KeepSafe Ledger Privacy Policy

1. Overview

KeepSafe Ledger is a local-first desktop finance application. Your financial data lives on your device by default. Some optional features — specifically bank connections via Plaid, cloud AI providers, and paid subscriptions — involve sending certain data off your device. This policy describes exactly what those features do and what data they touch.

2. Data We Process

• Local finance data you enter or import (transactions, budgets, goals, categories). Stored only on your device.
• Local app settings and preferences — stored only on your device.
• Local logs used for troubleshooting — stored only on your device.
• License / subscription state — stored on our servers (see Section 5).
• Bank connection tokens — stored on our servers if and only if you connect a bank via Plaid (see Section 4).
• Trial email address — stored on our servers if and only if you start a free trial (see Section 5).

3. Data Storage — Default (No Bank Connection)

• Transactions, budgets, goals, and app settings are stored locally on your device.
• Export/import files are controlled by you.
• If you do not connect a bank and do not start a paid subscription or trial, KeepSafe does not receive or store any of your financial data.

4. Optional Bank Connections (Plaid)

If you choose to connect a bank account inside KeepSafe Ledger, we use Plaid to authenticate with your bank and to retrieve transactions and account balances.

What Plaid sees: your bank login credentials, the transactions Plaid can retrieve on your behalf, and the account balances your bank exposes.

What KeepSafe's servers see and store:

• An encrypted Plaid access token, keyed by your license key, in Cloudflare Workers KV storage. This token grants KeepSafe read access to the linked institution until you disconnect it.
• A per-institution sync cursor — an opaque token from Plaid used to request only new transactions on each sync.

What KeepSafe's servers do NOT store:

• We do not persist your transactions, balances, or account numbers on our servers. Transactions transit through our Workers on their way to your device and are not written to any database.
• We do not see your bank login credentials — they go directly to Plaid.

Retention. Access tokens are deleted from our servers when you either (a) disconnect the bank from Profile → Connected Banks, (b) cancel your subscription, or (c) request deletion via support@keepsafeledger.com.

Your rights. You can disconnect any bank at any time from Profile. Disconnecting deletes both the access token on our servers and the sync cursor. Transactions already imported to your device remain on your device and are unaffected.

If you prefer not to send any data off your device, use CSV import instead — it works fully offline.

5. Payments, Trials, and License Keys

Paid subscriptions (KeepSafe Ledger Plus) are processed by Stripe. We never see or store your full card details.

Once a purchase completes, our Stripe webhook Worker:

• Generates a license key and stores it in Cloudflare Workers KV together with your email address, subscription status, and current period end.
• Emails the license key to you via Resend.
• Verifies the license key when your app calls /validate-license.

If you start a 14-day free trial, we store your email address plus a one-time verification code (deleted immediately on successful verification) and a "trial consumed" flag preventing repeat trials from the same email.

6. Optional Third-Party AI Providers

If you configure a cloud AI provider (BYOK) instead of the default on-device AI, aggregated finance summaries — never raw transactions — are sent directly from your device to that provider using your own API key.

• This is opt-in only.
• KeepSafe does not proxy or intercept your API calls.
• Provider handling is governed by that provider's privacy policy.

6a. Feedback Submissions

If you send us feedback via the in-app Send Feedback form, we collect what you choose to share plus a small amount of context to help us triage:

• You provide: feedback type (bug / feature / general), the text you write, and optionally your email address for follow-up.
• We auto-attach: app version, an anonymous install identifier (stored in local storage under ks_install_id), operating system string, and the app view you were on when you clicked Send Feedback.

What we do with it:

• Stored in Cloudflare Workers KV for up to 365 days for our internal review.
• Mirrored to a private GitHub repository as an issue so our engineering team can triage and prioritize.
• Aggregated into a weekly digest email sent only to KeepSafe staff.

We do not attach your finance data, Plaid transactions, or any local KeepSafe data to feedback submissions. Only the fields listed above.

You can request deletion of past feedback submissions by emailing support@keepsafeledger.com with your install ID or reference number.

7. Sub-processors

We rely on the following sub-processors to operate KeepSafe Ledger's optional online features. Each is bound by their own contractual privacy obligations.

8. Security

• Signed desktop binaries are used for production releases.
• Platform security mechanisms (Windows signing and, when released, macOS notarization) protect software integrity.
• Backend calls to our Cloudflare Workers require a valid license key and are rate-limited per license and per IP.
• Stripe webhook events are verified using Stripe's signed-request headers.

9. Data Retention

• On-device data: you control retention by managing local files and app data.
• Bank access tokens: deleted on disconnect, cancellation, or request.
• License records: retained for the life of the subscription plus a short grace period after cancellation.
• Trial verification codes: 15-minute TTL and deleted on use.
• Billing metadata: retention follows Stripe's policies and applicable legal / accounting requirements.

10. Your Choices

• Use offline mode: skip bank connection and any cloud AI configuration.
• Disconnect Plaid at any time from Profile → Connected Banks.
• Cancel your subscription at any time via Profile → Manage Billing.
• Export and back up your data as a portable JSON file.
• Delete local data via Profile → Reset App Data.
• Request server-side deletion of your license record and any stored Plaid tokens by emailing support@keepsafeledger.com.

11. Children

KeepSafe Ledger is not directed at children under 13. We do not knowingly collect data from children.

12. Contact

For privacy questions or deletion requests: support@keepsafeledger.com

Security-vulnerability disclosures: see our security policy.