Last updated 1 August 2026
Ledger exists to show you your own money. It does not sell your data, does not share it with advertisers, and does not use it to train machine-learning models. Bank connections are read-only.
Account details. Your name and email address. If you sign in with Google we also receive your Google profile picture. Passwords, if you use one, are stored only as a scrypt hash — never in a readable form.
Financial data. When you link a bank through Plaid we receive your account names, types, balances, and transaction history — dates, amounts, merchant names and categories. This is what the projections are computed from.
Nothing else. There are no analytics scripts, no advertising pixels and no third-party trackers on this site.
Your bank username and password. You authenticate directly with your bank through Plaid; Ledger only ever receives an access token scoped to reading account and transaction data.
That token cannot move money. Ledger has no transfer, payment or withdrawal capability, because that permission was never requested.
Data lives in Cloudflare D1 in the United States. Each account is isolated at the database level — every query is scoped to the signed-in user.
Plaid access tokens are envelope-encrypted before they are written, so a copy of the database alone is not sufficient to read them.
Three processors, each doing one job: Cloudflare (hosting and database), Plaid (the bank connection), and Google (only if you choose to sign in with Google, and only to confirm who you are).
Nobody else. No data broker, no advertiser, no analytics vendor. If that list ever changes, this page changes with it.
Deleting your account removes it and everything attached to it — linked banks, accounts, transactions, detected bills, plans and trips — by database cascade, not by a scheduled job that might not run.
You can also disconnect an individual bank at any time from Settings, which revokes the token with Plaid.
Questions, or a request to see or delete your data: privacy@projectledger.dev.