1. Summary (plain language)
- We store what you put into Daily Ledger so the app can work for you. It is your private workspace.
- We do not sell your personal data and we do not show you third-party ads.
- We use a small number of service providers to run the app (hosting, database, email, and optionally AI, payments, photo storage and Google sign-in).
- You can export your data and ask us to delete your account.
- Questions: dailyledger001@gmail.com.
2. Who is responsible for your data
Dailyledger is the controller of personal data processed through Daily Ledger. Contact: dailyledger001@gmail.com.
3. Information we collect
Information you give us
- Account data: name, email address, and either a password (stored only as a salted, memory-hard hash; we never store or see your plain password) or the identifier Google gives us if you sign in with Google.
- Your Content: transactions, budgets, bills, savings goals, tasks, habits and completions, goals and milestones, workouts and exercise checklists, meals and grocery items, notes, preferences (currency, timezone, region, focus areas), and notification settings.
- Profile photo (optional) if you upload one.
- Support messages and the information you include in them.
- Payment-related records when you buy a plan (see section 5): the plan, status and provider reference. We do not store your full card number.
Information collected automatically
- Security and operations data: sign-in events, IP address (used for security and rate limiting), device and browser type, and error logs, to keep the Service safe and working.
- Essential cookies: a session cookie that keeps you signed in and a security token that protects actions from forgery. See the Cookie Policy.
- Notification data: if you enable browser notifications, a push subscription identifier from your browser.
Information from others
- If you use Google sign-in, Google provides your name, email address and a stable account identifier. We do not request access to your Gmail or other Google data.
- Referral information, if you join through a referral link.
4. How we use your information, and our legal bases
- To provide and run your workspace, reports, reminders and notifications (performance of the contract).
- To create and secure your account, verify your email, prevent fraud and abuse, and enforce limits (contract; legitimate interests in security).
- To send essential service emails: verification codes, password resets, security and billing notices (contract; legitimate interests).
- To send optional reminders and product updates that you enable (consent, which you can withdraw in Settings).
- To process payments and manage plans (contract; legal obligations).
- To answer support requests and improve the Service, for example by fixing errors and understanding which features work (legitimate interests).
- To comply with law and protect rights (legal obligation; legitimate interests).
We do not use Your Content to train AI models of our own, and we do not allow our AI provider to use it for training where our provider settings permit that choice.
5. Who we share information with (service providers)
We share information only with providers that help us run Daily Ledger, under confidentiality and data-protection commitments, and only what they need:
- Hosting and delivery: Vercel (frontend) and Railway (API and PostgreSQL database).
- Email delivery: Resend (verification, reset, reminder and notification emails).
- Photo storage: Cloudinary, only if you upload a profile photo.
- Sign-in: Google, only if you choose Google sign-in.
- AI: an AI model provider (currently configured by us, for example Groq or a compatible provider), only when you use the AI assistant. Your request text and the minimum account context needed to answer it are sent to that provider.
- Payments: a third-party payment provider such as Whop, only when you buy a paid plan. The provider handles your card details.
- Browser push services (for example those operated by your browser vendor) when you enable notifications.
We may also disclose information if required by law, to protect rights, safety and security, or in a business transfer (merger, acquisition, sale), with notice where required. We do not sell personal data and we do not share it for third-party advertising.
6. International transfers
Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep information
We keep your account and Your Content while your account is open. If you ask us to delete your account, we delete or anonymise your personal data within [30] days, except what we must keep for legal, tax, fraud-prevention or dispute reasons. Deleted data can remain in backups for up to [35] days until they are overwritten. Security logs are kept for a limited period (typically up to [90] days). Password-reset and verification codes are stored only as hashes and expire within minutes.
8. Security
We protect data with measures including: HTTPS everywhere; passwords stored only as salted, memory-hard hashes; HttpOnly, secure session cookies and CSRF protection; rate limiting and lockouts on sign-in and verification attempts; single-use, short-lived reset links and verification codes; per-account data isolation; restricted administrator access with audit logging; and separation of secrets from code. No system is perfectly secure, so we cannot guarantee absolute security. Choose a strong, unique password, and tell us right away at dailyledger001@gmail.com if you suspect a problem. If a breach affecting your data occurs, we will notify you and authorities as required by law.
9. Your choices and rights
In the app you can edit your profile and records, export reports and data, turn optional emails and notifications on or off in Settings, and sign out of devices. Depending on where you live (for example under the GDPR/UK GDPR or California's CCPA/CPRA), you may also have the right to: access your data; correct it; delete it; restrict or object to some processing; receive a portable copy; withdraw consent at any time; and complain to your data protection authority. To use these rights email dailyledger001@gmail.com. We may need to verify your identity first. We will respond within the time required by law (generally within one month). We do not discriminate against you for using your rights. We do not "sell" or "share" personal information as those terms are defined in California law.
10. Children
Daily Ledger is not intended for children under [MINIMUM AGE]. We do not knowingly collect their data. If you believe a child has given us personal data, contact dailyledger001@gmail.com and we will delete it.
11. Cookies and similar technologies
We use only essential cookies in the app (sign-in session and request protection). The marketing website may use analytics only with your consent where the law requires it. See the Cookie Policy for details.
12. Demo mode
Where a demo workspace is offered, its example data and your edits are saved only in your browser's local storage on your device, not in your account.
13. Third-party links
Our site may link to other sites. We are not responsible for their privacy practices.
14. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, notify you by email or in the app.
15. Contact
Dailyledger. Email: dailyledger001@gmail.com.