Privacy Policy
Effective 2 September 2026 · Last updated 1 October 2026
In short: your figures stay on your iPad and are never uploaded. There is no account and no bank connection. The only thing Blank Ledger sends is an anonymous usage ping, which you can switch off.
This policy covers the Blank Ledger iPad app and this website.
1. What stays on your device
Everything you enter — accounts, bills, pay periods, savings, loans, mortgages, retirement figures and notes — is stored only on your iPad. None of it is uploaded, and we have no copy. Deleting the app deletes it, and we cannot restore it for you.
2. The usage ping
Blank Ledger sends an anonymous usage ping when it is opened. It tells us roughly how many people are using the app, which tells us whether to keep investing in its development.
The ping carries a random ID for the installation, the app and iPadOS versions, the iPad model, and your language and region. It never carries your figures, your name or anything you type.
You can turn it off. Open Preferences in the app and switch off Send anonymous usage ping. With it off, the app makes no network connections at all.
3. What we never collect
- Your financial figures.
- Your name, email address or any other contact detail.
- Bank credentials — the app cannot connect to a bank.
- Your advertising identifier or your location.
4. Third parties
The app contains no advertising or analytics libraries. The usage ping goes to a server we operate, and nothing is sold or shared.
This website loads fonts from Google Fonts, so your browser contacts Google when you view it, under Google's privacy policy. The app does not.
5. Backups
A device backup, to iCloud or a computer, may include the app's data. Apple manages those under its own privacy policy; we cannot read them.
Export a backup in Preferences writes everything you have recorded to one file, which you save wherever you choose. That file is not encrypted — anyone who opens it can read it — and it is never sent to us.
6. TestFlight
While the app is in beta through TestFlight, Apple collects crash and usage information from testers under its own privacy policy. That is separate from the usage ping.
7. Your choices
Your figures never reach us, so you hold the only copy: edit, export or delete it in the app at any time.
To stop the ping, switch it off in Preferences. Each launch record is deleted after a year; the summary record for an installation is kept until you ask us to delete it. To do that, send us the Installation ID shown in Preferences.
8. Children
Blank Ledger is for adults managing their own finances. It is not directed at children.
9. Security
Your data is protected by your iPad's passcode and encryption, so keep a passcode on. Treat an exported backup as you would a bank statement.
10. Changes
Any change to this policy will be posted here with a new date.