Privacy policy
Ledger Flow is a free personal finance app. This page explains what we keep about you, why, who helps us run the service, how long we keep it and what you can do about it. It is also our data processing policy under Colombia’s Ley 1581 de 2012.
Who is responsible
Ledger Flow is run by alexpiral, which decides how your data is used and answers for it.
What we store
- Your account: your name, your email, your password (kept in a form nobody can read back) and your settings.
- What you record: accounts, categories, transactions and budgets.
- Shared expenses: the people you add, the groups you create with their expenses and payments, and the invitations you send or receive.
- The technical data the service needs to work and stay safe: the devices you sign in on, your IP address to stop abuse, and a record of the emails we send you.
Who sees what
- Your records are yours alone: nobody else sees your accounts, transactions or budgets, except what you record in a shared group.
- If you join a group someone shares with you, its owner and the others in it see the name on your profile, and everyone in a group sees the expenses and payments recorded in it. Someone you invite sees your name and your email.
- The people you add are there to keep track of what you share. Only you see their details, and the members of a group you share see the names in it. We never write to them, and any of them can ask us to remove their details.
Why we use it
Only to run the service you sign up for: keeping your records and showing them to you on any device, keeping balances right, letting you share expenses, sending the emails the service needs, such as codes and security notices, protecting accounts from abuse, and finding and fixing errors. We do not sell data, we do not use it for advertising, and nothing about you is decided automatically. Your name, email and password are needed to have an account; everything else you record is up to you.
Who helps us run it
These companies process data on our behalf, only to provide their part of the service:
- Amazon Web Services runs our server and sends our emails (Amazon SES).
- MongoDB Atlas hosts the database where your records are kept.
- Vercel hosts the website and the part that handles your sign-in, and counts page visits without cookies and without identifying you.
- Sentry receives reports of errors in the app, without your name, email or IP address.
- Cloudflare runs Turnstile, the check that you are a person when you create an account or ask for an email. It receives your IP address and signals from your browser, and also uses them on its own to improve that check, as its Turnstile privacy addendum explains.
They keep the data in the United States, which Colombia’s data protection authority lists among the countries with an adequate level of protection, and each acts under its own terms and data protection commitments.
Cookies and your device
We only use the cookies the app needs to work — to create your account, keep you signed in, recognize your devices and remember your language — and nothing that tracks you or shows ads. So that the app works without a connection, your device keeps a copy of your data and your preferences, which you can delete in Settings.
How long we keep it
- Your data, for as long as you have an account. What you delete inside the app leaves every screen at once and is erased for good with your account.
- When you delete your account in Settings, it is kept for 30 days in case you change your mind, and signing in before then restores it. After that it is erased for good with everything in it, and your email is free again.
- What other people recorded in their own groups, such as the name they gave you, is theirs and stays with them.
- Technical data (such as sessions, protection against abuse and the record of emails), only as long as needed: 30 days at most, except a mark of the addresses that reject our email, so we stop writing to them.
Your rights
You can know, access, update and correct your data, ask for it to be deleted, withdraw the authorization you gave us, ask for proof of that authorization and be told how your data is used. Most of it you can do yourself: your profile is in Settings, and “Delete my account”, also in Settings, starts erasing everything (see How long we keep it).
For anything else, write to us at the address below, saying who you are, what you ask for and how to reach you; if you have an account, write from its email so we know it is you. It is free. We answer questions within 10 business days, and claims (to correct or delete data, or to withdraw your authorization) within 15 business days. If we need more time, we tell you why before that and take no longer than the law allows.
If our answer does not satisfy you, you can complain to Colombia’s data protection authority, the Superintendencia de Industria y Comercio (sic.gov.co).
Security
Connections are encrypted and we use reasonable measures to protect your data. If a security incident affects your data, we report it to the authority as the law requires and we tell you.
Changes to this policy
The date at the top says when this page last changed. If a change affects who is responsible for your data or what it is used for, we tell you before it applies, and if the purpose changes we ask for your consent again.
Data processing (Ley 1581 de 2012)
This page is the data processing policy of Ledger Flow under Ley 1581 de 2012 and its regulations. The controller is alexpiral, reached at ledgerflow@alexpiral.com, which also handles questions and requests. It applies from October 5, 2026, and the database is kept for as long as the service runs.
Contact
Write to ledgerflow@alexpiral.com for any question about your data.