Back to sign inProject Ledger

Privacy Policy

Last updated: July 10, 2026

This Privacy Policy explains how Project Ledger (“we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use our service (the “Service”). It applies to visitors, account holders, and anyone whose information we receive through the Service.

1. Data controller

Project Ledger is the data controller for personal information processed through the Service, except where you use the Service on behalf of an organization that is a controller in its own right (for example, a provider or client organization submitting information about its own end users). In those cases we act as a processor on that organization's behalf.

2. Information we collect

2.1 Information you provide

  • Account information: email address, username, first and last name, password (stored as a salted hash), preferred profile type, and (optionally) an avatar image.
  • Profile and project data: project titles and descriptions, invitations, connection requests, roles.
  • Update content: daily and weekly updates you create, including free-text sections (completed, in progress, blockers, next steps), comments, satisfaction reactions, and references between updates.
  • Attachments: files you upload to project updates (PDF, images, video, audio, documents, spreadsheets, presentations, code, and other supported types) along with metadata such as file name, MIME type, and size.
  • Communications: messages you send to support and any information you volunteer in feedback.
  • Payment information (if applicable): billing details processed by our payment provider. We do not store full card numbers on our servers.

2.2 Information collected automatically

  • Log & device data: IP address, browser type and version, operating system, referring pages, and interactions with the Service (for security, debugging, and analytics).
  • Cookies and similar technologies: for authentication (session cookies), preferences (e.g. theme), and product analytics. See “Cookies” below.
  • Notifications: read/ignored timestamps and delivery metadata.

2.3 Information from third parties

If you sign in with a third-party account (for example, Google or Microsoft), we receive basic profile fields from that provider as you authorize.

3. How we use information

We use personal information to:

  • Provide, operate, secure, and improve the Service;
  • Deliver updates, notifications, and other project communications to the participants you direct;
  • Authenticate accounts, prevent fraud, and enforce our Terms;
  • Process payments and subscriptions (via our payment provider);
  • Send transactional emails (activation, password reset, invitations, billing notices);
  • Analyze usage to fix bugs, improve performance, and build new features;
  • Comply with legal obligations and respond to lawful requests.

4. Legal bases (EEA / UK)

Where the GDPR or UK-GDPR applies, we rely on:

  • Contract — to deliver the Service you signed up for.
  • Legitimate interests — to keep the Service secure, prevent abuse, and improve the product, balanced against your rights.
  • Consent — where required (for example, optional marketing communications or non-essential cookies). You can withdraw consent at any time.
  • Legal obligation — where processing is required by law.

5. How we share information

We do not sell personal information. We may share it with:

  • Other project participants: when you post updates, comments, reactions, or attachments to a project, the other participants of that project can see them.
  • Service providers (processors) that help us operate the Service, including:
    • Cloudflare R2 — object storage for avatars and attachments;
    • Resend — transactional email delivery;
    • Payment processor (if applicable) — subscription billing;
    • Hosting and infrastructure providers — for database and application hosting.
  • Legal & safety: when required by law, to comply with a lawful request, or to protect the rights, safety, or property of Project Ledger, users, or the public.
  • Business transfers: if we're involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material change.

6. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account, we soft-delete your profile and content and then remove or anonymize it within a reasonable period, except where retention is required (for example, financial records for tax purposes, or backups on their standard rotation cycle).

7. Your rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or incomplete information;
  • Delete your information (subject to legal exceptions);
  • Restrict or object to certain processing;
  • Portability — receive your information in a structured, machine-readable format;
  • Withdraw consent where processing is based on consent;
  • Opt out of the sale or sharing of personal information under U.S. state laws (we do not sell personal information);
  • Lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@projectledger.app. We may need to verify your identity before responding.

8. Cookies and similar technologies

We use a small number of cookies and browser-storage entries. These typically fall into three groups:

  • Strictly necessary — required to log you in and keep the Service secure.
  • Preferences — remember choices such as your theme (light/dark) or last-used profile type.
  • Analytics (if enabled) — help us understand aggregate usage and improve the Service.

You can block or delete cookies via your browser, but doing so may break parts of the Service.

9. Security

We use industry-standard safeguards including encryption in transit (HTTPS), password hashing, access controls, presigned upload URLs for file storage, and application-level authorization. No system is perfectly secure, however. Notify us immediately at privacy@projectledger.app if you believe your account has been compromised.

10. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact privacy@projectledger.app and we will delete it.

11. International data transfers

We and our service providers may process personal information in countries other than your own. Where we transfer personal information out of the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses.

12. Third-party links

The Service may contain links to third-party websites (for example, Loom or YouTube URLs attached to updates). Their privacy practices are governed by their own policies.

13. Changes to this policy

We may update this Policy from time to time. When we do, we'll change the “Last updated” date above and, for material changes, provide reasonable notice (for example, by email or in-app).

14. Contact us

Questions about this Policy or your data? Email privacy@projectledger.app. For data protection inquiries specifically, you can also contact our data protection contact at privacy@projectledger.app.