Privacy policy
Last updated 1 October 2026.
Who runs Ledger
Euxie Ledger (“Ledger”) is run by Euxie, which is James Argarin, an individual based in the Philippines. Euxie decides what is collected and why, and is who to write to about any of it: support@euxie.com.
What Ledger stores
Ledger stores what you put into it: your expenses, the accounts and balances you record, debts owed to and by you, categories, notes, and the workbooks you import. Each account can see only its own rows — that is enforced by the database, not by the application code.
It also keeps:
- Your account — your email address and a password, stored as a hash that cannot be turned back into the password.
- Your settings — your income and savings goal if you enter them, and your choices about hiding amounts, report emails and promotional emails.
- Files you attach — the photos, PDFs and spreadsheets you give the assistant.
- A record of what changed — the activity log you can read in the app, and a record of each use of the AI assistant (when, which feature, and how much it cost to run).
Why, and on what basis
- To provide the service you signed up for — keeping your records, answering your questions about them, sending the emails you switched on, and taking payment for Pro. This is the agreement in the terms of use.
- To understand and improve it — the usage telemetry described below — and to keep the service secure and stop abuse.
- With your consent — promotional email, which is off unless you turn it on.
- Because the law requires it — the record of payments received.
By creating an account you agree to this policy, including the usage telemetry. Ledger does not sell your data, does not show advertising, and does not give your data to advertisers.
What goes to Google
The chat runs on Google's Gemini API. When you type an expense in plain words, ask a question about your money, or attach a photo, PDF or spreadsheet, that text or file — along with the figures the assistant needs to answer — is sent to Google to generate the response. Google's API terms govern that processing.
Ledger also sends Gemini the names you give the places you pay and the providers of your accounts — the name only, never an amount, a date or anything else about the entry — so it can show an icon beside each one. A name is sent once. One recognised as a business is remembered for every account, so nobody's Jollibee is asked about twice; one recognised as a person is kept to your account and shown a plain person icon. The people you list under Receivables are never sent. To fetch a business's icon, Ledger's server asks that business's own website, and Google's favicon service, by website address alone; the icon it finds is then shown to Gemini with the business's name, to confirm it is the right one before it is kept.
Conversation memory and recall
Ledger can use approved facts and preferences in future chats. A suggested memory is saved only after you approve it. You can add, edit, delete or disable these memories in Settings → Memory. Approved memories remain when their source chat is deleted, until you delete the memory itself.
When past-chat recall is enabled, Ledger indexes messages, recorded draft outcomes and text extracted from attachments. Relevant passages and compact conversation summaries help answer later questions. Indexing and semantic search send text to Google Gemini to produce numerical representations called embeddings; image and PDF text extraction also uses the configured AI provider. These records belong to your account and are stored with the same database access controls as your chats.
You can switch off past-chat recall separately. Deleting a chat removes its historical index, extracted attachment text and conversation summary as well as its messages and files. Deleting an approved memory removes its own index; independently retained conversations may still mention the same information. Account-data deletion removes both kinds of recall data.
A session export lets you choose a readable transcript, structured data and original attachments. An export manifest identifies any attachments that could not be included.
Emails
If you turn them on, twice-monthly summaries of your spending are emailed to the address on your account, and closing a month emails you its summary. Both are part of Ledger Pro. The month-end reminder is sent on every plan and carries no figures. Turn them off in Settings and nothing is sent.
Promotional email — product news and offers — is separate, and is sent only if you opt in, at sign-up or in Settings. Ledger records the choice and when you made it. You can turn it off in Settings at any time, and every promotional email carries a link that turns it off in one step without signing in. Emails about your account itself, such as confirming your address, resetting your password or confirming a payment you made, are sent regardless.
Payments
Ledger Pro is paid through PayPal. Your card or PayPal login is entered at PayPal, never here. Ledger keeps what it needs to know you paid: the plan, the amount, the date, PayPal's reference for the payment or subscription, and whether it was refunded. It does not store your name, email or card details from PayPal. So that a payment can be matched to your account, PayPal is given your Ledger account identifier — a random id, not your name or email — with each purchase. PayPal's own privacy statement covers what PayPal keeps.
Usage telemetry
Separately from the data above, and to understand how Ledger is used, it also records what you do here as telemetry. This is a second copy, keyed to your browser and, while you are signed in, linked to your account as well, and it includes the content — merchants, amounts, categories and notes. For purchases it records that a checkout was started, the plan chosen and whether it completed — never a PayPal reference. Specifically:
What we store
- Your activity — which actions you take and when.
- The content you process — the expenses you add, edit, refile or delete (merchant, amount, date, category, note), what you type into the chat and the drafts it produces, the questions you ask and its answers and figures, your searches, the balances and debt lines you record, and the months you close. Do not enter anything here you would not want stored, including passwords, secrets or personal documents.
- Files you upload — the photos, PDFs and spreadsheets you attach in the chat, and the workbooks you import are stored in our private file storage.
