device registers with a random identifier we make, never its hardware ID, and its secret is stored only as a one-way hash.
Usage data is pseudonymous. It is keyed to a random identifier for your device and an opaque iCloud identifier from Apple, never your name or email. It is deleted after 13 months at most, and we never sell it.
No ads. No third-party trackers. The app contains no third-party advertising or analytics SDKs.

Your switch

In the app’s own Settings, under Privacy, switch off Sending articles to the desk. From then on, articles you save stay on your phone and land without a brief, and nothing goes to our AI provider.

The privacy policy is the binding record. It names every service provider that handles your data and how long each piece is kept. If this page and the policy ever disagree, the policy is right and this page is a mistake we will fix.

Part 3 of 3

What the desk reads, and how a Dig Deeper is checked.

How The Lede handles sources

Our standard for sources, as we have published it. This part was a page of its own; its old address now brings you here.

The Lede reads whatever you save, from whoever published it, and hands you the strongest honest version of what it argues. It doesn't rank outlets and it doesn't keep a list of ones it won't touch. The standard is that every source gets the same treatment.

Every source, as it is

There's no blocklist and no quality gate. The Lede doesn't judge a piece by who published it. The Wall Street Journal, The New York Times, Fox, MSNBC: a story from any of them is read on its own terms, and the brief is the fairest case for what that story is actually saying. If you saved it, we brief it.

The one thing it changes

When a piece is opinion or commentary rather than reporting, The Lede builds the brief from the original reporting underneath it, not from the columnist's framing of it. That's the only move, and it's the same at every publication. What tells us a piece is opinion is plain and neutral: it's filed in the publication's own opinion section, right there in the web address. That signal says nothing about the politics. When it happens, the brief shows you the reporting it used. Nothing is swapped behind your back.

When you ask it to dig deeper

Ask The Lede to dig deeper and it goes looking for what the original piece left out. It reaches past the source on purpose: international reporting, and peer-reviewed or primary research over more of the same commentary. How the rest of the world covered a story, and what the underlying study actually found, usually tells you more than another take from the same vantage point.

Where we stand

We don't rank the press and we don't referee who's trustworthy. Every source gets read straight. The only time The Lede reaches past what you saved is to trade a columnist's opinion for the reporting it stands on, on a signal that treats every outlet the same, and it shows you when it did. That's the whole standard.

How a Dig Deeper is checked

A Dig Deeper is written from search results, and writing from sources can still go wrong: a finding stated backwards, a number that is off, a quote credited to the wrong outlet. So before a Dig Deeper reaches you, every sentence goes through these steps.

Server: The server searches.
It looks for research and reporting around the piece, and keeps the results it can show you as sources.
Stops here
No results it can show you, no Dig Deeper. Nothing is written, and it isn’t counted.
AI: The desk writes from those results.
It cites each result by number as it writes.
Code: Code looks for each quote and figure in the result it cites.
Anything it can’t find there is flagged.
AI: A separate check reads every sentence.
Run apart from the writing, it reads each sentence beside the result it cites, with code’s flags in hand, and gives a verdict on every one.
Stops here
If the check errors, or skips a sentence twice, the Dig Deeper fails and isn’t counted. You never get unchecked text.
Code: Code applies fixed rules.
Each verdict has one outcome, set out in the table below. A figure found in none of the results, and not in your own brief, is cut, whatever the check said. A quote found nowhere loses its quote marks and is checked again, or is cut.
Code: Enough has to survive.
The section on what others found must keep at least one checked sentence, and the desk’s conclusion must pass its check.
Once more, then stops
Too little left, and the desk tries once more on the same results if there’s time. If that falls short too, the app says HELD BACK · NOT COUNTED.
Server: It reaches you.
The citation numbers come out, every source is listed with a link to the original, and only now is it cached.

Figure 2. A Dig Deeper, from search to your screen. AI does two jobs here, writing and judging. The rules that decide what happens to a sentence are written in code, and the AI can’t change them.

What the check finds	What happens
Supported by the result it cites	Kept.
The desk’s own reading, adding no fact the sources don’t state	Kept.
An other angle that is wrong or unsupported	The whole angle is cut.
A sentence about what others found that is wrong or unsupported	That sentence is cut.
Credited to the wrong source	Re-credited to the right one, or cut.
Quote marks around words the source doesn’t use, though it says the same thing	The quote marks come off. The sentence is checked again and kept only if it passes.
The sources genuinely disagree	Rewritten as a disagreement with each side credited (one source reports this, another finds that), or cut.
The desk’s conclusion leaned on something that was cut	Rewritten once and checked again.
A quote or figure that appears in none of the results	A figure is cut by code. A quote is cut, or loses its quote marks if the check found the sentence sound, and is checked again.

Table 2. What the check can find, and the one thing code does about each.

Code has the last word only where it can be sure. A figure that appears in none of the results, and not in your own brief, is cut by code whatever the check said. A quote like that never reaches you as a quote. Anything subtler, like a paraphrase or a restated number, is the check’s call, because code can’t judge it.

The rules don’t change themselves. Code knows that 2 tablespoons and 2 tbsp are the same amount, and that one tablespoon isn’t. When the check and code disagree about a quantity, the pair is saved with no article, link or reader attached, and a person decides whether to add it, in a reviewed change. Saved pairs are deleted after 90 days.

Only checked text is kept on our server. A Dig Deeper is cached only after it passes, for 7 days at most. Our server never stores text from a Dig Deeper that failed.

What these steps can’t promise

The check reads each sentence beside the source it cites. It can’t tell you whether that source is right, and like any reader it can miss something. So every source is listed, every Dig Deeper ends with a row to report a problem, and the app says it plainly above every source list: The desk wrote this from the sources below. It can get one wrong, so check the ones that matter to you.

A brief, the desk’s reading of the one article you saved, doesn’t go through these steps.

Reporting a mistake

If a brief or a Dig Deeper gets something wrong, tell us. Every Dig Deeper has a Report a problem with this Dig Deeper row, and you can email support@theledeapp.com about any brief. We read every report, and we can remove a Dig Deeper from our temporary cache so it isn’t shown again.