Skip to content
Ledger
Open app

Last updated: 30 October 2026

Privacy policy

Ledger is a private, offline-first personal finance tracker. This policy explains what data the app handles, where it goes, and how long it is kept.

The short version

  • Your financial data lives on your device. The app works fully offline.
  • If you create an account, your data can sync across your devices. That synced copy is end-to-end encrypted: encrypted on your device before upload, and we cannot read it.
  • The Android app sends crash reports to Firebase Crashlytics. If you are signed in, the app also sends diagnostic logs (errors, warnings, and a few app events) to our Firebase project. Neither contains your amounts, balances, account names, or notes.
  • We do not sell your data, show ads, or use advertising or marketing analytics.

What we collect

On your device (not sent to us): your accounts, buckets, transactions, recurring rules, and settings, in local storage on your device.

Crash reports (Android app, with or without an account): when the app crashes, Firebase Crashlytics receives the error type and message, a stack trace, the app version, your device model, the Android version, the time of the crash, and a random installation identifier created by Crashlytics. Crash reports are not linked to your Ledger account.

If you create an account (optional, for sync):

  • Account identity: your email address, a user ID, your sign-in method, and sign-in times, handled by Firebase Authentication (Google). If you sign in with Google, Google shares your email and basic profile per your consent. Google also processes your IP address to secure sign-in.
  • Encrypted backup: one encrypted snapshot of your ledger, encrypted on your device with a key derived from a sync passphrase only you know. We store only ciphertext plus the non-secret parameters needed to decrypt it on your device, the snapshot format version, a random device ID for the device that last synced, and the time of the last update. We cannot decrypt it.
  • Diagnostic logs (on by default while signed in): warnings, errors, and named events (app opened, signed in, signed out, sync conflict, sync offline). Each entry is stored under your user ID and records the log level, the area of the app, a short fixed message, the error type and stack trace if there was one, the time, the app version, the platform (Android or web), the OS version (on web, the browser name), the device maker and model (on web, the browser's platform string), and a random session ID that changes every launch. Before anything leaves your device, the app drops any field that looks like money or personal data. Logs never include amounts, balances, account or category names, notes, your email, or your passphrase.

App Check: to keep bots away from our backend, the app proves it is genuine using Firebase App Check. On Android that uses Google Play Integrity. On the web it uses Google reCAPTCHA v3, which loads from Google and reads browser signals. Google handles this data under the Google Privacy Policy.

Websites: this site and the web app are hosted by Vercel, which processes your IP address and request details to serve pages. The pages load fonts from Google Fonts, and the web app loads its rendering engine from Google (gstatic.com).

Website analytics (web): this site and the web app use PostHog (EU cloud) to see how pages are used: pages viewed, clicks, page speed, a random visitor ID kept in a cookie, and session recordings. Recordings hide everything you type, and in the web app they hide all text on screen, so your amounts, balances, and names never reach PostHog. If you are signed in to the web app, its events are linked to your user ID (never your email). The web app also records what kind of action you took (for example logged an expense, exported a CSV, or finished a sync) with counts, timings, and whether it worked. Never amounts, balances, notes, or the names of your accounts and buckets.

Android app usage events: the Android app sends one anonymous usage event to the same PostHog project when you log a transaction: its type (expense, income, or transfer), whether it used a bucket, whether it has a note, whether it was backdated, and that it came from Android. It never sends amounts, notes, balances, or the names of your accounts and buckets. These events are not linked to your account or email, and the Android app does not record sessions or capture what you type.

We do not collect advertising identifiers, location, contacts, or your financial data in readable form.

How we use data

To authenticate you, sync your encrypted backup between your own devices, protect the backend from abuse, and find and fix bugs. No profiling, no selling, no advertising.

How long we keep it

  • Diagnostic logs: each entry is set to expire 30 days after it is written and is then deleted automatically.
  • Crash reports: kept by Firebase Crashlytics for 90 days.
  • Encrypted backup: until you delete it in the app or ask us to delete your account.
  • Account identity: until you ask us to delete your account.

Where data is stored

  • On device: local database, behind your device biometric lock.
  • Cloud: Google Firebase (Authentication, Cloud Firestore, App Check, Crashlytics). Each user's backup and logs are isolated by security rules so only that signed-in user can read them. Web hosting by Vercel. Website and app analytics by PostHog (EU). Google, Vercel, and PostHog process data as sub-processors and may store it in data centers outside your country.

End-to-end encryption and your responsibility

Your synced data is encrypted with a passphrase only you hold, plus a recovery key shown once at setup. If you lose both, your synced data cannot be recovered by anyone, including us. This is the cost of zero-knowledge privacy.

Your choices and rights

  • Use without an account: fully usable offline with no account. Without an account, no diagnostic logs are uploaded. The Android app still sends crash reports.
  • Delete your cloud data: Settings → Account → Delete cloud data removes your encrypted backup. Diagnostic logs expire on their own within 30 days, or contact us to delete them sooner.
  • Delete your account: contact us to remove your account and server-side records.
  • Crash reporting: there is no in-app switch for it yet. Contact us if you want your crash reports deleted.
  • Export: export your full data as JSON or CSV from Settings anytime. Settings → Data → Export diagnostics shows you the log entries the app keeps.

Children

Ledger is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect their data.

Changes

We may update this policy. Material changes will be noted in the app or here with a new "last updated" date.

Contact

syed.sarib@imagine.art · Governing region: Pakistan.