What the app collects
Ledgr does not collect personal data and does not track you. The app has no account, no advertising and no analytics. Leaf Automation does not automatically receive any of your app data; it only sees what you choose to send, such as a receipt you share with us or an email to the address below.
Data stored on your device
Settings and your ledger are stored in the app's private storage on the device. The ledger holds people and saved calculations. Its file is sealed with AES-GCM using a key kept in the device keychain. That key is restricted to this device and is not synced.
iCloud sync
Ledgr syncs people, profile pictures as small JPEG copies, and saved calculations through the private database of your own iCloud account. These records use encrypted fields that your own devices can read. Leaf Automation cannot read them.
The iCloud sync row in Settings shows whether sync is working. To stop syncing, turn off iCloud for Ledgr in the iOS Settings app under your name, then iCloud. Sync requires you to be signed in to iCloud. Without an iCloud account, your ledger stays available on the device but does not sync.
App Lock
App Lock uses Face ID, Touch ID or the device passcode through Apple's LocalAuthentication. Ledgr receives the authentication result, not your biometric data or passcode. You can turn App Lock off in Settings.
Sharing receipts and Venmo links
Apart from iCloud sync, receipts leave the app only when you choose to share them through the share sheet. You choose the receiving app or person. Tapping a Venmo link opens Venmo with the amount and note filled in. The note contains only "ledgr split" and the date.
Encrypted receipts (Ledgr 1.2 and later)
Ledgr can generate OpenPGP keys on your device. Your private key stays in the device keychain, protected by your passphrase, and is not synced. If you choose to remember the passphrase, access requires Face ID, Touch ID or the device passcode. Encrypted receipts go out through the share sheet when you choose to share them.
A local history of encrypted shares records the date, transaction ID and key fingerprints when the share sheet is opened. It does not confirm delivery. This history stays on the device, is excluded from backups and keeps the latest 1,000 entries.
Optional profile pictures
Profile pictures are optional. When you add one, you pick a photo with Apple's photo picker. Ledgr receives only the photo you choose, shrinks it, and stores the copy in its app storage. It does not get access to your photo library. The synced copy is a small JPEG, at most 512 pixels on its longest side and 400 KB.
Deleting data and backups
Deleting a person or calculation removes it from the app's storage. Deleting the app removes its storage under iOS controls. Device backups follow your Apple settings.
When sync is available, deleting a person or calculation also queues deletion of its iCloud record. The deletion reaches your other devices through sync. Deleting the app alone does not delete those iCloud copies.
Questions or requests
Email contact@leafautomation.ai for a privacy question or request. Include "Ledgr privacy" in the subject line. Never send passwords or codes.
This policy describes the iPhone app. This page is hosted on the Leaf Automation website, whose web analytics and site data practices are described in the general website privacy policy.