Ledger is a finance app that runs on your own computer. Almost everything it does stays there. This page says exactly what leaves your machine, because an app that holds your money records should be plain about its own behaviour.
Last updated 7 September 2026
The short version. Your transactions, accounts, balances, loans, investments and notes never leave your computer. We do not have them, cannot see them, and never receive them. The only things the app ever sends are a check for updates, an optional anonymous daily count, and, if you buy Pro, your licence check.
When Ledger starts it fetches one small file from our update host to see whether a newer version exists. That request carries no identifier of any kind. It is served by our hosting provider, which logs requests the way any web host does.
Once a day, Ledger sends one small anonymous message so we can count how many people use it. It contains only a random id that is not tied to you or your computer, the product name, whether you are on Free or Pro, your operating system, and the app version. We do not store your IP address with it.
You can switch it off in Settings, under Privacy.
When you activate Pro, the app sends your licence key, the email address the key was issued to, the app version, and a one-way identifier for the computer. That identifier is not a hardware serial number or a network address, and it cannot be turned back into anything about you. We use it only to count how many computers a key is active on.
Afterwards, from time to time, the app checks in to confirm the licence is still valid, using the same email, computer identifier and version. When you deactivate a computer, the same details are sent once more so the seat is freed for another machine.
If you activate on a computer that has been sending the daily ping, the activation also carries that random ping id. That is how we know how many free users go on to buy. It links the ping row to a masked reference to your key. It does not add your name or email to the ping row.
There is no analytics service, no crash reporting service, no advertising, and no third-party code inside the app that reports anywhere. The app contacts exactly two places: our update host and our licence server.
All of this lives in an encrypted database on your machine, and the key to it stays on your machine too. On a portable copy that key comes from a passphrase you choose, and we have no way to recover the passphrase if you lose it. Backups are encrypted files.
Because the data is only on your machine, keeping it safe is shared work. Use the built-in backup, and keep the backup file somewhere other than the same disk.
Our licence records hold the email address the key was issued to, the name given when it was issued, the licence type, the key so we can send it to you again, the dates it was issued, activated, last checked and, for a time-limited key, when it expires, and any note we made if a key had to be withdrawn. For each computer the key has been active on we keep the machine identifier, the first and latest app version seen, how many times it has checked in, and when it was released if you moved the licence.
We keep these for as long as the licence exists, plus a reasonable period afterwards for support and accounting history.
When a licence check is refused, we log which key it was, the computer identifier, the reason and the app version, so we can answer "why will it not activate" when you write to us. These entries are deleted automatically after 90 days.
One row per installation: the random id, Free or Pro, the operating system word, the first and latest version seen, the dates we first and last heard from it, and a count. If that installation later activates a key we record a masked reference to the key, and nothing more. The row is never linked to a name or an email address.
We keep a record of what you paid, when, and how, for accounting. When a payment provider is used, the card or bank details go to that provider and we never see or store them. We email your licence key to the address you give when you buy.
The licence records are held with our hosting provider, which processes them on our behalf and nothing more. They are visible only to us. No one else has access, and nothing is sold or shared with anyone.
This site sets no cookies, runs no analytics, and loads nothing from third parties. The one thing it stores in your browser is your light or dark theme choice, which never leaves it. The site and the downloads are served by our hosting provider, which keeps standard request logs.
Ledger is not directed at children under 18 and we do not knowingly collect anything from them.
If the app starts sending anything new, this page changes first and the date at the top moves. The version on this page is the one that applies.
Questions about any of this: ledger@whyitcosts.com. See also the terms.