Privacy Policy

DRAFT FOR LEGAL REVIEW, NOT YET IN FORCE

This policy is a working draft. It has not been reviewed by a lawyer, it binds no one, and it is not yet offered to anyone. Passages marked [[CONFIRM: …]] depend on a decision still to be made.

Draft of October 15, 2026. Effective date: [[CONFIRM: effective date, once in force]]

The short version

We read your bank accounts, through Plaid, so the app can work out what you may safely spend. We never move money.
Sign in with Apple is the only way in. We do not know a password, because there is none.
We do not run analytics, trackers or advertising code, and we do not sell your data or share it for advertising.
An AI model (Anthropic’s Claude) reads your transaction descriptions and amounts, on our server only, to propose bills, paydays, categories and notes. You confirm everything.
Everything is kept until your household closes the ledger. “Close the ledger” erases the household’s data, ends the bank links at Plaid and deletes your sign-in.

Who we are

“We” means [[CONFIRM: legal name and postal address of the operator of Family Ledger]], who runs the Family Ledger app and this website. “You” means a person who signs in, and, where the context needs it, the household that person belongs to. This policy covers the app and this website. Plaid’s own privacy policy applies to the moment you connect a bank in Plaid’s screens (see below).

What we collect

Sign in: We use Sign in with Apple, and nothing else. We receive an Apple identifier that is unique to our app, the email address you choose to share (which may be an Apple private relay address, or none) and a first name, either the one Apple gives us the first time or the one you type. We never see an Apple password.
The household: A household is a ledger shared by the people in it. We keep which sign-ins belong to it, and the people you enter: a name (up to 40 characters), what each is paid, and how often. An invitation to a partner is a one-time link; we store only a cryptographic fingerprint of its secret, so we cannot read it back.
What you tell the ledger: Bills (name, amount, due date), goals, categories you make or assign, notes, the cushion, settings, which account is used for spending, bills and savings, the moves you record, and your answers to the Clerk’s questions.
Your bank, through Plaid: The institution, each account’s name, type and last four digits, its available and current balances, and its transactions (date, amount, description or merchant, whether pending, and Plaid’s category). Read-only; see the next section.
Your phone, for notifications: If you allow notifications, a device token that Apple issues, which of our servers it belongs to (testing or live), and the times it was last seen. We also keep which notices each person has switched on.
What we do not collect: No bank password (you type it only into your bank’s or Plaid’s own screens). No contacts, photos, location, microphone or camera. No advertising identifier. No analytics or usage tracking inside the app or on this website, which sets no cookies. [[CONFIRM: whether crash reports are used. Apple can pass the developer aggregate crash data from people who opt in; say so here if the owner reads it, or state that none is used]]

Your bank, through Plaid

You connect a bank inside the app using Plaid Link, which Plaid runs. Plaid’s screens ask for your bank credentials; we do not receive them. Plaid gives our server a read-only access token for the transactions product only: balances and transactions, nothing that can move money.

The token is stored encrypted, in Supabase Vault, on our server. It is never sent to your phone, and it is not readable by the app’s own database roles. Plaid handles your data under its privacy policy as well as ours, and you can review or withdraw the connection in your bank’s or Plaid’s own settings. You can also disconnect a bank in the app at any time, which ends the link at Plaid.

The Clerk, an AI model

The Clerk is an AI model, Anthropic’s Claude, run only on our server. It reads transaction descriptions and amounts so as to propose bills, paydays, categories and notes. It proposes; your household confirms or amends every one, and nothing it proposes changes the numbers until someone confirms it.

Transactions are sent to the AI provider only for that purpose. We do not send the names of household members, your email address, or account numbers beyond the last four digits. [[CONFIRM: the owner’s agreement with the AI provider: no training on this data, retention period, region. State here exactly what that agreement says]] The AI provider is a service provider acting for us, and its own terms apply to its processing.

The Clerk’s proposals are suggestions only, can be wrong, and are not financial advice.

How we use it

Only to run the app for your household: to work out safe-to-spend, bills due, paydays and goals; to keep the household in step across its phones; to send the notifications you switch on; to keep the service secure and fix faults; and to answer your requests. We do not use it for advertising, we do not build profiles to sell, and we do not sell or rent it.

Only the services that help us run the app, each for that purpose and no other:

Apple, for Sign in with Apple, push notifications through the Apple Push Notification service, and (if there is a subscription) billing through the App Store.
Plaid, to read your bank.
Supabase, which hosts our database, sign-in and server functions.
Anthropic, for the Clerk, as described above.
Cloudflare, which hosts this website (Cloudflare Pages). The website sets no cookies and runs no scripts.

