Skip to content

Privacy

Last updated 10 October 2026

OpenLedger keeps track of who owes whom among people who know each other. This page says plainly what we store, why, and how to get rid of it.

What we store

  • Account: your name, email address, and timezone (used only to avoid sending reminders at night).
  • Optional profile picture: a resized image with metadata removed, visible to people you share a friendship, group, or ledger with. Blocking stops photo access.
  • Private person notes and hidden suggestions: these preferences belong to their author and are not shared with the person described.
  • Optional password: a salted password hash. We do not store your password itself.
  • Optional payment details: your Venmo username, Cash App $cashtag, PayPal.Me name, the phone or email you use for iMessage (for Apple Cash), Zelle email or phone, and QR images you upload. You can edit or remove them in Settings.
  • Ledger data: expenses, amounts, splits, payment requests, settlements, disputes, and the notes you attach to them, together with who was involved.
  • People you add by name: when you type a friend's name without an account, we store that name as a placeholder linked to you. If you email them an invite, we store the address you sent it to.
  • Session: one cookie that keeps you signed in. No advertising cookies.
  • Usage analytics: we use Amplitude to learn how the app is used: which screens are opened and which buttons are tapped, your device type, browser, and rough location from your IP address, and recordings of visits with every word, number, typed entry and link hidden, photos and QR codes left out, and page addresses cut to the screen's name. When a form turns something down, it records which form and a fixed reason (like “amount missing”), never what you typed. Amplitude keeps a random ID in a cookie in this browser to tell visits apart. When you're signed in, this usage is tied to your account's random ID, and the app records which actions you take (for example, added an expense or sent a reminder) as counts and types, never names, emails, amounts, or notes. We don't send it your name, email, or amounts, and pages opened from invite, join, receipt, or sign-in links are never recorded. When you scan a receipt or bring in balances, Amplitude also gets which AI model ran, how long it took, how much text it processed, and whether it failed, under your account's random ID, never the photo, the note, or anything read from them.
  • Appearance: your System, Light, or Dark preference is saved in this browser.
  • Reliability reports: when the app encounters an error, it can send a fixed error category, screen category, broad device type, and app release to our server logs. These reports do not include form inputs, names, passwords, ledger amounts, full page URLs, or error messages.
  • Server logs: standard request logs kept briefly for reliability and abuse prevention.
  • Receipt photos: when you scan a receipt, the photo is resized, its metadata (such as location) removed, and sent to Anthropic to read. We never store the photo; only the items and amounts you save are kept. We count scans (who and when, nothing from the receipt) for two days to enforce a daily limit.
  • Group chat: messages you send in a group or one of its trips are kept with the group and seen only by its people (a trip's, only by the people on it). Deleting a message removes its words; a “Message deleted” marker stays so the conversation still makes sense.
  • Bringing in balances: when you paste a note or add a screenshot under “Bring in balances”, it's sent to Anthropic to draft the lines, with a screenshot resized and its metadata removed first. Neither is stored; only the balances you check and save are kept. These count toward the same daily limit as receipt scans.
  • Help questions: when you're signed in and ask Help a question, the question is sent to Anthropic together with the Help text to write the answer. We don't store your question or send it to analytics; we only count how many you ask in a day.

Who sees it

Payment details and QR images are visible only to you and accepted friends. Sharing a group or an expense alone does not grant access. Blocking someone or removing the friendship removes their access, though we cannot erase copies they already saved.

Ledger data is visible to the people it involves: the other side of each balance, and members of a group for that group's expenses. Name suggestions are limited to people you already share a group, ledger, or friendship with. There is no public name directory; others need your exact handle or email. Nobody else can browse your ledger. We do not sell or share personal data with advertisers.

Four service providers process data on our behalf: our hosting provider (Fly.io) stores the database, our email provider (Resend) delivers sign-in links, invites, and notifications, Anthropic reads receipt photos you choose to scan, notes or screenshots you choose to bring in, and questions you ask Help, and Amplitude records usage analytics as described above.

Email we send

Sign-in links, invites you ask us to send, and notifications when someone requests a payment from you, reminds you, or says they paid you. Reminders are capped at one per week per request and you can mute them; the sender cannot override that.

Retention and deletion

The ledger is append-only by design, so other people's statements stay accurate. Email hello@tryopenledger.com from your account address to close your account: we remove your name and email, sign you out everywhere, and keep only the anonymised amounts that other people's balances depend on. Backups are kept for 14 days.

Contact

Questions about your data: hello@tryopenledger.com.

Terms of use · Home