Privacy Policy

The short version

• Your ledger is private by default. No other member can see your cycle, body, photos, sleep, mood, journal, logged meals, fasts or daily log — there is no setting that shares them.
• The only things another member can see are your profile card (name, @username, photo, bio) once you choose a username, a workout you deliberately share, and the specific items you switch on under Settings → Sharing.
• We don't sell your data, we don't show ads, and we don't use advertising or analytics trackers.
• AI only sees a meal photo you choose to analyze, or a photo of a body-composition printout you choose to scan — each only after you've allowed it. No AI reads your journal, cycle, saved body data, sleep or mood.
• You can download your data (everything except the photo files themselves, for now), and delete your account and all of it, from Privacy & data in the app.

Who is responsible for your data

The data controller for PersonalLedger is [LEGAL ENTITY NAME REQUIRED], [BUSINESS ADDRESS REQUIRED], company registration number [COMPANY REGISTRATION NUMBER REQUIRED].

Questions about privacy, or requests about your data: [PRIVACY CONTACT REQUIRED].

Data protection officer: [DPO DECISION REQUIRED — appoint one if the scale of health-data processing requires it under GDPR Art. 37, or state that none is required].

What we store, and where it comes from

Almost everything PersonalLedger holds is something you typed, tapped or uploaded. We don't buy data about you. Two things come from your phone's sensors or apps, and only when you start them: the route of a GPS activity you record (“GPS activities” in the table below), and Apple Health, only if you connect it yourself in the iPhone app (see “Apple Health” below).

Technical data: our hosting and authentication providers process technical information needed to run the service — such as your IP address, browser type and request times — in their logs. [LOG RETENTION PERIODS REQUIRED — confirm the retention configured with each provider].

Apple Health

Apple Health is optional and only in the iPhone app. Nothing moves until you turn it on in Settings › Apple Health, and iOS asks you separately for each kind of data.

• From Apple Health to PersonalLedger, one data type at a time and only for what you connect: daily step totals (one number per day), sleep (each night's times, time asleep and awake, and sleep stages where your watch measures them, with the source's name), body measurements (weight, body fat, lean body mass and waist), workouts (sport, time, distance, average heart rate, active energy, the recording app's name and, for outdoor workouts, the route; your own GPS activities saved to Apple Health are not read back), recovery values (daily resting heart rate, heart rate variability, respiratory rate, blood oxygen and wrist temperature during sleep), State of Mind (how pleasant it felt, the feelings, what it was about and when), mindfulness minutes per day, activity totals per day (active energy, exercise minutes, stand hours, walking and running distance, flights climbed) and, only if Cycle is on, cycle data (menstrual flow, spotting, cervical mucus and the cycle symptoms Cycle also tracks). Cycle, body, workout, recovery, State of Mind and activity data are only ever read, never written to Apple Health. At first up to the last 90 days (steps, sleep) or the last year (cycle, body, workouts, recovery, State of Mind, activity), then kept up to date. It is sent to our own service and stored with your account (hosted by our providers Supabase and Vercel, like the rest of your data). Nothing else is read from Apple Health.
• From PersonalLedger to Apple Health: only if you turn on “Save GPS activities to Apple Health”, each GPS run, walk or ride you save is written to Apple Health on your iPhone as a workout with its distance and route. This stays in your own Health app; we don't receive anything back.
• Live steps: while the app is open, Today can also show today's step count from your iPhone's motion sensor (iOS asks for Motion & Fitness). That live number stays on your phone: it is only shown, never stored or sent.
• Imported data is used to show it to you and in your own patterns and insights (for example how your sleep and steps relate to your mood or training). It is never shown to other members, never sent to an AI provider, advertisers or anyone else, and not written to analytics, crash reports or logs. Nights from Apple Health take the place of nights you only typed in; a night you changed yourself is never overwritten, and a day's step total you typed is kept beside Health's.
• Disconnecting a data type stops its import. You can then delete what was imported (step totals or nights); they are also included in your data export and deleted with your account. Workouts already saved in Apple Health stay there until you delete them in the Health app — PersonalLedger doesn’t delete Health records for you. Apple Health access itself is managed in iOS Settings › Health › Data Access & Devices.

Why we use it, and our legal basis

Health information — cycle, body, sleep, mood, and similar — is a special category of personal data under the GDPR. We only process it because you have given explicit consent to it (GDPR Art. 9(2)(a)), which we ask for separately before you start using the app.

Withdrawing your health-data consent means we can no longer keep your health information — in practice that means deleting your account, which you can do yourself at any time. Your AI photo choice is separate: you can turn it off and keep using everything else.

