Ledger privacy policy

Information you provide

• Your name, email address and account identifier identify your workspace.
• Ledger stores a salted password hash and hashed invitation or recovery codes. Your password and codes are sent to the service when you use them, but are not stored as readable credentials in the account database. Private invitation delivery files may remain with the operator after the invitation expires.
• Your financial records include the accounts, balances, transactions, debts, assets, amounts due and notes you enter, and the rows you choose to import.
• If you contact support, your message and contact details are used to respond.

How Ledger uses information

Ledger uses these records to sign you in, display and update your workspace, support recovery and exports, and protect access to the service. Account records are linked to your account.

Ledger does not connect to your bank, initiate payments, sell your financial records, display advertising or include an advertising or analytics SDK. Ledger does not use third-party sign-in.

Sessions and security

The website uses a session cookie to keep you signed in. The Apple app uses its network session to communicate with the same service. Account-specific and network-based attempt counters help limit authentication abuse. Network addresses used by those counters are stored as unsalted SHA-256 hashes, which can be reversed by testing every possible address, and have no automatic cleanup yet.

The hosting service can process network addresses, request details and operational logs when it receives traffic. These service logs are separate from the financial records in your workspace.

Service providers

Vercel hosts the web service and Neon stores account and financial data. These providers process information needed to operate Ledger. Your device communicates with the service using HTTPS.

Ledger does not automatically upload your entire device or connect to your bank. A CSV import sends the records you select and confirm. Exported backups and CSV files contain readable financial information; keep them private.

Access and deletion

You can view and edit your records in Ledger and export a financial backup from Data on the web. To delete your account, use Delete account in Data on the web or Account in the Apple app. Deletion requires your current password and explicit confirmation.

A completed deletion removes your account, sessions, financial records, recovery credentials, pending invitations for your email and account-specific attempt counters from the active database. It does not delete another account's records. Shared network abuse counters remain separate and currently have no automatic deletion schedule.

Downloaded exports remain wherever you saved or shared them. Account deletion affects the active database. When checked on October 7, 2026, Neon production recovery history was set to six hours. A separate operator recovery copy created that day had no automatic expiry and may retain records present when it was created. Account deletion does not erase that copy.

Hosting logs are separate from account deletion. Vercel keeps runtime logs for a limited period set by the hosting plan. Build logs and other provider operational records follow separate retention practices. Contact us about information retained outside the active database.

Contact and changes

For privacy questions or help with your information, email contact@royeradames.com. Do not include passwords, recovery codes, bank credentials or financial backups.

We will update this page when Ledger's data practices change.