Where your data goes
As of September 9, 2026 · Each claim below was checked against Ledger’s actual code: the routes, logs, and analytics calls. The legal detail lives in the Privacy Policy.
Your prompts go to exactly one AI provider: Anthropic.
Everything you type into Memo, lessons, and Skills — text, documents, photos — is sent to Anthropic’s Claude API to generate your draft. No other model provider receives them, and Anthropic’s commercial terms bar training on them.
Until you sign in, your work lives in your browser.
Progress, streaks, saved prompts, your voice profile, and interview answers sit in your device’s local storage — anonymous use writes none of it to our database.
Signing in is the only thing that stores your work on our servers.
An account stores your email plus a sync snapshot of that same on-device work (so you can resume on another device) in our Postgres database, hosted on Railway.
Analytics can never carry your writing.
Every analytics event is a name, an id, a score, or a count — autocapture is off, session recording is off, and we verified call-by-call that no event includes prompt text or drafts.
Error monitoring gets errors, not your prompts.
When something breaks, Sentry receives the error and request metadata — never the text you typed or the draft that came back — and replay is disabled.
Server caches are short-lived and memory-only.
Scoring keeps a small in-memory cache of recent results so re-scoring the same prompt is instant — nothing in these caches is written to disk, and they vanish on every deploy.
We only get your email when you hand it to us.
Sign-in links (sent via Resend), the optional email field on feedback, and the team-plan form on the pricing page are the collection points. The “join the waitlist” button is a plain mailto link that opens your email app. The team form sends exactly the five fields you type — name, work email, organisation, roster size, state — to our server, which stores them in Postgres and emails them to us; nothing on the page captures an address you did not type into it.
Rate limits and run meters count; they don't read.
Abuse protection uses per-IP counters held in memory and signed cookies that carry a number and a timestamp — never the content of a run.
No sale of data. No ad trackers.
There is no advertising integration, no data broker, and no cross-site tracking anywhere in the product.
The pipes: Railway behind Cloudflare, all HTTPS.
Hosting runs on Railway, fronted by Cloudflare for DNS and TLS — the standard infrastructure logs (IPs, URLs) those platforms keep are listed as processors in the Privacy Policy.
Your side of the deal
The biggest privacy lever is what you paste. The free lesson What client data can go in a prompt (almost nothing) teaches the 30-second redaction test before anything goes into any AI — this one or anyone else’s. And you can ask us to delete your account data any time: [email protected].