LedgerPen privacy policy

Last updated October 10, 2026

LedgerPen is a receipt and expense app for Android. This page explains what the app does with your information. The short version is that your ledger stays on your phone and we never receive it.

Who we are

LedgerPen is published by Jon Holman. Write to jon@deskync.com about anything on this page.

What happens to a receipt you scan

A receipt photo you take or import is saved in the app's private storage on your device. The text on the receipt is read by a recognition model that is bundled inside the app and runs on your phone. Your photos and the text read from them are not sent to us. There is no LedgerPen server that receives them and no account to sign in to.

Network access

The app declares internet access for one reason. Google's text recognition library, which is bundled for on device reading, includes that permission in its own manifest. LedgerPen makes no network request that carries your receipts or your ledger.

Purchases

Google Play handles payment for any plan you buy. We never see your card details. The app learns only which plan is active on the device, and it stores that as a setting on your phone.

What stays on your device

Your ledger, your receipt photos, your mileage entries, your signatures and your settings all live in the app's private storage. Android cloud backup and phone to phone transfer are switched off for this app, so that data is not copied to Google's servers or onto a new phone.

What can leave the app

Nothing is sent unless you send it. Two actions move data out, and both start with you.

A CSV export or a Schedule C summary goes through whichever app you choose, for example your mail client. You decide the recipient.

A bookkeeper link carries a read only snapshot of your numbers inside the link itself, in the part of a web address that follows the # character. Browsers do not send that part of an address to the website, so the page that opens the link does not receive your numbers and we do not learn that anyone opened it. Anyone you send the link to can read the numbers in it, so treat the link the way you would treat the figures themselves.

Deleting your data

Uninstalling the app removes the ledger, the photos and the signatures with it, because they exist only on your device. You can also delete any expense inside the app, which removes its photo and signature. There is no server copy for us to delete.

Children

The app is built for business use by adults. It is not directed to children under 13 and we do not knowingly keep information from them.

Changes to this policy

If this policy changes, the date at the top of this page changes with it.