Patterns, insights and estimates

PersonalLedger looks for patterns in your own data — for example how your sleep and mood move together, or an estimated range for your next period. These are calculated by fixed rules inside our own service, from your data only. They are labelled as estimates or observations, they never decide anything about you, and nothing about you is decided automatically in a way that has legal or similarly significant effects.

A pattern is not a cause, and an estimate is not a diagnosis. See the Health notice for what PersonalLedger is and isn't.

Sharing with other members

• Profile card: if you choose a username, other signed-in members can find you by name or username and see your name, @username, profile photo and bio — whether your profile is Public or Private. Private means follow requests need your approval; it does not hide the card. Without a username you can't be found. Your profile photo is stored at a public web address so it can be shown in the app — anyone given that exact link can open it, so choose a photo you're comfortable being public.
• Shared workouts: when you share a workout, a frozen copy of its title, date, exercises and sets is published. Training notes are only included if you tick that box. Cardio is never included. Public profile: any signed-in member can see it. Private profile: only your followers. Followers who joined while your profile was Public keep access until you remove them, which you can do any time from your Followers list.
• Settings → Sharing: your training level and streak, your current book, and up to five favourite library items are shown to your followers — only for the switches you turn on. All are off by default.
• Nothing else — no cycle, body, photo, sleep, mood, journal, logged-meal, fasting, daily-log or Apple Health data — is ever shown to another member.
• Blocking: if you block someone, you stop seeing each other's profile and shared workouts, and follows between you are removed. They are not told. We store who blocked whom so the block works; you can lift it in Settings.
• Reporting: if you report a profile or shared workout, we store your report (what, why, your optional note) and a copy of the reported text and photo address as they were, so a moderator can review it even if it changes. The person you report is not told who reported them. Reports never include health data.

Favourite library items can hint at health topics (for example a herb traditionally used in pregnancy). Think about that before switching favourite sharing on.

Companies that help us run PersonalLedger

We use a small number of service providers (processors) who handle data only on our instructions. We don't sell your data and we don't share it with advertisers or data brokers.

Food composition data (vitamins and minerals per 100 g) comes from Livsmedelsverket's food database (CC BY 4.0) and USDA FoodData Central. These are public databases we download in advance; nothing about you is ever sent to them, so they are not processors.

Data processing agreements: [DPA STATUS REQUIRED — confirm a signed DPA with each provider before launch]. Where a provider is outside the EU/EEA, transfers rely on [TRANSFER MECHANISM REQUIRED — e.g. the EU-U.S. Data Privacy Framework or Standard Contractual Clauses].

Anthropic's published commercial terms state that API inputs are deleted within 30 days (longer only if flagged for a usage-policy violation, or where required by law) and are not used to train models. [VERIFY AGAINST CURRENT ANTHROPIC TERMS AND DPA REQUIRED]

Cookies and similar storage

PersonalLedger uses only what it needs to work. There are no advertising, analytics or tracking cookies, so there is no cookie banner to dismiss.

On your device (not cookies, and never sent anywhere by themselves): a GPS activity is kept on the phone while you record it and until it has uploaded to your account (in the iPhone app's own storage, or the browser's storage on the web); the iPhone app keeps your Apple Health choices for each account (no Health values) and, if you turn on saving to Apple Health, the activities waiting to be saved. These are needed for the features you use. When you delete your account, the device you delete from removes them once our server has confirmed the deletion (if that is interrupted, it finishes the next time the app opens there); removing the app also removes them. The app also remembers a few display choices, such as whether you collapsed the Ask bar.

If we ever add analytics or anything not strictly needed to run the app, we'll ask first — and this section will change before that happens.

How long we keep data

PersonalLedger is a long-term record, so we keep what you log for as long as you keep your account — that history is the point. You can delete individual entries at any time, and deleting your account deletes everything.

