Privacy Policy

Last updated July 19, 2026

The short version: Ldgr collects nothing about you. The budgets and purchases you enter are stored in your own iCloud account. There are no analytics, no ads, and no tracking. The only server Ldgr uses is a small relay that delivers shared-budget notifications, and it is end-to-end encrypted — the developer cannot see your financial data.

Ldgr is a manual budgeting app for iPhone. This policy explains what happens to the information you put into it — and, just as importantly, what doesn't.

What Ldgr stores, and where

Everything you create in Ldgr — your budgets, spending limits, and the purchases you add — is stored in your own private iCloud (CloudKit) database, tied to your Apple Account. If you aren't signed in to iCloud, your data simply stays on your device.

Your budgets and purchases are never sent to the developer, and the developer has no way to read, copy, or access them. The one small exception is the notification relay described below — and even it cannot read your data.

Sharing a budget

When you choose to share a budget, that budget and its purchases are stored in a shared iCloud area that the people you invite can access. Everyone you share with can see the purchases in that budget, and each purchase is attributed to the person who added it. Sharing is handled entirely through Apple's iCloud sharing — you control who is invited and can stop sharing at any time. Only share with people you trust.

Notifications for shared budgets

When someone adds a purchase to a budget you share, Ldgr sends you a notification. To make those notifications arrive promptly and reliably, Ldgr uses a small notification relay server. It is built so the developer cannot see anything meaningful about you or your money.

The relay receives only: your device's Apple push token (needed to deliver any notification at all), random, meaningless identifiers for your app installation and for each shared budget, and the notification's contents already encrypted. The name, amount, and category in each alert are encrypted on the device that created the purchase, using a key that exists only on the participants' devices and in your shared iCloud area — the relay never has that key and cannot decrypt the message.

What the relay cannot see: your name, any amount, any budget or category name, your Apple Account, or who is in a shared budget. It stores no message history — only what's needed to route the next notification. Muting a shared budget stops the relay from sending you its notifications entirely. If you never share a budget, the relay is never used.

Crash and error diagnostics

To find and fix bugs, Ldgr uses a third-party crash and error reporting service called Sentry. If the app crashes or hits an unexpected error, a technical diagnostic report may be sent to Sentry. That report contains information such as the app version, your device model, the iOS version, the state of the device at the time (things like available memory), and details of the error itself, including a stack trace showing which part of the app's code failed.

These reports are used only to make the app more reliable. They are not advertising or analytics, they are not sold, and they do not include your budgets, purchases, amounts, memos, names, or any of the financial information you enter into Ldgr.

What Ldgr does not do

No advertising and no ad networks.
No usage analytics or behavioral tracking.
No selling or sharing of your data with anyone.
No account to create — Ldgr uses your existing Apple Account for iCloud sync.

Apple's role

Because Ldgr relies on iCloud to store and sync your data, Apple processes that data on your behalf as part of iCloud. Apple's handling of iCloud data is governed by Apple's Privacy Policy.

Service providers

Ldgr relies on a deliberately short list of providers, and only for the purposes given:

Apple (iCloud / CloudKit) — stores and syncs your budgets and purchases in your own Apple Account, and handles budget sharing. Governed by Apple's Privacy Policy.
Apple Push Notification service — delivers notifications to your device.
The Ldgr notification relay — routes shared-budget alerts. Receives only push tokens, random identifiers, and already-encrypted message contents, as described above.
Sentry — receives crash and error diagnostics. Never receives your financial data.

Security

Data in transit is protected by TLS. Your budgets and purchases are protected by the security of your own Apple Account — so a strong Apple Account password and two-factor authentication are the most useful things you can do. Shared-budget notification contents are encrypted on-device with a key the relay never holds. No system is perfect; if a breach ever put your data at risk, affected users will be notified.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to certain processing. Because Ldgr holds none of your financial data, most of this is already in your hands through your Apple Account. For anything that isn't — a crash report, for instance — email privacy@ldgrapp.com and it will be actioned. Nobody is treated differently for exercising these rights.

Your control over your data

You can edit or delete any budget or purchase directly in the app at any time. Because your data lives in your iCloud account, you can also manage or remove it through your Apple Account and iCloud settings. Deleting the app removes it from your device; data in iCloud is managed through iCloud.

Children

Ldgr is rated 4+ and is safe for all ages, but it is designed for personal budgeting by adults. It does not knowingly collect any personal information from anyone, including children.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new "last updated" date. Material changes will be reflected here before they take effect.

Contact

Questions about privacy? Email privacy@ldgrapp.com.