Privacy at Ledger

Information you choose to put in Ledger

Ledger stores the financial records you import or enter, including transaction dates, descriptions, amounts, categories, accounts, personal shares, reconciliation links, import metadata and original parsed row data. These can include sensitive information about you and other people in shared-expense records. Only import information you are entitled to use.

Uploaded statements are processed in server memory; the application does not intentionally retain the original uploaded file. The parsed records are saved in the hosted database. Ledger does not connect directly to your bank or request bank login credentials.

Google sign-in and essential storage

You may optionally save a custom profile picture. Cropping happens in your browser before upload; only the small cropped picture is saved in private Supabase Storage after server-side image validation and metadata removal. It is shown only after authentication and syncs across your devices. The original selected file is not uploaded. Removing your custom picture returns to an initials avatar and deletes the current stored image; provider backups may follow separate retention periods. This does not change your Google account picture.

Google sign-in is used through Supabase Auth to authenticate the existing authorized owner. Google and Supabase process sign-in information such as your identity, email and basic profile. Ledger uses your account identity to restrict access to financial records. Public signup is disabled. Ledger does not add its own separate MFA challenge; your Google account security settings remain your responsibility.

Supabase session cookies keep you signed in. Browser local storage remembers interface preferences and your versioned cookie choice for up to 180 days. Rejecting analytics does not remove sign-in cookies. Signing out ends this browser’s Ledger session; it does not delete your account or financial records.

Hosting and service providers

Vercel hosts the application and handles web requests. Supabase hosts the PostgreSQL database and authentication service. These providers process information needed to operate their services, including network information such as IP addresses and operational logs. Google handles Google sign-in. Providers may process data outside your country under their own terms and privacy policies; Ledger does not promise that all processing remains in one location.

See the privacy information from Vercel, Supabase and Google. Ledger is not designed to sell financial records or use them for advertising.

Optional AI assistant

The assistant is optional, uses AI Gateway credits and depends on provider availability. Opening the assistant does not itself send a question. If you choose to send one and the service is available, your question, recent conversation, account and category names, and relevant tool results may be sent through Vercel AI Gateway to the configured AI model provider. Tool results can include transaction descriptions, merchants, dates and amounts, not only anonymous totals.

Ledger records request timing/account information for rate limiting. The operator has not confirmed provider-specific AI retention or training terms, so do not assume zero retention or that submitted information is excluded from training. Avoid sending sensitive information and leave the assistant unused if you do not want this processing. Analytics permission does not authorize AI requests.

Optional Google Analytics

Analytics is off by default. No Google Analytics tag is loaded and no analytics request is sent by this integration before you accept analytics. Analytics also stays off unless the operator explicitly enables it after completing setup and provides a valid measurement ID, even if you accept. Your saved choice applies if analytics is enabled later; you can change it at any time. Google sign-in is separate and still contacts Google when you use it.

When enabled, Google Analytics 4 measures generic page views using sanitized route names, generic titles, cookie identifiers and browser/device information, along with basic session and engagement events generated by GA4. It receives your IP address as part of the network connection. This integration does not send account IDs, financial records, amounts, assistant messages, raw query strings, URL fragments, record identifiers or record-specific page titles. Advertising personalization and Google signals are disabled in the integration. Analytics cookies (_ga and _ga_*) are configured to last up to 180 days without extending their expiry on each visit.

Global Privacy Control and Do Not Track keep optional analytics off while enabled. Accept and reject are equally available. You can withdraw permission through Cookie preferences at any time. Withdrawal stops future tracking and removes accessible analytics cookies for this site; it cannot undo requests already sent or delete data Google has already received. Preferences apply to this browser, not all devices.

Configuration checked on October 19, 2026: Enhanced Measurement, Google signals, user-provided data collection and ads personalization are disabled. Optional account data-sharing settings are also off. User and event data retention is set to two months, with resetting retention on new activity disabled. This limit does not apply to Google’s standard aggregated reports, which may retain statistical summaries longer. The application sends its own sanitized page views, not automatic form, search, download or outbound-link events. These property settings are configured in Google Analytics and are not enforced by this application; changing them can expand collection beyond what this notice describes.

Retention, access and your choices

Financial records remain in the hosted database until you or the operator delete them; Ledger does not currently apply a fixed automatic deletion schedule. You can review, edit and delete records, undo imports where available, export your ledger, sign out, and decline or withdraw analytics without losing access. Clearing browser storage resets local preferences but does not delete server-side records. Backup, infrastructure-log, analytics and AI-provider retention periods have not all been confirmed; deleting a record in Ledger does not guarantee immediate deletion from provider logs or backups.

For account deletion, access/export help, correction, or questions about data already shared with a provider, contact the operator. Which privacy rights apply depends on your circumstances and location; this preview does not promise a particular legal status, response deadline or provider deletion guarantee.

Contact and updates

No verified privacy contact is configured yet. Use your existing private contact with the operator during the preview. The operator must provide a working privacy contact before opening this service to the public.

This notice may change as the preview evolves. Check the date above for updates. Material changes to optional analytics purposes require a new consent choice rather than silently expanding an existing permission.