Privacy Policy

Project Ledger operates the service available at projectledger.app (the “Service”). Project Ledger is currently an early-stage product offered through an invite-only early-access program. For anything relating to this policy or your information, contact support@projectledger.app.

Account information

When an account is created for you — usually by an invitation from your organization’s administrator — we collect your name and email address, and we maintain your organization membership, role, and permission settings. If you enable two-factor authentication, we keep the related enrollment status. Passwords are handled and stored by our authentication provider (Supabase); Project Ledger does not store your password.

Business information your organization enters

The heart of Project Ledger is the business information your organization chooses to record in it. Depending on how your team uses the Service, this includes: organization settings (such as reporting currency, fiscal year, and timezone); client and supplier names; projects and their status, dates, and descriptions; contracts; planned revenue and cost line items; invoices, payments, and other financial amounts and dates; project notes, replies, and tasks; and tags and categories your team creates.

Uploaded files

Your team can upload documents (such as PDFs, Word and Excel files, and images) and attach them to projects, contracts, and invoices. We store the files along with basic metadata: the file name, size, type, who uploaded it, and when.

Usage and technical information

When you use the Service we collect information about how it is used: the pages you visit, product actions (for example, creating a project or recording a payment), your browser and device type, and screen size. We also record sessions and collect error reports, described in sections 4 and 5 below. Like any online service, our servers — and the providers that receive requests directly from your browser, such as our analytics provider — can see your device’s IP address; we use it transiently to protect sign-in and password endpoints against abuse, and it appears in the routine server logs our infrastructure providers keep.

Feedback and support

If you submit feedback through the in-app feedback tool, we collect the message you write, the category you choose, and — to help us reproduce what you saw — the page you were on, your browser and screen information, the app version, references to the related session recording and error reports, and the most recent error message, together with your user account and organization. If you email support@projectledger.app, we receive your message, your email address, and any attachments; section 6 describes where that mail is handled.

Early-access requests

If you request early access through our public website form, we collect the information you provide there — your name, work email, company, role, and answers about your business and what you want to achieve — and use it to evaluate and respond to your request. This information is also sent by email to Project Ledger’s administrators.

We use the information described above to:

• operate the Service and provide its features;
• authenticate users and secure accounts;
• let your team collaborate on projects, notes, tasks, and documents;
• calculate and display project financial information such as margins, totals, and outstanding balances;
• send account emails — invitations, password resets, and early-access notifications;
• protect the Service against abuse, including rate-limiting sign-in attempts;
• diagnose and fix errors;
• understand how the product is used so we can improve it; and
• respond to your feedback and support requests.

We do not sell your information, and we do not use it for third-party advertising.

We use PostHog, a product analytics service, to understand how Project Ledger is used. PostHog receives product events and page views (including page URLs), along with your user identifier, email, and name, and an identifier for your organization together with your role in it. This tells us which features are used and where people run into trouble. Product events are configured to describe the action, not the record’s financial contents — for example, that a payment was recorded, but not its amount — and automatic click tracking is configured to mask the on-screen text of the elements you interact with.

PostHog also records user sessions (“session replay”) so we can see how the interface behaves — where people click, what renders slowly, and where a flow breaks down. These recordings are configured to mask all displayed text and all form inputs: the recording captures the structure of the page, your interactions with it, and the addresses of the pages visited, with the text the page displays and everything you type masked on your device before the recording is sent. The recorded page structure can itself still include identifying details — for example, an element’s accessibility label — and no masking technique is perfect, so we do not claim a recording can never contain a sensitive fragment; but recordings are designed and configured not to contain the text you type or the text the page displays.

There is currently no self-serve setting to opt out of analytics. If you would like your account excluded, contact us at support@projectledger.app and we will exclude it.

We use Sentry to monitor the Service for errors and performance problems. Sentry receives:

• Error reports when something in the Service goes wrong;
• Performance information — timing data about how requests and pages perform, collected for a sample (currently 10%) of activity, whether or not an error occurs; and
• Session recordings — Sentry records a small sample (currently 1%) of sessions regardless of whether an error occurs, and records the affected session when an error does occur. These recordings mask text, inputs, and media by default.

We have deliberately narrowed what Sentry receives. Reports are attached to internal identifiers — your account’s internal ID, your organization’s internal ID, and your role — rather than your name or email. The configuration turns off Sentry’s collection of cookies, request bodies, and database query contents, and we actively remove URL query strings from error and performance reports before they are sent. Two narrower channels remain: the browser attaches its standard identifying headers (such as User-Agent and the referring page) to what it sends Sentry, and Sentry’s session recordings include the addresses of the pages visited, including any parameters in those addresses.

