what we collect
this is the same information as our privacy policy, written the way we'd actually explain it to you. if the two ever disagree, the privacy policy is the one that's legally binding — this page is here so you don't have to read that one to understand what's going on.
what you type in
your ledger is yours. wallets, categories, tags, budgets, transactions, and any notes you write on them — we store exactly what you type, nothing more. notes are free text, so if you write something sensitive in one, that's on you to know — we don't scan, read, or do anything with note contents except show them back to you and let you search them.
we keep all of this until you delete your account. we don't delete anything when you downgrade a plan — an over-limit wallet or api key just goes read-only, nothing disappears.
what we generate about your account
a few things exist only because the account does, not because you typed them in:
- a password hash (never the password itself)
- a two-factor secret, encrypted, if you turn that on
- a hashed fingerprint of the devices you sign in from — enough to notice "hey, this is new," never enough to know your actual ip address or browser string
- api keys, hashed, if you generate any
- a record of which version of our terms and privacy policy you accepted, and when
- an activity log, if you're on the pro tier — this one's yours to review in the app, and it's deleted along with everything else if you delete your account
what we need to send you email
your email address, obviously, plus the content of whatever we send you — always something about your account (verify your email, reset your password, "a new device signed in"), never a newsletter unless you've explicitly opted in from settings. we don't put tracking pixels in email, and there's no ad network anywhere near any of this.
what we need to bill you
nothing yet — ledgerpost doesn't process payments right now. when it does, this section gets rewritten before a single card is charged, and it'll say exactly what a payment processor sees (as little as we can manage) and what we store ourselves (even less).
what we never touch
no bank connections. no reading your actual bank account, ever — ledgerpost is a place you type numbers into, not a thing that logs into your bank. no selling your data. no ad trackers, no analytics scripts watching what you click. no sharing with anyone except the handful of companies that host our servers and send our email (see the privacy policy for the full list) — and none of them get more than they need to do that one job.
want the receipts instead of our word for it? the privacy policy has the full table with legal basis and retention periods for each item above.