Overview
Ledger is a private household expense tracker made by Lumaru ("we", "our", "us") for a small, invited group of people who share one household. It is not a public service: nobody can create an account, and the only way in is an invitation from someone already in the household. Because Ledger handles financial records, it collects more than our other apps do. This page explains exactly what, where it lives, and how to remove it. The general Lumaru privacy policy does not apply to Ledger; this page does.
What Ledger stores
For each transaction you import or connect, Ledger keeps:
- Transaction details — date, amount, merchant or payee description, the account it came from, and the category you or your household assign to it.
- Item names for online orders — when you import an order-history export (for example from Amazon), the product titles in that file.
- Household settings — categories, budgets, rules you create for filing transactions, trips, and notes you type.
- Who did what — an audit trail recording which household member approved, changed, or removed an entry, and when. Members are identified by the display name they chose, not by email or phone.
- Device records — a random identifier and a name for each phone or Mac that has joined the household, so a member can see and revoke devices.
Ledger does not store your bank usernames or passwords, card numbers, Social Security numbers, or precise location.
Where it is stored
Household data is stored on a server we operate on Cloudflare's platform (Cloudflare Workers and D1), located in the United States, so that every member of the household sees the same records. Data is encrypted in transit and at rest; transaction descriptions are additionally encrypted with a key held only by our server code. A copy is cached on each member's device, protected by the device passcode and Face ID or Touch ID inside the app, and excluded from device backups. We keep weekly backups on Cloudflare for disaster recovery.
Statement files, spreadsheets, and exports you share into Ledger are read on your device. The original files are never uploaded; only the individual transactions extracted from them are.
Bank and card connections (Plaid)
If you connect a bank or card account, the connection is made through Plaid Inc. You enter your credentials in Plaid's own interface; Lumaru never sees them. Plaid gives our server an access token that lets it fetch your transactions from that institution. You can disconnect an institution at any time in Ledger's settings, which revokes the token, and you can manage Plaid connections at my.plaid.com. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
Apple Card, Apple Cash, and Savings (FinanceKit)
On iPhone, Ledger may ask for permission to read Apple Card, Apple Cash, or Savings transactions through Apple's FinanceKit framework. Access happens only after you grant it in the system prompt, and only for the accounts you choose. The transactions read this way are stored with your other household records as described above, so that both household members can see them. You can revoke access at any time in Settings → Privacy & Security → Wallet & Apple Pay; revoking stops new transactions from being read but does not delete records already stored, which you can remove in the app.
What we do not do
- No advertising, no analytics SDKs, no tracking, no fingerprinting.
- No selling, renting, or sharing of your data with anyone. The only third parties that touch your data are Cloudflare (hosting) and Plaid (bank connections you choose to make), each acting as our service provider.
- No use of your financial data for any purpose other than showing it back to your household.
- No accounts for the public. Ledger has no sign-up; access is by household invitation only.
Children's privacy
Ledger is intended for adults managing a household. It is not directed at children and we do not knowingly collect information from anyone under 13.
Deleting your data
Any household member can remove individual transactions in the app (removed items sit in a recoverable trash and can be permanently deleted from there), revoke any device, and disconnect any bank. To delete an entire household and all of its data from our server, email support@lumaru.app from the address you used to receive your invitation; deletion is completed within 30 days and confirmed by reply. Removing the app from a device deletes that device's local copy.
Changes to this policy
If we update this policy, the changes will be posted on this page with a new "last updated" date.
Contact
Questions about this policy: support@lumaru.app.