Security
How Zeal Ledger handles your money data.
Financial data is sensitive. This page says plainly what we store, who processes it, and what we never do. It will be kept current as the product changes.
What we store
- Transactions from connected accounts and files: date, amount, description, and the categories, purposes, and people you assign.
- Receipt images and the fields read from them, kept as evidence for the retention period your workspace sets.
- Workspace members, roles, and an append-only log of who changed what.
What we never store
- Bank usernames, passwords, or full account numbers.
- Payment card numbers for your subscription.
- Amounts or merchant names inside crash reports or analytics.
Who processes it
- Supabase
- Database, authentication, file storage, and background processing. Your data lives here, isolated per workspace.
- Stripe Financial Connections
- Bank and card connections. Stripe holds the bank credentials and tokens; Zeal Ledger stores only the account name, last four digits, balances, and transactions you consented to share.
- Stripe Billing, Apple, Google
- Subscription payments. Zeal Ledger never sees your card number.
- Google Document AI
- Reads receipt images into merchant, date, totals, and line items. Images are sent for processing and not retained by the processor beyond the request.
- Anthropic
- Suggests a category for receipt lines and normalizes merchant names from short text snippets. No bank credentials or account numbers are ever sent.
- Sentry and PostHog
- Crash reports and product analytics without amounts, merchant names, or personal identifiers.
How access works
- Every record belongs to exactly one workspace, and every read and write is checked against your membership in the database itself.
- Receipt images are private; the app receives short-lived signed links, never public URLs.
- Sessions on your phone are stored encrypted in the device keychain.
- Deleting your account removes your data and files; workspace owners delete workspaces in two steps.
Draft for legal review. Last updated 2026-09-12.