Privacy

Your ledger — income, rates, envelopes, every receipt and every photo — is stored on your device, in your browser. It is not uploaded, not backed up by us, and we cannot see it. There is no account, no sign-in, and no way for us to identify you.

Exactly two things ever leave your device, and both are listed below.

A receipt photo, when you choose to scan one. Pressing Snap & Go or Upload sends that image to a vision model so its total can be read. Nothing else about you is sent with it — no name, no account, no ledger. The image is processed to extract the total, vendor, currency and date, and is not stored by the reader.

Where that image goes depends on how this deployment is configured, and you can see which reader answered:

• Our own hardware — a machine we control and administer. The image is read there and discarded.
• Google Gemini, as a fallback when our own machine is unavailable. This deployment currently uses a free-tier Google API key, and Google's terms permit content submitted on the free tier to be used to improve their products. That is a meaningful difference from the paid tier, and it is stated here rather than buried because a receipt records where you were, when, and what you bought.
• Your own model — if you set an endpoint under Settings, your browser calls it directly. The photo never reaches our servers at all. This is the most private option and it is available to everyone.

A currency code, to fetch today's exchange rate. The app asks a public rate feed (open.er-api.com) for the rate between two currencies. It sends the currency codes and nothing else — but, as with loading any web page, that service can see your IP address. You can turn this off in practice by typing the rate in yourself; the app works fine without it.

That is the complete list. If you never scan a receipt, no personal information leaves your device at any point.

No analytics. No tracking pixels. No advertising. No third-party scripts of any kind — the app loads its own code and nothing else. We do not sell, share or licence your information, because we do not have it.

We do not set cookies. Your data is kept in your browser's own storage on your device, which is not transmitted anywhere.

The app is served by a hosting provider which, like any web host, records ordinary request logs — IP address, time, and which file was requested — for security and reliability. These are not linked to your ledger, because your ledger never reaches a server.

You can export everything at any time: Settings → Your data → Back up to a file. You can delete everything by clearing this site's data in your browser, or with the reset button under Plan.

The warning: because your ledger lives only on your device, we cannot recover it for you. If you lose the phone, clear your browser data, or a browser evicts the storage, the ledger and its photos are gone. Take backups. Receipts can matter for years — tax authorities commonly expect three to ten.

The PIN lock is a curtain, not a lock. It keeps a borrowed phone or a curious houseguest out of your figures. It does not protect these records from anyone determined, because the app runs entirely in your browser and the data is readable by someone who knows how.

XPAT Ledger is a budgeting tool for adults and is not directed at children.

This page is versioned by date, shown at the top. If what the app does changes, this page changes in the same release — not later.

This app is operated by WarProLog LLC. Questions about this policy: feedback@xpatledger.com.