Privacy policy

Draft. The bracketed details are still to be filled in, and this page has not yet been reviewed by a lawyer.

Who we are

Ledgerline is run by [SELLER NAME], [CONTACT ADDRESS], [COUNTRY] (“we”). We are responsible for the personal data described here. Write to us at [SUPPORT EMAIL].

What we collect

Your account

• Your name and email address.
• Your password, stored only as a salted hash; your sign-in PIN, stored only as a keyed hash.
• If you sign in with Google: the name, email address and profile photo Google shares, and Google's sign-in tokens, encrypted.
• Your preferences (colour, density, whether to show cents).

What you keep in your workspace

Your accounts, entries, categories, budgets, goals, loans, notes, saved views, and the advisor's readings and conversation. All of it is encrypted with your workspace's own key before it is stored (see Security).

Security records

When you sign in, fail to sign in, enter a PIN, change a password or PIN, download your data, or your plan changes, we record the time, what happened, your browser's description (for example “Chrome on Windows”) and a keyed fingerprint of your network address, not the address itself. You can see these on your account page.

Billing

If you subscribe, Paddle handles the payment (see below). We keep only your plan, the subscription's status and dates, and Paddle's references for you and your subscription. We never see your card details.

The AI advisor, if you turn it on

When you turned it on and which version of the explanation you agreed to, and how many messages your workspace has used each month with their token counts and cost. Not what you asked.

Files you import

Read in memory to show you the preview and import what you confirm. The file itself is never stored.

Cookies

Only the cookies that keep you signed in. No analytics or advertising cookies. If you open Paddle's checkout from your account page, Paddle may set its own cookies for the payment.

Why we use it

• To provide the service you signed up for: your workspace, its reports and its downloads.
• To keep your account secure: confirming your email, the PIN, rate limits, and the security log.
• To bill you for Pro, through Paddle, if you subscribe.
• To send you emails about your account: confirmation, password and PIN resets, a new sign-in, a deletion. No marketing.

Who processes it for us

• [HOSTING PROVIDER] runs the app.
• MongoDB Atlas stores the database (your workspace records only as ciphertext).
• Brevo sends our emails, so it receives your email address and the email.
• Paddle is the merchant of record for subscriptions: it sells Pro to you, takes the payment, handles tax and invoices, and processes your billing details under its own privacy policy.
• Google, if you choose to sign in with Google.
• OpenRouter and the model's maker, only if you turn the advisor on, and only on endpoints that keep nothing and do not train on it. What is sent is described on the Security page and on the advisor's own screen before you agree.

We do not sell your data, and we do not use it for advertising. Some of these providers may process it outside your country; [TRANSFER SAFEGUARDS].

How long we keep it

• Your account and workspace: until you delete them.
• When you delete your account, it is kept for 7 days in case you change your mind, then your workspace's key, every record, your security log and your account are deleted. One line remains saying an account was deleted, and when, with no address or browser.
• Encrypted backups age out within [N] days, and cannot be read once the key is destroyed.
• Paddle keeps billing records as the law requires of it.

Your rights

• Get a copy: download everything you have stored, as JSON or spreadsheets, from your account page, at any time, on every plan.
• Correct it: edit anything in your workspace or your profile.
• Delete it: delete your account from your account page.
• Withdraw consent to the advisor at any time; nothing is sent after that.
• Ask us anything about your data, object to how we use it, or complain to your data protection authority. Write to [SUPPORT EMAIL].

Children

Ledgerline is not meant for children, and we do not knowingly hold a child's account.

Changes

If this policy changes in a way that matters, we will tell you by email or in the app before it takes effect. The date at the top says when it last changed.