Ledgerly

The short version

SMS, notification and screen capture are optional. They are processed on your phone to create financial records. You can skip permissions and enter expenses manually.

You may enter a name for the local greeting or for people you track amounts with. The app has no general account sign-in. Names or other details may be included in optional AI requests when relevant to the feature.

Cloud AI, receipt uploads, offers, link previews, logo requests and billing/access verification have their own data flows below. We do not sell personal data or use it to build advertising profiles.

Reading SMS

RECEIVE_SMS lets Ledgerly process incoming messages in the background. It recognises supported financial alerts and merchant order confirmations, extracting amounts, dates, merchant or sender details, account/card suffixes and related order information. Unrelated messages are ignored.

READ_SMS is used for the optional Import SMS history flow. You start the scan, choose its range and review the proposed entries. It is not an automatic continuous inbox scan.

Raw SMS bodies are processed locally and are not sent to cloud AI. Parsed records are stored in the ledger. Relevant fields from that ledger may be sent when you enable optional cloud AI. Android Settings lets you revoke SMS access.

Accessibility and order capture

The AccessibilityService is off until you grant it in Android Settings. While enabled, it reads visible page content in a built-in set of supported merchant apps, including supported variants of Blinkit, Swiggy/Instamart, Zomato, Uber Eats, Amazon and Zepto. It recognises pages and temporarily buffers recent page text and nodes before a capture action. The normal expense capture is saved when you use the capture control.

Order capture can extract items, prices, totals and order details. Amazon Now order details, including paid item prices, are read from accessible text and descriptions on your device. Its direct order parser does not use a screenshot or optical character recognition (OCR) to recover prices. A capture needs complete item and bill information before it can be saved; incomplete pages can require screenshot import you explicitly request. Regular Amazon and Amazon Fresh orders, and Zepto, use requested screenshot import rather than the Amazon Now parser. Product-photo and ingredient features can also use an image from an action you start. Saved ledger details can later be used by optional cloud AI as described below.

The Play edition does not tap, scroll or type inside other apps. The direct-download edition also has optional checkout suggestions and spending reminders on additional supported merchants; an Ingredient Check you start may unfold an ingredients panel. These extra automation features are not part of the Play edition.

The capture helper keeps the capture controls available while enabled, with an ongoing notification. In version 1.1.100 you can use Stop helper in that notification, or turn Keep capture ready off in Settings. Stopping the helper leaves normal accessibility capture enabled. Pause capture is a separate control in Settings, the helper notification and the Capture on/off Quick Settings tile: it disables the connected accessibility service and prevents automatic recovery. If Android lists the service as enabled but it is not connected, finish disabling it in Android Settings. Resume opens Android Settings for you to turn Ledgerly on again. SMS and payment notification capture keep their separate settings. The helper is ongoing, not limited to a single screenshot.

Notification access

After a separate Android grant, Ledgerly filters notifications from supported payment and banking apps, including Google Pay, Paytm, PhonePe and BHIM. It processes matching payment-alert titles and text on your phone, including while Ledgerly is closed, and stores parsed financial details.

Raw notification text is not sent to cloud AI. Relevant saved ledger fields may be included in optional AI requests. Unrelated notifications are ignored. You can revoke notification access independently of SMS and accessibility. Permission to show Ledgerly alerts is separate.

Receipts, PDFs and photos

You can select or share a receipt image or PDF, or request a supported screen capture. On-device analysis is the default when cloud receipt analysis is not enabled.

From Play version 1.1.100 on Android 11 and newer, Ledgerly does not request broad photo-library access. For screenshot import, a requested screenshot is captured through Android accessibility, saved as an image created by Ledgerly, and passed directly to the review flow. Amazon Now direct order parsing uses accessibility text and descriptions instead of screenshot OCR. Selecting existing files uses Android file selection or sharing.

On Android 10 and older, Play retains optional legacy media-read access for the existing screenshot handoff. Older app builds and the direct-download edition can also use optional media-read permission to look for a newly created screenshot briefly after you request it. This involves querying recent media records; it is not limited to a file-picker grant.

