Privacy Policy
Draft pending legal review. This document has not yet been reviewed by a lawyer. It reflects the actual data map produced by an internal audit (
docs/legal/data-map.mdin the repository) rather than boilerplate, but bracketed placeholders mark open decisions that still need sign-off.
Who's responsible for your data
The controller is [legal entity name — pending], [registered address — pending]. Contact us about anything in this policy at ledger.post@outlook.com. If you're in the EU and believe we've mishandled your data, you also have the right to complain to your local data protection supervisory authority — this policy doesn't take that right away.
What we collect, why, and for how long
Every row below traces to an actual table or file in Ledgerpost's codebase — see
docs/legal/data-map.md for the underlying audit, current as of 2026-08-27.
| What | Why (purpose) | Legal basis | Kept until |
|---|---|---|---|
| Email address, password (hashed, never stored in plain text) | Create and secure your account | Contract (we can't run the ledger for you without an account) | Account deletion |
| Ledger content — wallets, categories, tags, budgets, transactions, including any notes you write | The core service: your personal ledger | Contract | Account deletion |
| Two-factor secret (encrypted), recovery codes (hashed) | Optional account security you turn on yourself | Contract (once you enable it) | Until you disable two-factor, or account deletion |
| API keys (hashed) and daily request counts | The public API you asked for | Contract | Until you revoke the key, or account deletion |
| Device fingerprint (a one-way hash of your browser and a truncated IP — never your raw IP or raw browser string) | Detect a sign-in from a device we haven't seen, and stop credential-stuffing attempts | Legitimate interest (account security) | Account deletion |
| Consent records (which version of these documents you accepted, when, from a hashed IP and hashed device) | Prove what you agreed to, and when | Legal obligation / legitimate interest (we need a defensible record) | Account deletion |
| Activity log ("what happened on your account and when") | Let you review your own account's history (Pro tier) | Contract / legitimate interest | Account deletion — this is deleted along with everything else, so it isn't retained for post-deletion investigation |
| Transactional email we send you (verification, password reset, security notices) and its delivery status | Actually deliver the email, and know if it bounced | Contract / legitimate interest | 30 days for the message body; the delivery record itself is deleted along with your account |
| Marketing email preference | Only email you about product updates if you've said yes | Consent — off by default, opt-in only, withdrawable any time from Settings with no effect on your account | Until you opt out, or account deletion |
| Rate-limit counters (a hashed identifier plus a count, in Redis) | Stop abuse of login and the API | Legitimate interest | Minutes to two days, automatically — nothing here persists |
We do not sell or share your personal data with anyone for their own purposes, and we don't run any advertising or analytics trackers.
Third parties who process data on our behalf
| Who | What they do | What reaches them |
|---|---|---|
| Hetzner Cloud (Germany) | Hosts our database and servers | Everything above, by virtue of hosting it |
| Resend | Sends our transactional email | The recipient address and the content of that one email |
| GitHub | Runs our build and deploy pipeline | Nothing containing your personal data — the pipeline handles code and infrastructure secrets only |
| GoDaddy | DNS only | Nothing — DNS resolution doesn't touch your data |
Ledgerpost does not currently process payments, so there is no payment processor to list yet — this section will be updated the moment one is added, before it processes a single transaction.
Your rights
You can, at any time:
- See and correct most of your data directly in the app — wallets, categories, tags, transactions, and account settings are all editable in place.
- Export everything you've entered as a CSV, free, on every tier, from Settings → Export.
- Delete your account, which removes essentially everything — see /deletion for the exact list.
- Withdraw marketing consent any time from Settings → Legal, with no effect on your account.
- Ask us anything else — object to a specific use, ask what we hold, or request something this page doesn't cover — by emailing ledger.post@outlook.com. We aim to respond within 30 days.
Cookies
Every cookie Ledgerpost sets, what it's for, and how long it lasts:
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
ledgerpost.session | Keeps you signed in | Strictly necessary | Until you sign out, or it expires |
That's the entire list — no analytics cookies, no advertising cookies, no third-party tracking cookies. Because the only cookie we set is strictly necessary for the app to function, EU law doesn't require asking your permission for it, so we don't run a cookie consent banner. If that ever changes — if we add analytics or anything else that isn't strictly necessary — this table grows and a consent banner appears before it does, not after.
One honest exception, not swept under the rug: the logged-in app (not this marketing site — that one's fully self-hosted now) still loads a font from Google's servers, which means your browser makes a direct request to Google and your IP address is visible to them for that request. This isn't a cookie, but it's the same kind of third-party contact a cookie banner would normally flag. We're moving that font self-hosted too; until that ships, we're disclosing it here rather than pretending it doesn't happen.
Security
Passwords are hashed (not stored in plain text, not reversible). API keys and one-time tokens are hashed the same way. Two-factor secrets are encrypted. IP addresses are never stored raw — only a truncated, hashed form used for abuse prevention. We don't claim any of this makes Ledgerpost unbreakable; we're describing the actual measures in place, not promising a result.
Children
Ledgerpost is not directed at, and its minimum account age is 18 — see the Terms for the reasoning.
Changes to this policy
Same mechanism as the Terms: a material change gets a banner and an email before it takes effect; a version number and date at the top of this page always tell you exactly what you're reading.
<a id="changes"></a>
Changelog
- 1.0.1 (2026-08-27) — Cookies section rewritten as a table per cookie; corrected the font disclosure now that this marketing site self-hosts its fonts (the logged-in app doesn't yet).
- 1.0.0 (2026-08-27) — first published version.