Privacy

LedgerLeaf is a budgeting app. It holds the figures you type in and does nothing else with them. This page says exactly what that means.

Last updated 12 September 2026

The short version

• Your budget is visible to you, and to anyone you explicitly invite to share it.
• Nothing is sold, rented, or shared with advertisers. There are no ad trackers.
• No bank connection. LedgerLeaf only knows what you tell it.
• You can export everything as JSON, and delete everything, at any time.

What is stored

Only what you enter, plus what is needed to sign you in.

• Your account. Email address and a password, handled by Supabase Auth. The password is hashed by Supabase; it is never stored in readable form and nobody at LedgerLeaf can see it.
• Your budget. Transactions (date, vendor, amount, category, notes), categories and targets, recurring rules, accounts and their balances, transfers between accounts, and goals.
• Your settings. Display name, currency, locale, theme, reminder and report preferences, and your time zone — the last of these only so the server knows which calendar day is today for you.

There is no location tracking, no contacts access, no advertising identifier, and no profiling. LedgerLeaf does not connect to your bank and cannot see any account you do not type in yourself.

Who can see it

You can. So can anyone you invite to a budget you own — that is the point of inviting them. Access is enforced in the database with row-level security, not only in the apps, so a request for someone else’s budget is refused by Postgres itself.

The operator of LedgerLeaf has administrative access to the database, as anyone running a database does. It is used to keep the service working, not to read your budget.

Who it is shared with

Three companies, each doing one job:

• Supabase — stores the database and handles sign-in.
• Vercel — hosts the website, and provides the page-view counts described below.
• Resend — delivers the email reports, and only if you turn them on. Reports go to your own address and nowhere else.

Nobody else. No data broker, no advertiser, no analytics network.

Analytics

The website uses Vercel Analytics, which counts page views without cookies and without building a profile of you. It records which pages are visited, not what is in them: it never sees a transaction, a balance, or anything inside your budget. The mobile app has no analytics at all.

Notifications

Statement reminders and the daily brief are scheduled on your phone and delivered by it. Their contents are worked out on the device and never sent anywhere — there is no push service, and no notification of yours passes through a server.

Getting your data out

Settings → Export downloads your whole budget as JSON: every transaction, account, balance, goal and rule. It is a complete copy, not a summary, and it is yours to keep.

Deleting your data

Settings → Delete account, in the app or on the website. It removes your profile, every budget you own and everything inside them, and your sign-in record. It is immediate and cannot be undone.

A budget you own is deleted for everyone it was shared with. Budgets owned by someone else survive; you are simply removed from them.

Deleted data is gone from the live database at once. Encrypted backups kept by Supabase for disaster recovery expire on their own schedule, after which no copy remains.

Children

LedgerLeaf is not intended for children under 13 and is not directed at them.

Changes

If this policy changes in a way that affects what is collected or who it goes to, the date at the top changes and the change is described here rather than applied quietly.

Contact

Questions, or a request to delete data you cannot reach yourself: privacy@ledgerleaf.dev.