Cloud receipt analysis requires both cloud-AI consent and the separate receipt-upload choice in Settings, AI. In Play testing release 1.1.124, eligible imported receipt images and PDF pages are sent through the Ledgerly proxy to DigitalOcean inference with extracted text and parsing context. PDF pages are converted into images on your phone; cloud processing supports up to four pages and 5 MB. Longer documents retain on-device analysis. Uploaded receipt content may contain names, addresses, purchases or account details. The direct-download own-key route sends eligible images and PDFs to OpenAI. Turning this option off keeps new receipt analysis on-device. Builds before 1.1.100 may upload eligible imports once an OpenAI key is configured.

Optional cloud AI

AI features include questions about your ledger, conversation history and saved context, spending summaries, card comparisons, reminders, product or ingredient analysis, and optional background helpers such as daily briefs or return-window checks. Their data needs differ.

Play testing release 1.1.124 sends text, receipt and photo AI requests through a Mad Max Labs proxy on DigitalOcean to DigitalOcean inference, using a cloud access pass. Provider model credentials stay on the server. Older hosted text access did not include the full receipt/PDF route. In the direct-download edition, requests made with your own OpenAI key go directly to OpenAI.

Requests can include transaction dates and amounts, purchase and item history, merchant and product names, categories, budgets, card information you entered, names used in reminders, your questions, previous chat messages, saved AI context and results returned by ledger tools. Image features can send the image you ask them to analyse. These are not always anonymous totals or summaries.

From version 1.1.100, saving a key alone does not enable cloud AI. You first review and accept the disclosure in Settings, AI. Enabled background AI features may send relevant data while the app is closed; control the individual features in AI Settings. Receipt/PDF import uploads require their additional choice. Turning cloud AI off stops new inference requests, but cannot recall a request already sent.

OpenAI API data is handled under its terms and data controls. Default abuse-monitoring retention can be up to 30 days; store=false does not by itself guarantee zero retention. See OpenAI API data controls. Your own API usage can incur provider charges.

DigitalOcean's AI data privacy documentation states that its inference infrastructure does not store model inputs or outputs or use customer data to train models. Ledgerly's own proxy and access records are separate: we keep subscription/access and usage records to authenticate access, meter allowances and investigate failures. The live meter uses Upstash Redis. Technical logs include key labels, model, counts, timing, status and error information; error details may contain provider-returned context. We do not promise ephemeral or zero-retention processing across the full service.

Keys are encrypted on your device with Android Keystore-backed protection. Provider data handling and server-side records are distinct from your local chat history and ledger. Deleting local data does not automatically delete data already sent to a provider.

Reporting an AI answer

Version 1.1.123 and later lets you report an AI answer inside Ledgerly. Choose a reason, review the selected answer and optionally add details. You can edit the preview to remove information you do not want to share. Sending requires a separate confirmation; enabling cloud AI alone does not send reports.

Ledgerly receives the text shown in the report preview, your reason, feature screen, app version, a random report reference and a random reporting-only installation identifier. Selected text may contain financial or personal information. We do not automatically attach your conversation history, ledger, receipts, photos, account identity or API keys. A keyed hash of the random installation identifier helps prevent abuse; it is not an advertising or hardware identifier.

Reports travel over HTTPS to our service on DigitalOcean, with encrypted report contents and review notes stored in Upstash Redis. These service providers process the submission on our behalf. We use reports to investigate safety and accuracy concerns and improve prompts, content safeguards and affected features. The reporting feature does not send reports to an AI model, consume your AI allowance or require a subscription.

Reports and review notes expire from the reporting queue within 30 days of submission, or are removed sooner when a deletion request is fulfilled. Abuse-prevention counters expire within two days. Hosting and database providers may process network logs and backups under their own retention settings; those are separate from the reporting queue. We do not intentionally write report text into application logs.

After the server confirms receipt, Ledgerly displays a reference. For questions or deletion requests, contact madmaxlabsllc@gmail.com and quote that reference. Do not send passwords or API keys. Receipt does not promise an individual reply or a particular resolution time.

