PocketLedger privacy policy

Effective date: 8 November 2026.

Your ledger stays on your device

PocketLedger is a local-first Android personal finance ledger. It stores the records you enter or import, such as Accounts, Categories, people, amounts, currencies, dates, comments, financial history and exchange-rate evidence. The production database is encrypted; its key is protected using Android Keystore. This does not protect information visible on an unlocked device or copies you choose to share.

The current app has no app login, advertising, analytics SDK or automatic remote crash-reporting service. It does not upload your ledger to PocketLedger servers. Local-first does not mean that the app never uses the internet: exchange-rate requests and your deliberate external actions are described below. Demo uses a separate fictional local dataset.

Optional notification access

Manual ledger use does not require notification access. Before opening Android's notification-access settings, PocketLedger explains the feature and asks you to activate access explicitly. Android then controls the grant.

With access enabled, Android can deliver notifications to PocketLedger, including while its screen is closed. The listener reads source-app identity, notification title/text and delivery metadata. It records detected app names, package names and last-seen times so you can choose sources. Detection is not monitoring: notification bodies from apps you have not enabled do not become stored captures or financial records.

For enabled sources, money-relevant notifications and matching rules can produce locally stored captures, review items or automatic ledger postings. Automatic posting requires an enabled, successfully previewed Auto-create rule and valid financial configuration. Reconnecting the listener or enabling a source can also process notifications still present in the Android tray. Parsing, matching and recovery run on-device; notification text is not sent to a parsing or analytics service.

You can change source monitoring, pause capture, disable rules, or revoke access in Android settings. Revocation stops new Android notification delivery; it does not erase already received data or undo ledger postings. Work already received can finish. Manual entries, history and corrections remain available whether you decline or revoke access.

What is retained, and how to remove it

Stored captures can contain original notification titles and bodies, source identity, timestamps, processing outcomes and links to rules or posted Operations. Rules can retain example notification text separately.

Resolved captures (posted, finalized, ignored or duplicate) become eligible for cleanup more than 30 days after their last update. Cleanup runs during capture processing or workspace loading, not on a guaranteed daily schedule. Unresolved, ready-for-processing and error captures are not deleted merely because they are old. You can delete visible capture items. Deleting a capture does not delete a rule's saved example or the associated financial history. Delete rules separately to remove their saved examples; archiving a rule retains it.

Local recovery identifiers and deletion markers can remain after a capture is removed to prevent duplicate replay. Their cleanup follows recovery state, not the capture's 30-day rule. Financial records and correction history are retained while the app's data remains; editing or deleting a posted entry uses correction records rather than erasing its history.

Clearing PocketLedger's app storage or uninstalling removes its app-owned local data. Android automatic app backup is disabled. Encrypted backups you explicitly export can include financial records, retained notifications, rule examples and recovery metadata. Exported files remain in the location you choose until you remove them there. A chosen storage provider may synchronize those files under its own settings; app-data deletion does not remove them.

Internet exchange-rate requests

Production currency conversion and budget planning can request rates from Frankfurter (api.frankfurter.app, api.frankfurter.dev) and the National Bank of Ukraine (bank.gov.ua). Requests contain currency codes and a requested rate date, or use a latest-rate fallback. They do not contain your transaction amounts, balances, names, notification text, encryption keys or backup contents.

The provider and network infrastructure receive ordinary connection metadata, including your IP address and request timing. Their own processing and retention are outside PocketLedger's local-storage controls. Requests use HTTPS; available persisted rates and local fallbacks support offline work.

Feedback and support

Ordinary app diagnostics use local stage/state, error categories and identifiers, not raw notification bodies, financial values, passphrases, keys or backup contents. There is no automatic support-data upload. System feedback omits financial details by default; explicitly enabling financial-details feedback can make those details visible in Android notifications, subject to your device and lock-screen settings.

Contact PocketLedger support at support@inwestman.uk. If you send an email, your email service, the services handling this support address and the support recipient process your email address, message and any attachments you choose. Email providers may retain messages under their own policies. Support uses the information you send to respond and investigate your report. The app does not grant support access to your local ledger.

Start with the installed version, Android version, steps to reproduce and a sanitized description. Do not send financial records, raw notifications, passwords, keys or backups. Check screenshots and attachments before sending. Contact the same address to request deletion of a support message; deleting app data cannot delete email or copies held by an email provider. No fixed support-email retention or deletion deadline is promised.

Visiting this policy

This static policy site is hosted by GitHub Pages. GitHub logs and stores visitors' IP addresses for security purposes, whether or not they are signed into GitHub. See the GitHub Privacy Statement for the hosting provider's processing. PocketLedger adds no analytics, tracking scripts, third-party assets or contact form to this site. Opening the policy uses your browser and an internet connection; it does not upload your ledger or notification contents.

Future changes

This policy describes the current app, not planned billing. Purchase verification/provider data flows must be assessed and disclosed before they ship. Any new analytics, login or remote telemetry requires a separately approved privacy change. The policy and its effective date will be updated when relevant behavior changes.