Privacy

Your account

• Your display name, and the email address your sign-in provider gave us. With Sign in with Apple that may be one of Apple’s private relay addresses rather than your real one.
• Optionally, and only if you enter them: a phone number, a Venmo username, a PayPal.Me username, a profile photo and a default currency. Most accounts have none of these.
• Which sign-in providers are linked to the account, and the stable identifier each provider uses for you.

Your ledger

• The groups you belong to, the other members, and each member’s role and default share.
• Expenses: description, any notes, the amount and currency, the date, the category, who paid, who owes what, how it was split, and a revision history of every edit.
• Settlements: the amount, the method recorded (cash, Venmo, PayPal, Zelle, bank or other), an optional note and reference, and whether the person being paid confirmed it.
• Comments on expenses, and an activity feed of who did what in a group.

Files

• Receipt photographs, files you attach to an expense, your profile photo, and a group’s avatar and banner.
• The text a receipt scan produced on your device, and the position of each word on the image. It is kept so an improved reader can be run over the same receipt later, without asking you to photograph it again.

Sessions and devices

• One record per signed-in device, holding a hashed session token, the device identifier the app supplied, and when it expires or was replaced. The token itself is never stored in a form that could be replayed.
• If you allow notifications: a device identifier, the push subscription identifier and the platform.

Server logs

• Every request writes one line: the method, the route, the response status, how long it took, the size of the response, your account identifier, the IP address the request came from, and the app or browser that sent it. Invite tokens are redacted out of the path before it is written.

• Your Google or Apple password. Signing in happens with the provider, and Ledger only verifies the signed token they hand back.
• Any payment credential. A Venmo or PayPal username is stored as a username, never as a link, and Ledger never moves money. Tapping pay with Venmo opens Venmo and records nothing: the settlement is still written in Ledger, and still confirmed by the person being paid.
• Your location, your contacts or your address book. The app asks for none of them and includes no library that could read them.
• Advertising identifiers, analytics events, or behavioural profiles of any kind.

When you photograph a receipt the text is recognised on the phone itself: Apple Vision on iOS, ML Kit on Android. Only the recognised words and their positions are sent to Ledger, which turns them into line items you can assign to people.

The photograph is uploaded separately, straight from your phone to storage using a short-lived signed link, so the receipt can be shown next to the expense afterwards. It does not pass through the Ledger server, and nothing on the server reads it.

A group is a shared ledger. Joining one means the other members can see your display name and profile photo, every expense you are part of, what you paid, what you owe, comments on those expenses, and the group’s activity feed. That is the product working rather than a leak, and it is worth being clear about before you join a group with someone.

What group membership does not disclose:

• Your email address is never shown to other members, on any screen or in any response.
• Your phone number is not on the member list. It is used for one thing: letting someone who already knows your full number find your account. That works only while you leave discoverable by phone switched on, and only on an exact match, so a partial number finds nothing.
• Your Venmo and PayPal usernames appear only on the settle up screen, only to people who already share a group or a balance with you, and only while you leave that setting on. They are never returned by a phone lookup.
• A receipt image is visible to the person who uploaded it and to the members of the group the expense belongs to. Nobody else can request it.

Images and attachments are never served from a permanent public address. Each view is a fresh signed link that stops working after an hour, and an upload link stops working after fifteen minutes.

Ledger sends no email to anyone, ever. There is no mail server in it. An invite is a link you share yourself.

Ledger runs on privately operated servers rather than a third party app platform. Records are held in a MariaDB database, and files in a self-hosted, S3-compatible object store on the same infrastructure. Traffic to both the app’s server and this website passes through Cloudflare, which terminates TLS in front of them.

• Your account is kept until you delete it. Deleting scrubs your personal details immediately.
• Expenses, splits and settlements are kept for as long as the group exists. They are other people’s records as much as yours, which is why deleting your account does not remove them.
• A session record is deleted thirty days after it expires. The delay is deliberate: presenting an already-rotated session token is how a stolen session is detected, and deleting the record sooner would make a theft look like a typo.
• A file that is uploaded and never attached to anything is deleted from storage after twenty-four hours.
• Server logs are kept for as long as they are useful for running and debugging the service. No fixed retention period is configured for them today.

Four, and no others. There are no advertising networks, no analytics providers and no data brokers, and nothing is sold or shared for anyone else’s marketing.

• Google. Sign in with Google. Ledger receives a signed token holding a stable identifier for you, your email address, and whether Google has verified it.
• Apple. Sign in with Apple. The same, plus your name on the very first authorisation only, and an address that may be Apple’s private relay. Ledger also stores the token Apple issues, so that deleting your account can tell Apple to revoke it.
• OneSignal. Push notifications. If you allow notifications, the app registers your device with OneSignal and Ledger stores the resulting subscription identifier, so that a message could be addressed to your phone. Ledger is not sending notifications yet: its server has no OneSignal credentials configured, so nothing is dispatched.
• Cloudflare. Sits in front of the server and this website, and sees the requests that pass through it.

The site you are reading sets no cookies, has no login and runs no analytics. Beyond these pages it has one job: turning a group invite link into a page that opens the app. Invite pages are kept out of search engines, because an invite link is a key to a group.

• Change your display name, photo, phone number, payment usernames and default currency at any time, in the app.
• Turn off discoverable by phone, and turn off showing your payment usernames, without deleting either value.
• Turn notifications off in your device settings.
• Sign out, which ends every session on every device rather than just the one in your hand.
• Delete your account from inside the app. See exactly what that removes.

If you want a copy of your data, or want something corrected that you cannot change in the app, ask.

This page is updated whenever Ledger changes what it stores or who can see it, and the date at the top changes with it.

Ledger is built and run by one person. Questions about this page, or about your data, are welcome.

The support page is the place to send them.