How Leava works

It goes to the owner’s phone as a notification. You don’t need an app, an account, or to give any details about yourself. Notes are up to 280 characters.

No — and that’s deliberate. Every note gets the same “Message sent.” reply no matter what: whether the code is active, switched off, or was never set up at all.

It sounds unhelpful, but it’s the promise that makes the whole thing safe. If the page told you a code was live, anyone could scan a stranger’s QR code to confirm that a real person is behind it and paying attention. We refuse to answer that question — for you too.

No. Notes only travel one way. If you want to hear back, put your number or email in the note itself — that’s your choice to make, the same as writing it on a piece of paper.

Only what you type. We don’t collect your name, number, or account — you don’t have one. Behind the scenes we keep a scrambled fingerprint of your device purely to stop spam and blasting; it can’t be turned back into you, and the owner never sees it.

Yes — tap Add where you found it under the note and it drops a map link to your current spot into the message. Useful for the cases where “I found your bike” isn’t much help without a “…here”.

It only asks for your location when you tap that button, never when the page loads, and the link goes into the note as text you can see before you send. Don’t want to share it? Delete it like any other text, or just type a cross street instead.

It’s rounded to about 10 metres — enough to find a bike on a street, not enough to point at a doorway.

Yes. Every note is screened automatically — a keyword check and an AI classifier — before the owner is notified. Ordinary notes go straight through, including blunt ones: telling someone they parked badly is fine. Harassment and threats are stopped.

You won’t be told which happened to yours. The response is the same either way, deliberately — the same reason you’re never told whether a code is in use or whether anyone read your note. It isn’t evasiveness; it’s what stops this from becoming a tool for probing whose stuff is whose.

The web address is printed under it — type that into your browser instead. Both go to the same place.

Tap here — one tap creates it and it’s yours immediately. Print it at home; there’s nothing to order and nothing to pay.

Inside a window facing out is best — the glass weatherproofs it for free and makes it hard to peel. Otherwise laminate it (clear packing tape over the whole card works) before it goes outside. For a laptop, the lid or its sleeve. If you’d rather not display it all the time, keep it on the dash and put it out when you’re parked somewhere tight.

Add Leava to your home screen, then open it and turn notifications on. On iPhone this is required — Safari only delivers push to an installed app. On Android either works, but installing is more reliable.

The notification shows the start of the note itself, so you can tell a “your lights are on” from something that can wait without unlocking. That does mean a stranger’s words appear on your lock screen where anyone nearby could read them — if you’d rather they didn’t, most phones can hide notification content on the lock screen in their own settings.

Yes — a car, a bike, a boat, a laptop, whatever. Each gets its own QR code and its own inbox. You can name them, but those names are only ever visible to you; a stranger scanning your bike never sees “Dave’s bike.”

Right now your QR codes live with the device you set them up on, so losing it means losing access to them. Email recovery is built but not switched on yet. Until it is, if you replace your phone, print fresh QR codes from the new one.

Mute — notes still arrive in your inbox, your phone just stops buzzing. Reversible, same QR code.

Turn off — nothing is delivered at all. Reversible, same QR code. Good for something you’ve sold or parked up for the season.

Change the code — the kill switch. Your old QR code dies permanently and you get a new one, which means you have to print and replace the sticker. Use it when the code itself is the problem: someone won’t stop, and blocking hasn’t stopped them.

Why can’t the old code just point somewhere new? Because the code is the key, and everyone who scanned your sticker already knows it. Re-pointing it would leave them a working way in — which is the exact thing you were trying to end.

Open the note and block them — either on that one item or across everything you own. They’re never told; their notes simply stop arriving and they keep seeing “Message sent.” You can also report a note, or delete it outright.

Threats and abuse are also screened automatically before they ever reach you — see below.

Yes, in two passes, and both run before your phone ever buzzes. A keyword tripwire catches unambiguous threats and slurs. Then an AI classifier reads the note and sorts it into one of three outcomes: delivered normally, withheld, or dropped.

Rude is not the same as abusive, and the classifier is built to know the difference — “you parked like an idiot” is a normal note and gets delivered. Harassment, sexual content and targeted personal insults are withheld, so no notification fires and the note doesn’t appear in your list. Threats, doxxing and incitement are dropped outright.

If the check itself fails — the service is down, say — the note is withheld rather than let through. We would rather you miss a note than get one that should have been stopped.

No. Ordinary notes are read by the automatic check and by you, and by nobody else. There is no screen anywhere that lists them.

The single exception is a note you report. Reporting is a request for someone to look, so a reported note’s text does become visible to us — that’s the whole point of the button, and it’s worth knowing before you press it. Even then we see the text and nothing else: not which QR code it came from, not who owns it, not who sent it.

Two things. The sender’s standing drops, which is what puts a Flagged label on their future notes. And the note goes into a queue we review, where we can block that sender across all of Leava — not just your stuff, but everyone’s.

Reporting doesn’t block them for you on its own, so if you want them gone from your own items too, block as well. As with everything here, the sender is never told any of it.

Treat it as what the sender says, not as something we checked. A finder can drop a pin from the send page, and the tappable chip in the note opens that spot in maps — but nothing verifies it, and whoever sent it chose it.

Nearly always it’s exactly what it looks like: your bike, where they found it. But a location makes “come here” easy to write, so the same advice applies as for any note asking you to come somewhere — no rush, look from a distance first, especially at night.

That chip is the only tappable thing a note can ever contain. Everything else a stranger types — links included — is plain dead text on purpose, so nobody can send you somewhere you didn’t choose to go. And the chip shows the actual coordinates rather than a friendly label, so you can see where it goes before you tap.

New sender — first time you’ve heard from this device. Flagged — this sender has been blocked or reported before, so treat it with more suspicion.

Usually it’s exactly what it looks like — lights on, a window open. But an anonymous note asking you to come somewhere is worth a moment’s thought: there’s no rush, and you can look from a distance first, especially at night. We show that reminder above your notes for the same reason.

The note, which QR code it was for, and a scrambled fingerprint of the sender’s device for spam control. That’s it. No names, no number plates, no location history, no accounts for senders.

We don’t measure the page a QR code opens at all — no analytics run there — because a record of which code was scanned, where and when would be a movement log for your things. We’d rather not be able to produce one.

That’s also why a sender’s pin is part of the note rather than a field of its own. There is no location column to fill up: the coordinates are words in a message, they go when you delete it, and nothing can line them up into a history of where your bike has been. A single pin is a helpful detail; a list of them is the exact thing we’ve refused to be able to build.

Our database can — that’s how “block this sender everywhere” works. Nobody outside can. Each code is independently random, nothing about one hints at another, and no part of the site will walk from a code to its owner to their other codes.

Nowhere. Notes sent to a code that hasn’t been claimed are discarded rather than stored up for later. Claim a printed code before you stick it on anything.

Delete an item from its page and the QR code, every note on it, and its history are gone from our database for good. There’s no copy to ask us for.