We do not sell your data and do not share it for advertising. We may disclose it if the law requires, to protect someone’s safety, or in a sale or reorganisation of the business, in which case this policy continues to protect it. [[CONFIRM: counsel to confirm the business-transfer wording]]

Push notifications

Push notifications are optional. A device token is kept on our server so Apple can reach your phone. There are two kinds. A silent refresh tells the app to read the ledger again; it carries no content at all. A visible notice (a question waits, a bill is due, payday, safe-to-spend changed) is sent only if the person switched that notice on, and it carries no amounts on the lock screen unless that member also turns amounts on. A token Apple reports as dead is deleted. You can switch notices off in the app or in iOS Settings.

Logs

Our server logs are content-free: they record that something happened and an error code, never a transaction, a name, an amount, a token or a request body. [[CONFIRM: confirm Supabase’s own platform logs (request metadata such as IP address) and how long they are kept]]

Where it is kept

The database and server functions run on Supabase, in the US East (Virginia) region. Plaid and the AI provider process data in the United States. [[CONFIRM: if people outside the United States may use the app, state the legal basis for the transfer]]

How long it is kept

Until the household closes the ledger. In the app, any member can choose Close the ledger under Household, then Privacy. That ends every bank link at Plaid, erases the household’s data on our server (including its bank data, bills, goals, people and notes) and deletes the sign-in of the member who asked. The other members of that household, if any, are left with no household, and their own sign-ins remain until they delete them from the app or ask us to. Closing cannot be undone.

If Plaid cannot be reached, nothing is erased and the request can be sent again. Our hosting provider keeps backups for a time; data erased from the live database leaves the backups within [[CONFIRM: backup retention in days]]. If you cannot use the app, write to us and we will do it for you.

Export

Under Household, then Privacy, then Export, the app makes a plain file (a CSV) of what is kept: today, bills, accounts and goals. For a fuller copy of everything we hold about you, write to us. [[CONFIRM: confirm the in-app export covers what counsel thinks portability requires, or promise a full export by email within a stated time]]

Children

Family Ledger is for adults. It is not directed to children under [[CONFIRM: 13, or 16 in some countries: decide the age and the wording]], and we do not knowingly collect their data. If a child has signed in, write to us and we will delete the account.

Security

The only sign-in is Sign in with Apple; we hold no passwords.
Bank access tokens are encrypted in Supabase Vault and never leave the server.
Every table is protected by row-level security: a member can read and change only their own household’s rows.
All traffic is encrypted in transit (HTTPS).
Logs hold no content. The app and this website carry no analytics, tracking or advertising code.

No system is perfectly secure. If something goes wrong that affects you, we will tell you as the law requires. [[CONFIRM: breach-notice process and deadlines]]

Your rights

You may ask for a copy of your data, to have it corrected, to have it deleted, and to take it with you (portability). Most of this you can do yourself in the app: amend entries as you wish, export a copy, or close the ledger. For anything else, or if you cannot use the app, write to ledger@kylecrouse.com and we will answer within [[CONFIRM: response time, for example 30 days]]. [[CONFIRM: which regimes apply (for example California, the United Kingdom, the European Union) and the extra rights and statements each requires, such as the categories collected and the absence of a sale or share in the California sense]]

If you are not happy with an answer, you may complain to the data protection authority where you live.

Changes to this policy

If we change this policy in a way that matters, we will say so in the app before the change takes effect, and the date at the top will change. Earlier versions can be had on request.

Contact

ledger@kylecrouse.com
[[CONFIRM: postal address]]

For the owner and counsel

Every open item in this draft. Remove this section and every banner only after review.

Legal name and postal address of the operator.
Effective date, and the version history.
The AI integration (the Clerk, Claude) is now built. Confirm that every statement about it matches what ships: what is sent, that no member names or full account numbers are sent, and where it runs.
The agreement with the AI provider: training, retention, region.
Supabase region, backup retention, and what its platform logs hold.
The rest of the data lives in a few places not named here (raw Plaid webhook events, sync queues): confirm they are erased with the household, and say so.
Whether Close the ledger should also remove the other members’ sign-ins, and whether the Apple sign-in token must be revoked with Apple on deletion (App Store account-deletion rule).
Whether crash reports, if any, are collected.
Age limit for children (13, 16, or other) and the wording.
Which privacy regimes apply (US states, UK, EU), the extra statements each needs, and the legal basis for transfers.
Export: is the CSV enough, or promise a full export.
Breach-notice process, and the response time for requests.
Business-transfer wording.
The App Store privacy “nutrition label” must say the same as this page.