Privacy Policy
TenderLab, the studio that makes and operates Ledgewise ("TenderLab," "we," "our," or "us"), is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use our budgeting application and website (collectively, the "Service").
1. Information We Collect
Account information. When you create an account we collect your email address and a hashed password.
Financial data. If you connect a bank account via Plaid, we receive transaction history, account balances, and institution names. If you upload a bank statement, we extract transaction data from that file. We store this data to power your budget envelopes and forecasts.
Usage data. We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate and improve the Service.
Payment information. Subscription payments are processed by Stripe. We never see or store your full card number; Stripe returns only a payment method token.
Debt history. To show your progress over time, we keep a snapshot, at most one per day, on days you use the debt tools: your total debt balance, total minimum payments, average interest rate and number of debts (never any debt's name, creditor or individual figures), and the payoff plan you last viewed that day with its projected payoff date. We use it only to show you your own progress. Snapshots are kept while your account is active and deleted with it.
Negotiation tracking. If you use the negotiation kit, we store a log of each attempt you record: which debt, what you asked for, the date, the outcome you chose and any note you type. Scripts and letters are generated on request and are not stored. We use this only to show you your own history. It is deleted with the debt or your account, or when you delete the entry.
Payment log and approved plan. If you tap "I paid this" we store the debt, the amount, the date and where the suggestion came from, and we lower that debt's balance by the amount (bank-linked debts keep the balance your bank reports). If you approve a plan we store its strategy and monthly extra amount. We use this only to show you your own records. It is deleted with the debt or your account, or when you undo the entry or remove the plan. Ledgewise never makes or schedules a payment.
Connected-app activity. When an app you connected (such as Meta Muse) requests your data, we record which app called which tool, when, how long it took, and whether it succeeded or was blocked. We do not record the request details or any of your figures. You can review this under Settings, and entries are deleted after 90 days.
2. How We Use Your Information
- To provide, operate, and maintain the Service
- To process transactions and send related information
- To power the Muse AI connector when you query your budget
- To detect and prevent fraud or abuse
- To send transactional emails (receipts, password resets)
- To improve the Service through aggregated, anonymized analytics, including comparing your debt payoff pace with other users. A comparison is shown only when at least 50 users are included, uses totals only, and never reveals any other user's data
- To spot your own spending patterns (such as the week after payday, or a month that is usually a big one for you) and send you an optional heads-up that can name the category involved (for example "Dining"), which means that name can appear on your lock screen. This is simple arithmetic on your own history, not an AI model, and to tell you when your projected debt-free date moves
We do not sell your personal data to third parties. We do not use your financial data for advertising purposes.
3. Data Sharing
Service providers. We share data with Supabase (database hosting), Plaid (bank connectivity), Stripe (payments), and Anthropic (AI features) solely to deliver the Service. Each is contractually bound to protect your data.
Analytics and referrals. Our website and blog (ledgewise.app) use HeyCatch to measure page visits and which articles are read, using a random visitor ID. It does not include anything from your Ledgewise account or the numbers you type into the debt-free date calculator, which stay in your browser. The mobile app uses PostHog to measure how the app is used (for example which screens and plans are viewed) so we can improve it. These events are tied to a random app user ID (not your name or email) and never include your financial data, balances, merchants or email. If you installed the app through a creator's referral link, Flinku, our link provider, and our referral service record that link together with a random device ID and your subscription profile ID so the creator can be credited. If you create an account on the web through a creator's link, we store that creator's referral code on your account and share it, with a random web profile ID, with our referral service, and we pass your subscription payments (amounts only, never your name, email or card details) to it so the creator can be credited.
Linked partner. If you link accounts with a partner, each of you can choose debts to share. Debts are private by default. A shared debt shows your linked partner its name (which, for a debt imported from your bank, may identify the lender), balance, interest rate and minimum payment, and only while the link is active. You can also enter a monthly extra amount toward the shared debts; your partner sees that amount, and it is deleted when you disconnect. We never show the creditor field, account details or your payment history. Turning sharing off, or disconnecting your partner, ends their access.
Shared envelopes. Envelopes are private by default. If you share one with your linked partner, they see its name, what you budgeted for it this month and what you spent in it this month. They never see the transactions in it, and they never see an envelope you have not shared. Sharing needs Premium and a linked partner, and it ends when you turn it off, when you disconnect your partner, or when either account is deleted.
Legal requirements. We may disclose your information if required by law, court order, or to protect the rights and safety of Ledgewise and its users.
4. Data Retention
We retain your account data for as long as your account is active. You can delete your account yourself in the app (More → Settings → Delete my account) or on the web at app.ledgewise.app, or by emailing founder@tenderlab.studio from your account email. Deleting from the app removes your data from our database immediately, disconnects your bank connections and deletes any uploaded statement files. For an email request we verify it and delete within 30 days. Copies in encrypted backups are removed as the backups roll off, within about 7 days. Usage analytics tied to a random ID (never your budget or bank data), referral attribution records and server logs (which can include IP addresses) are not deleted with your account. Records we are required by law to keep, and payment records held by Stripe, Apple, Google and Adapty under their own rules, may be kept longer.
5. Security
We use industry-standard measures including TLS encryption in transit, AES-256 encryption at rest for sensitive tokens, and strict access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
6. Your Rights
Depending on your location, you may have the right to access, correct, export, or delete your personal data. To exercise these rights, contact us at founder@tenderlab.studio.
7. Cookies
We use only functional cookies necessary for authentication (session tokens). We do not use tracking or advertising cookies.
8. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13.
9. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email or via a notice in the application at least 14 days before the change takes effect.
10. Contact
Questions? Email us at founder@tenderlab.studio.