Project Ledger runs on established cloud infrastructure. The following providers process information on our behalf, each for the purpose described:

• Supabase — database, authentication, and file storage: holds your account and your organization’s business data and documents.
• Vercel — application hosting: serves the Service and processes requests to it.
• PostHog (hosted in the United States) — product analytics and session replay, as described in section 4.
• Sentry (hosted in the United States) — error and performance monitoring, as described in section 5.
• Resend — sends our account emails (invitations, password resets, and early-access notifications) and receives email sent to support@projectledger.app, which it forwards to the mailbox we read.
• Google (Gmail) — the mailbox that receives a copy of each email sent to support@projectledger.app.
• Upstash — infrastructure used for rate limiting; processes IP addresses transiently to protect sign-in and password endpoints.
• Cloudflare — access-controlled storage for our database backups.
• GitHub — runs the scheduled backup process.

We do not claim specific certifications on behalf of these providers in this policy; each provider publishes its own security and compliance documentation.

Project Ledger is built as multi-tenant business software, and isolation between organizations is enforced at the database layer:

• signing in is required to access the application and your organization’s data (only the public website pages, such as this one, are available without an account);
• access to your organization’s data is enforced with database row-level security, so queries are scoped to your organization and, below that, to the projects and permission areas each member is entitled to see;
• role and permission settings control who in your organization can view financial figures, edit projects, or manage users;
• two-factor authentication (authenticator app) is required for organization administrators (excepting demonstration accounts we operate ourselves) and available to all members;
• uploaded documents live in private storage and are only served after a per-request permission check — there are no public file links;
• connections to the Service are encrypted in transit (HTTPS), and our infrastructure providers encrypt stored data at rest; and
• we back up the database daily (see section 8).

No software or security program can guarantee perfect security, and we do not promise it — but the controls above are real, tested parts of how the Service works today.

We keep your organization’s information for as long as the account is active. Deletion works as follows today:

• Records (projects, clients, suppliers, contracts, line items, invoices) that your team deletes are hidden from the application immediately. A deleted project — together with the contracts, line items, and invoices inside it — is permanently removed by a scheduled process approximately 90 days later; the project’s stored files are removed by the same process, though a file whose storage removal fails can remain in storage. Deleted clients and suppliers are permanently removed by the same scheduled process — no sooner than about 90 days after deletion, and only once nothing else in the Service still refers to them. Contracts, line items, and invoices deleted individually stay hidden but are retained until their project is deleted and purged, or until you ask us to remove them.
• Documents, notes, and tasks that your team deletes are removed immediately and permanently from the Service. In the rare case where deleting a file’s underlying storage copy fails, the application no longer lists or serves that copy, but it can remain in storage, where it stays subject to your organization’s access permissions.
• Change history: we keep an internal audit record of changes to financial records for integrity purposes; this history is retained.
• Backups: deleted information may persist in our routine database backups for up to approximately 30 days before those backups are themselves removed.

There is currently no self-serve way to delete an entire account or organization. To request that, contact support@projectledger.app and we will carry it out for you. As the product matures we expect to formalize a published retention schedule; in the meantime, the behavior described above is what the Service actually does.

Project Ledger stores what your organization puts into it. Your organization controls that information and is responsible for it: for only entering or uploading information it has the authority to use, for the accuracy of what it enters, and for managing which people it invites and what permissions they hold. If your organization enters personal information about other people (for example, in notes or documents), it is responsible for having the right to do so.

Much of your information is directly visible and editable in the application — your profile, and (permissions permitting) your organization’s records. In addition, you can export data as CSV from the app’s list views (such as invoices, projects, and operations) and download your uploaded documents from within the app. For anything else — to request access to, correction of, or deletion of your personal information, to opt out of analytics, or to ask any question about privacy — email support@projectledger.app. We will respond within a reasonable time. Depending on where you live, you may have specific legal rights regarding your personal information; we will honor the rights that apply to you.

Our service providers operate cloud infrastructure that may store and process information outside your own country or province. In particular, our analytics (PostHog) and error and performance monitoring (Sentry) are hosted in the United States. By using the Service you understand that your information may be processed in jurisdictions with different data-protection laws than your own.

The Service uses a small number of first-party cookies:

• Authentication cookies that keep you signed in — essential to the Service;
• Preference cookies that remember interface choices, such as whether the sidebar is collapsed; and
• Analytics cookies and browser storage set by PostHog to distinguish sessions and visitors, as described in section 4.

We do not use third-party advertising cookies.

As Project Ledger evolves we will update this policy to keep it accurate. When we make material changes we will update the effective date at the top of this page and notify users through the Service or by email. The current version is published at projectledger.app/privacy.

Questions, requests, or concerns about privacy: support@projectledger.app.