• Your ledger, photos and profile: until you delete them or your account.
• Account deletion: your sign-in account, every database record and every stored photo are deleted. Photos are removed first, then your account and its records. If something fails part-way, your account stays and some photos may already be gone; trying again safely finishes the job. On the device you delete from, GPS recordings that haven't uploaded yet, waiting Apple Health exports and your Apple Health choices are removed too, after our server has confirmed the deletion; if that clean-up is interrupted it finishes the next time the app opens on that device. We cannot reach other phones or browsers where you used PersonalLedger: they keep such local copies until you remove the app or its data there.
• Meal photos and printout photos sent for analysis: never stored by the app — only the values you approve are saved. The AI provider's own retention is described above.
• Backups: [BACKUP RETENTION PERIOD REQUIRED — deleted data can persist in provider backups for a limited period].
• Account-deletion bookkeeping: to stop repeated deletion requests, we count them per account in one-hour windows (with the other abuse counters, see Security); each deletion attempt leaves a record of when it started, whether it reached the sign-in service and how it ended. Both are keyed by a scrambled form of your account id (never the id itself), included in your data download, and deleted as soon as your account's deletion is confirmed. Otherwise counters are removed after about two days and attempt records 31 days after the attempt started — one day longer than the deletion proof on your device can be used. That clean-up runs daily and whenever these requests run; if the daily job doesn't run, it happens only as requests come in. Removing a record is never taken as a sign that a deletion failed: if we can no longer tell, the app says so and keeps your device's copies paused. After a day you can choose to let sync resume on that device; the app keeps checking, and if the earlier deletion takes effect after all, the account and everything added since are deleted and the device's copies removed.
• Records of your privacy choices: deleted together with your account. [LEGAL REVIEW REQUIRED — whether a minimal proof of consent must be kept after deletion]
• Inactive accounts: [INACTIVE ACCOUNT POLICY REQUIRED]
• Reports and blocks: blocks are deleted with either account. If you delete your account, reports you made lose their link to you. A handled report, including its copy of the reported content, is kept for [REPORT RETENTION PERIOD AND LEGAL BASIS REQUIRED].

Your rights

• See and get a copy of your data — download your whole ledger from Privacy & data at any time.
• Correct it — edit any entry, or your profile, directly in the app.
• Delete it — delete individual entries in the app, or your whole account from Privacy & data.
• Take it with you — the download is structured JSON that other services can read.
• Withdraw consent — turn off AI photo analysis at any time; withdraw health-data consent by deleting your account.
• Object to or restrict processing in the cases the GDPR allows — contact us.
• Complain to a supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY), imy.se — or the authority where you live.

We answer requests within one month. Contact: [PRIVACY CONTACT REQUIRED].

How we protect your data

• Connections to PersonalLedger are encrypted (HTTPS).
• Every request that reads or changes your data is checked on our server against your signed-in account.
• Optional two-step sign-in: if you turn it on, our authentication provider (Supabase) stores the key your authenticator app uses, and every sign-in asks for a code from the app.
• To stop abuse (for example floods of sign-in attempts, sign-in code guesses, automated AI-photo requests, bulk writes, photo uploads, reports or blocks) we count attempts per IP address, email address or account in short time windows. We store only a scrambled code (a keyed hash) of these, never the address or id itself. Because we can recompute that code for a known address or account, these counters are pseudonymous personal data. The ones tied to your account or email address are in your data download and are deleted with your account (a write made from another signed-in device at the very moment of deletion can leave one such counter behind; it runs out like the others); counters keyed by an IP address, and — if a deletion is only confirmed later — those keyed by your email address, are not and simply run out. Old counters are deleted after about two days by a daily clean-up job and whenever counting happens; if that job doesn't run, they are removed only as the app is used.
• Progress photos are kept in private storage and are only ever shown to you through short-lived links.
• Location and camera details are removed from every photo uploaded from this version on, before it's stored or analyzed. Progress and profile photos uploaded before then were stored as they were sent and may still contain those details. [HISTORICAL PHOTO CLEAN-UP DECISION REQUIRED — see docs/trust/PHOTO_METADATA_BACKFILL.md]
• Encryption at rest is provided by our infrastructure providers. [ENCRYPTION-AT-REST CONFIRMATION REQUIRED]

PersonalLedger does not use end-to-end encryption. People who operate the service can technically access stored data; access is limited to what running and supporting the service requires. [ACCESS CONTROL POLICY REQUIRED]

If a breach affecting your data happens, we'll notify the supervisory authority within 72 hours where required, and tell you directly when it's likely to put you at high risk.

Age

PersonalLedger is for people aged 16 and over (18 and over in the United States). We ask for your date of birth and the country you live in before you start; they are used for this check, stored with your account and never shown to anyone. At that moment we also look at the country your connection comes from (worked out by our hosting provider from your IP address): if it is the United States, the US age limit applies. That country is used only for this check and is not stored. If you are under 16, nothing you entered is saved and you can't continue. If the date of birth on an account shows someone under the limit, the app stays closed to that account until they reach it; they can still download their data or delete the account. [LEGAL REVIEW REQUIRED]

Changes to this policy

When we make a material change, we'll ask you to review it in the app before you continue. Every version has a version number, and the change history is at the bottom of this page.