Privacy Policy — Ledgerly Expense Tracker

Who we are

Ledgerly ("the extension") is built and provided by Nitinbhai Viras, an independent developer. There is no company behind it — one person writes it and one person answers your email.

For data-protection purposes, Nitinbhai Viras is the data controller for the records described below.

Questions, data requests, or deletion requests: nitinbhaiviras@gmail.com

What Ledgerly is

A browser extension for tracking your own personal expenses, income, debts and budgets. You type in your financial records; Ledgerly stores them and shows you reports.

What we collect

Only what you type in, plus what is needed to give you an account.

Data	Why	Where it goes
Email address	To create your account and let you sign in	Supabase Auth
Password	To authenticate you. Stored only as a salted hash by Supabase Auth — we never see or store your password	Supabase Auth
Transaction records: amount, currency, date, category, your own note, payment-method label	This is the product — it is the data you asked Ledgerly to keep	Supabase Postgres + your device
Debts, budgets, recurring rules, category names and colours	Same	Supabase Postgres + your device
Display name, base currency, locale, theme preference	Your settings	Supabase Postgres + your device

"Payment-method label" means a free-text word you choose, like card or cash. Ledgerly has no field for card numbers, bank account numbers, or banking credentials, and does not connect to any bank or financial institution.

What we do not collect

Stated explicitly because extensions can technically do these things and Ledgerly does not:

No browsing history. Ledgerly has no content scripts, no tabs read permission, and no access to the pages you visit. It cannot see them.
No analytics, telemetry, or tracking. There is no third-party analytics SDK, no session recording, and no usage reporting of any kind.
No advertising identifiers, and no ads.
No contacts, location, camera, microphone, or clipboard access.
No reading of other extensions' data.

You can verify all of this: the extension requests only storage, unlimitedStorage, alarms, notifications, and network access to https://*.supabase.co. It requests no permission that would let it observe your browsing.

Where your data is stored

On your device. A local copy lives in the browser's IndexedDB so the extension works offline and loads instantly. Writes made while offline are queued locally and uploaded when you reconnect. Signing out erases this local copy.

On our server. Your records are stored in a Postgres database hosted by Supabase (supabase.com) in their Northeast Asia (Tokyo) region, ap-northeast-1, located in Japan. Every table enforces row-level security, so a request authenticated as you can only ever return your own rows.

International transfer. Because that region is in Japan, using Ledgerly means your records are transferred to and stored in a country that is probably not your own, wherever you use it from. Supabase holds them under its own data-protection terms as our processor. If you would rather your financial records not leave your country, this is the thing to weigh before signing up.

Who we share it with

Nobody. We do not sell, rent, trade, or share your financial data with any third party.

We do not use your data to assess creditworthiness, for lending decisions, or for any purpose other than showing you your own records inside the extension.

The only processors involved:

Processor	Role	What they receive
Supabase	Database, authentication and hosting	Your account and financial records, as their infrastructure necessarily stores them
Supabase's built-in SMTP	Sends account emails (password reset)	Your email address

Exchange rates are fetched server-side, from a public rates API, with no user data attached. That request contains a currency code and nothing else — the rates provider never receives any information about you.

We may disclose data if legally compelled by valid legal process, and will tell you unless prohibited from doing so.

How long we keep it

Your records are kept until you delete them or delete your account. Deleting your account removes your rows from the database (foreign keys cascade from your user record). The local copy on your device is removed when you sign out.

Your rights

Export. Settings → Your data exports everything as CSV or JSON, at any time, without asking us.
Correction and deletion. Edit or delete any record in the extension.
Account deletion. Email nitinbhaiviras@gmail.com and we will delete your account and all associated data.
Access. The export covers this, but you can also request a copy from us.

If you are in the EU/UK, you additionally have the rights to restrict or object to processing and to lodge a complaint with your local supervisory authority. Our lawful basis for processing is performance of a contract (providing the service you signed up for).

Security

All traffic to the server uses HTTPS/TLS.
Passwords are hashed by Supabase Auth; we never receive them.
Row-level security is enforced on every table in the database, on every operation.
The extension ships no secret keys. The key inside the extension is a publishable key which grants no data access on its own — access is decided entirely by the row-level security policies attached to your authenticated session.

No system is perfectly secure. If you find a vulnerability, please report it to nitinbhaiviras@gmail.com rather than disclosing it publicly, and we will respond promptly.

Children

Ledgerly is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date above and note the change in the extension's release notes. Continued use after a change constitutes acceptance.

Contact

Nitinbhai Viras — nitinbhaiviras@gmail.com

Read the terms & conditions