Payments and AI access

Play testing release 1.1.124 has no AI purchase or personal-provider-key setup. Invited testers activate a cloud access pass. Test passes run for 30 days from the opening of their testing cohort and have daily, total and shared group allowances; reviewer access is maintained separately. Activating a pass checks access without sending your ledger or invoking an AI model, and does not grant cloud-AI consent. Removing a pass or ending access does not delete local records. Earlier eligible billing and direct-download access flows are described below.

For testing access, the service stores a hash of the pass, a random pass reference, its cohort or reviewer role, activation/expiry and revocation state, and usage counters. The counters enforce daily, pass and group allowances, including in-flight reservations; interrupted or unconfirmed inference can count conservatively. Daily and expiring-test counters expire after up to 180 days without updates. Cumulative counters for maintained review access stay with its access record so a fixed allowance cannot refill through inactivity; they can be removed when that access is retired. Access records are separate from the local ledger and do not contain your full financial records. Contact us using the address below for access-record deletion requests.

Google Play handles Play payment details. Ledgerly can send the purchase token, product/package details and entitlement information to its server to verify or restore access with Google Play. The service maintains access keys, entitlement/verification records and usage counters. We do not receive your full payment-card details from Google.

Where website subscriptions are available, checkout uses Razorpay. We receive the checkout contact details and payment/subscription identifiers needed to provide access and support; Razorpay handles payment credentials under its privacy policy. Website cancellation and refund terms are described in our refund policy and terms.

Contact us to request deletion of subscription/access records. Some records may need to be retained for accounting, payment disputes, fraud prevention or legal obligations. We will explain any applicable limitation rather than promise immediate deletion of every record.

INR Deals offers

Affiliate offer links and INR Deals connections are disabled in the current Play testing release. In older editions where those features are available, opening a card offer opens an affiliate URL in your browser. That URL can send INRDeals a publisher identifier, the selected offer and a randomly generated app identifier to attribute a referral or commission. This does not require connecting an INRDeals account. If you connect INR Deals, background sync can also send its token, publisher and device identifiers and a date range to that service. These requests do not need your ledger transaction list. Avoid opening offers to avoid referral tracking; disconnect the feature to stop its sync.

Links and brand logos

Web link previews are on by default. When you attach a link, the app can contact that website to fetch its title and preview. The recipient can receive the requested URL and normal connection information such as your network address. Turn previews off in Settings to keep new links as plain text.

Subscription brand logos are optional. When enabled, the app requests a brand domain from Google's favicon service. Google can see the requested domain and connection information. Transaction amounts and raw SMS text are not part of that request. Turning logos off stops new fetches and clears the cached logos.

Storage, security and retention

The main ledger and local settings are stored on your device. You can edit or delete records and manage backups. User-created screenshots may remain in the photo library after uninstalling the app, like other saved images.

Android may back up eligible app data according to your device/account settings; encrypted API/subscription keys are excluded. Exported backups are files you control. Removing app data does not remove backups or exports elsewhere.

Network requests to configured AI and billing services use HTTPS. Local deletion, provider retention, server usage records and payment records follow different lifecycles. For remote-data questions or deletion requests contact us, identifying the service involved without sending your API keys or full financial records.

Your controls

SMS, notification access and accessibility grants are separately revocable in Android Settings. Manual entry remains available. Photo imports use selected/shared files in the current Play edition. The capture helper uses a visible foreground-service notification and a stop control; battery settings remain user-controlled.

Cloud AI consent, receipt uploads and individual AI features are controlled in Settings, AI. Disabling inference does not necessarily disable a key-verification or restore request you explicitly initiate. Offers, previews and logos have their own controls.

Ledgerly does not contain an advertising SDK or a third-party analytics/crash-reporting SDK. Google Play may separately provide platform stability reports. We do not sell, rent or trade personal or financial data.

Questions and deletion requests

You can inspect and correct your local records, delete entries, revoke permissions, disable optional features and delete app data. Remote requests and subscription records are addressed separately as described above. Ledgerly is intended for adults.

For privacy questions, access/correction/deletion requests or complaints, contact Mad Max Labs at madmaxlabsllc@gmail.com. We may need enough information to locate the relevant subscription or service record; do not send passwords or API keys.

We update this policy when the app or its data handling changes. The date above identifies this revision. Individual feature availability depends on the version and distribution channel.