LedgeraPrivacy Policy
1. Your financial data stays on your phone
Ledgera is a manual, offline money manager. Everything you enter — entries, amounts, notes, payees, accounts, balances, budgets, categories and receipt photos — is stored only in the app’s private storage on your device (a local SQLite database and an app folder for receipts). We never receive, upload, store or share this data, and we operate no servers that process it. Cloud backup of the app’s storage is disabled.
Ledgera never connects to your bank and never asks for bank logins, card numbers or account numbers. It is a personal record-keeping tool and does not provide loans, credit, payments, investments or any other financial service.
Your data leaves the phone only when you choose to: when you share an export (Excel/CSV) or a backup file, or when you use Desk Mode, which serves your book directly from your phone to a browser on your own local Wi-Fi network after you enter a one-time pairing code. Desk Mode traffic never goes through the internet or our servers and stops automatically after 10 minutes without use.
Receipt scanning: when you scan a receipt, text recognition (Google ML Kit) runs entirely on your device using a model built into the app. The photo and the recognised text are not sent anywhere.
2. Permissions
- Camera — Ledgera does not request the camera permission. Receipt photos are taken with your phone’s camera app, and gallery photos are chosen through the Android photo picker, which only shares the photos you pick.
- Notifications — optional: one reminder in the evening to log the day’s spending. You can turn it off in Settings.
- Biometrics — only if you turn on fingerprint/face unlock for the passcode lock. Biometric data is handled by Android and never reaches the app.
- Wi-Fi state and local network — only for Desk Mode, to show your phone’s address on your Wi-Fi.
- Internet — for ads, analytics, purchases and consent. Your financial data is never sent over the internet.
3. Analytics and crash reports (Google Firebase)
With your consent where required, we use Google Analytics for Firebase and Firebase Crashlytics to understand how the app is used and to fix crashes. We log anonymous events such as “entry added (type: expense)”, “budget created”, “export done (CSV)”, “paywall viewed” or “purchase completed”, plus device model, OS and app version, approximate region and an app-instance identifier. We never log amounts, notes, payees, account or category names, balances or receipts; the app enforces this with an allow-list of event parameters. Crash reports contain the error type and stack trace only. Firebase Remote Config is used to tune paywall and ad settings.
4. Advertising (Google AdMob and Unity Ads)
The free version shows ads: a slim banner under the entry list and the statistics, an occasional full-screen ad after you save your third entry in a session or after you leave a monthly report, and optional rewarded ads you choose to watch to unlock one export or one more account/budget slot. Ads never appear while you type an amount, during onboarding or on the paywall. Ledgera Pro removes all ads.
Ads are served by Google AdMob, with Unity Ads competing through AdMob mediation and serving the banner directly. These partners may collect the advertising ID, device and usage information to serve and measure ads. They never receive your financial data. See Google’s and Unity’s privacy policies.
5. Your choices (GDPR, UK GDPR, Swiss FADP, US state laws)
In the EEA, the UK and Switzerland, Ledgera asks for your consent through Google’s consent message (IAB TCF) before personalised ads or analytics are used. If you decline, ads are non-personalised and analytics stays off. In US states with privacy laws (such as California, Virginia, Colorado), you can opt out of the “sale” or “sharing” of personal information and targeted advertising. You can change your choice at any time in More → Privacy choices.
Legal bases (GDPR): consent for analytics and personalised ads; performance of a contract for purchases; legitimate interest for crash diagnostics where consent is not required. You may request access, deletion, correction or portability of data we control, object to processing, or lodge a complaint with your supervisory authority. California residents (CCPA/CPRA): we do not sell personal information for money; ad partners may receive identifiers as described above, which you can opt out of in Privacy choices. We do not discriminate against users who exercise their rights.
6. Purchases
Subscriptions and the lifetime purchase are processed by Google Play. We never receive your payment details; Google tells the app whether Pro is active.
7. Retention and deletion
Your book remains on your device until you delete entries, use More → Erase all data, or uninstall the app. Backup files you create stay wherever you saved them. Analytics data is retained by Google for up to 14 months. See how to delete your data.
8. Security
Data is kept in Android’s app-private storage. You can add a passcode (stored only as a salted hash) and biometric unlock; with the lock on, the app hides its content from the recent-apps screen.
9. Children
Ledgera is intended for adults and is not directed to children. We do not knowingly collect data from children.
10. Changes
We will update this page if our practices change and revise the date above.