Privacy Policy — October Ledger
Effective Date: November 7, 2026 · Last Updated: November 7, 2026
October Ledger ("we", "our", or "the App") is a personal finance and household ledger application available on the web, Android, and iOS. This Privacy Policy explains what information we collect, how we use and protect it, and your rights regarding your data.
1. Information We Collect
a. Account & Profile Information
When you sign up or sign in using Email/Password, Google Sign-In, or Apple Sign-In (powered by Supabase Auth), we collect:
- Your email address and authentication identifier.
- Optional profile details you choose to provide: name, mobile number, date of birth, gender, profession, and optional family member profiles.
b. Financial Ledger Data You Enter
To provide bookkeeping and budgeting features, we store the records you create in the App, including:
- Bank account and credit card display names, bank brand names, opening balances, and optional last 4 digits (we never ask for or store full bank account numbers, full card numbers, CVVs, or net-banking passwords).
- Income, expense, and transfer entries, category budgets, recurring entries, upcoming bill reminders, monthly payment plans, savings goals, and loan tracking records.
c. Optional Gmail Sync Data (gmail.readonly)
If you explicitly choose to connect your Google account under Profile → Gmail Sync:
- The App requests read-only access (
https://www.googleapis.com/auth/gmail.readonly) solely to scan bank and credit card transaction alert emails.
- From matching alert emails, the App extracts the transaction amount, date, debit/credit type, merchant/payee description, and the last 4 digits of the account or card.
- We store your OAuth refresh token securely in our database so you can run manual or automatic syncs, along with the Gmail message ID of imported transactions to prevent duplicate imports.
- We do not store raw email bodies, personal correspondence, or attachments, and you can disconnect Gmail Sync at any time from Profile → Gmail → Disconnect.
2. Google API Services User Data Policy (Limited Use Disclosure)
October Ledger's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We only use Gmail data to provide user-facing transaction tracking features within October Ledger.
- We never transfer, sell, or share Google user data with third parties, advertisers, or data brokers.
- We never use Google user data for serving advertisements or training generalized AI/ML models.
3. How We Use Your Information
We use your information strictly to:
- Authenticate your account and sync your ledger across your web, Android, and iOS devices.
- Compute your balances, spending summaries, budgets, monthly plans, savings goals, loan schedules, and financial health score.
- Import bank alert transactions when you use the optional Gmail Sync feature.
- Enable optional household collaboration when you explicitly generate or claim a family invite code.
4. Data Storage, Security & Third-Party Services
- Database & Authentication (Supabase): Your data is stored in a Supabase PostgreSQL database protected by Postgres Row-Level Security (RLS), ensuring that queries only return rows belonging to your authenticated account.
- Hosting (Vercel): Our web application and API are hosted on Vercel over encrypted HTTPS (TLS) connections.
- Device Preferences: Theme preferences, privacy mask settings, and optional app-lock PIN hashes (SHA-256 salted) are stored locally on your device and in your account settings.
We do not sell, rent, or trade your personal or financial data to any third party.
5. Data Export, Retention & Deletion
- Full Export: You can download all of your ledger data at any time from Profile → CSV export or Profile → Full backup (JSON).
- Disconnecting Gmail: You can revoke Gmail access at any time in Profile → Gmail or from your Google Account Permissions page.
- Account & Data Deletion: You may delete individual accounts, entries, goals, or plan items directly within the App. To permanently delete your entire account and all associated data from our servers, email us at marun8.k@gmail.com from your registered email address, and we will permanently erase your account and all associated records within 7 days.
6. Children's Privacy
October Ledger is not directed to children under the age of 13. While adult users may create internal budget categories or profile labels for dependent family members, we do not knowingly collect personal information directly from children under 13.
7. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date.
8. Contact Us
If you have any questions or requests regarding this Privacy Policy or your data, please contact:
Terms of Service · Back to October Ledger