My recovery phrase leaked. What do I do?

Treat the vault as burned. A phrase cannot be changed or rotated, because the phrase is the key everything is encrypted under - so the fix is moving to a fresh vault. First, in the old account, export everything: Settings > Import & Export > Export > "PrivacyNotes backup (.zip)".

Sign out, create a new vault (new 12 words), and bring the export back in via Settings > Import & Export > Restore > "Full backup (.zip)". Then delete the old account from any device still signed into it: Settings > ID & Sync > "Delete account & data...". That removes its synced data and shuts out anyone holding the old phrase. If you signed in with Google or Apple, delete the old account first, then sign in with the provider again to start the fresh vault.

Two honest costs: an active storage add-on must be cancelled before deletion, and Pro is bound to the account it was bought on - it does not transfer to the new vault, and beyond the standard 30-day window this is not a refundable event. Prevention is cheap by comparison: keep the phrase in a password manager and nowhere else.