- Your network and device — your IP address, an approximate location derived from it, your browser and operating system, language, time zone, screen and window size, and similar technical details your browser exposes.
- A device identifier — a random id kept in your browser’s storage so we can recognise return visits. It is also stored in a cookie so our servers can recognise the device. It is not tied to your name and clearing your browser storage resets it.
- Page views via Vercel Web Analytics — the hosting platform records which pages are visited, referrers, and coarse device and country data. It sets no cookies and identifies a visitor only by a hash that changes daily, so it cannot follow you across days or sites.
- Performance via Vercel Speed Insights — the hosting platform measures how quickly pages load and respond (Core Web Vitals), with the page, device type and country. It sets no cookies and does not identify you.
- Your account — while you are signed in, telemetry recorded from this browser is also linked to your account (its id and email address), so we can see what one account did across devices. Deleting your account unlinks that telemetry but does not delete it: the records stay under the device identifier, without your account or email. To have them removed as well, ask separately (below).
- Support access — to diagnose a problem, the operator can sign in to your account and see the app as you see it, without learning or changing your password. Each access is time-limited and logged, and does not sign you out anywhere else. Nothing done during it is recorded as your telemetry.
- Feedback you send — your bug reports, feature requests and replies are stored linked to your account, so the maintainer can answer them on your Requests page, and each new report is also emailed to the maintainer. Deleting your account unlinks them but does not delete them.
How long we keep it
Stored data is retained indefinitely unless you ask us to remove it.
Requesting deletion
To have your telemetry deleted, write to support@euxie.com from the email address of your account, or use the feedback button in the app. The records tied to your account and to your device identifier are then removed.
Cookies
Ledger uses a small number of cookies and similar browser storage: to keep you signed in, to remember how you like the app to look, and for the device identifier above. The cookie policy lists every one.
Who processes your data
Ledger is built on services run by other companies. Each handles your data only to provide its part:
- Supabase — the database, sign-in and file storage.
- Vercel — hosting, and the page-view and speed measurements.
- Google — the AI assistant, as described above.
- Resend — sending email.
- PayPal — payments.
- Cloudflare — the check, on the sign-in, sign-up, password-reset and account forms, that a visitor is a person and not a script (Turnstile). It runs in a frame Cloudflare serves and sees your network address and technical details of your browser, not your records; its Turnstile privacy policy describes them.
- Upstash — counting sign-in and message attempts, to limit abuse. It sees your network address or account identifier, not your records.
Where it is kept
Your records are stored in Singapore. The companies above also process data in other countries, including the United States, so your data may be handled outside the Philippines.
How long it is kept
- Your records and settings: until you delete them, or delete your account.
- Usage telemetry: until you ask for it to be removed, as described above.
- Payment records: kept after an account is deleted, because they are the seller's record of income for tax.
- The log of AI calls and the AI allowance counts (token counts and timings, never what was asked): kept after an account is deleted, with your hive sign-in, so deleting your data does not reset the daily limit or the Free plan's monthly allowance.
Your rights
Under the Data Privacy Act of 2012 of the Philippines (Republic Act 10173) you have the right to be told how your data is used, to see the data held about you, to have it corrected, to have it erased or blocked, to object to how it is used, to receive a copy you can take elsewhere, and to complain. In practice:
- See and take a copy — Settings → Import and export downloads everything you recorded as a workbook, free on every plan.
- Correct — every record can be edited in the app.
- Erase — delete your account (below), and write to support@euxie.com to have telemetry removed.
- Object or withdraw consent — turn emails off in Settings, or write to support@euxie.com.
- Anything else — write to support@euxie.com. We aim to reply within 15 days.
If you are not satisfied with the answer, you can complain to the National Privacy Commission of the Philippines.
Deleting your account
Where account deletion is available, Account → Delete account removes every row belonging to you, immediately and irreversibly — export a workbook first if you want a copy. If you do not see it, write to support@euxie.com and it is done for you. A Pro subscription is cancelled at PayPal first, and the time left on it is not refunded. The record of each payment (plan, amount, date and PayPal's reference) is kept, because it is the seller's record of income for tax, and so is the record of each subscription (plan, status, paid-until date and PayPal's reference), so that anything PayPal reports about it later still reaches the right account; neither holds anything else about you. Because your sign-in itself stays, a lifetime purchase stays with it: sign in again and it is still Pro. Usage telemetry is unlinked from your account but not deleted — see above for how to have it removed.
Security
Data is encrypted in transit, and each account's rows are separated by the database itself. No system is perfectly secure. If a breach affects your data, you will be told by email, as the law requires.
Children
Ledger is for people aged 18 and over, and is not directed at children. If you believe a child has made an account, write to support@euxie.com and it is removed.
Feedback
The feedback button in the header sends only what you type in it. It is stored with your account, emailed to the maintainer, and answered on your Requests page.
Changes
When this policy changes, the date at the top changes with it. A change that affects how your data is used is announced in the app before it applies.