Privacy Policy

Account information: your email address, and your name and profile picture if you sign in with Google. If you use a password, we store only a hashed version of it — never the password itself.

Financial information you provide: the accounts, balances, transactions, categories, and statement files you enter or import. LedgerLeaf does not connect to your bank and never asks for banking credentials. Everything in your ledger got there because you put it there.

Technical information: IP address, browser type, and request logs, kept for security and for diagnosing faults.

Usage analytics: page views and feature usage — collected only if you accept analytics cookies, and never at all if you decline.

To provide the service: storing your ledger, importing statements, categorizing transactions, and producing dashboards and reports.

To secure your account: authenticating sign-ins, detecting abuse, and keeping audit records of access to shared data.

To keep the product working: monitoring errors and performance.

To improve the product: understanding which features are used — only with your analytics consent.

LedgerLeaf does not currently use artificial intelligence or machine learning to process your financial data, and your data is not used to train any model — ours or anyone else's.

Categorization and recurring-payment detection run on deterministic rules and pattern matching that execute on our own infrastructure. If we introduce AI-assisted features later, we will update this policy and describe what is sent where before those features are switched on.

We do not sell, rent, or trade your personal or financial information. We do not share it with advertisers or data brokers, and we run no advertising on LedgerLeaf.

If you invite an advisor, accountant, or other professional, they see only what your permit grants them. Permits are scoped and can be revoked at any time from Settings, which cuts off their access immediately.

Professional access is recorded so you can see who viewed what.

Your ledger is kept for as long as your account exists. You are in control of it: individual records can be deleted at any time from within the app.

Uploaded statement files are retained so imports stay auditable and re-runnable, and are deleted when you delete the associated import or your account.

Deleting your account removes your accounts, transactions, categories, permits, and uploaded files. Deletion cascades through our primary database immediately and is purged from encrypted backups within 30 days.

Error diagnostics are retained for 90 days. Analytics events, where consented, are retained for 12 months.

Access and portability: download a complete copy of your workspace — accounts, transactions with categories, tags, splits, memos, and import history, categories, recurring patterns, and net worth snapshots — as a single JSON file from Settings → Privacy at any time. A quick CSV of the transactions currently shown is also available from the Transactions page.

Deletion: delete your account and all associated data from Settings. This is self-service and takes effect immediately — we do not make you email us to leave.

Correction: edit or remove any record directly in the app.

Withdraw consent: change or withdraw your analytics cookie choice at any time; withdrawing stops all analytics collection.

If you are in the UK, EU, or a jurisdiction with comparable data-protection law, you may also have the right to object to processing or to lodge a complaint with your supervisory authority. To exercise any right you cannot complete in the app, email support@theledgerleaf.com and we will respond within 30 days.

Essential cookies keep you signed in and remember your cookie choice. These are required for the service to function and cannot be switched off.

Analytics cookies are set only after you accept them. If you decline, the analytics code is never loaded — not merely disabled after the fact.

Data is encrypted in transit with TLS and at rest by our database and storage providers. Access to production systems is restricted and logged.

No system is perfectly secure. If a breach affects your personal data, we will notify affected users and the relevant authority without undue delay.

Our providers process data in the United States and other regions. Where data leaves the UK or EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard offered by the provider.

LedgerLeaf is intended for adults and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

If we make a material change we will update the date at the top of this page and, for changes that affect how your data is handled, notify you by email before they take effect.