Privacy Policy
1. Who we are
LedgerVault is published by ZoeDev ("we", "us"). You can reach us at [email protected].
2. What we collect
Nothing. We do not collect, receive, store, or have access to any personal data about you. Specifically:
- There is no account, no sign-up, and no login.
- We operate no server that the app talks to. The app cannot reach the
network because it does not hold the Android
INTERNETpermission. - There are no analytics SDKs, no crash reporting SDKs, no advertising SDKs, and no third-party trackers in the app.
- We do not collect device identifiers, advertising IDs, location, contacts, or usage statistics.
3. Where your data lives
Everything you create in LedgerVault is stored only in the app's private storage on your own device:
| Data | Where it is stored |
|---|---|
| Ledgers, transactions, categories, tags, notes, budgets, reminders | An SQLCipher-encrypted database inside the app's private directory |
| Receipt photos you attach | The app's private file directory. They are never written to the system gallery, and EXIF location metadata is removed. |
| The encryption key | Android Keystore, hardware-backed where the device supports it |
Other apps on your device cannot read this data. Android's app sandbox enforces this separation.
4. When data can leave your device
Data leaves your device only when you explicitly ask it to, through one of these actions:
- Export or backup — you choose the destination with the system file picker, including cloud storage providers you have installed.
- Share — you pick a target app in the system share sheet.
In both cases the file is created by you, handed to the app you chose, and we never see it. Backup files are encrypted with your own passphrase.
5. Permissions and why they exist
| Permission | Why | When it is requested |
|---|---|---|
CAMERA |
To photograph a receipt for an entry. The photo stays on your device. | Only when you tap the camera button in an entry |
POST_NOTIFICATIONS |
To deliver reminders you created yourself. | Only when you enable reminders |
USE_BIOMETRIC |
To unlock the app with your fingerprint or face instead of a PIN. Handled entirely by Android Keystore. | Only when you turn on biometric unlock |
SCHEDULE_EXACT_ALARM |
So your reminders fire at the exact time you set. If you decline, reminders still work with a small delay. | Only when you enable reminders |
Declining any of these permissions does not block the core ledger. We never ask for contacts, SMS, call logs, precise location, or background location.
6. Sharing with third parties
We share nothing with anyone, because we receive nothing. There are no third-party SDKs in the app that could receive data independently.
7. Retention and deletion
Your data stays on your device until you delete it. You can:
- Delete individual entries, which move to a recycle bin you can empty.
- Delete a whole ledger from the ledger management screen.
- Erase everything via Settings → Data → Delete all data, or by clearing the app's storage in Android settings, or by uninstalling the app.
Because we never hold a copy, there is nothing for us to delete on our side and no deletion request to file.
8. Children
LedgerVault is not directed at children under 13. We do not knowingly collect data from anyone, including children, because we do not collect data at all.
9. Security
The database is encrypted at rest with SQLCipher (AES-256). The database key is protected by Android Keystore, and can additionally require your device credentials or biometrics. You can enable an app lock with a PIN. No method of storage is perfectly secure, but we deliberately minimise the attack surface by keeping everything local and giving the app no network access.
10. Your rights
Privacy laws such as the GDPR and China's PIPL grant rights to access, correct, export, and delete your personal data. In LedgerVault you exercise all of these directly and offline: your data is on your device, you can view and edit it in the app, export it at any time, and delete it at any time. We hold no copy to act on.
11. Changes to this policy
If this policy changes, we will update the date at the top of this page and publish the new version at this URL. Material changes will also be noted in the app's release notes.
12. Contact
Questions about this policy: [email protected]
隐私政策
1. 我们是谁
记账库由 ZoeDev 开发和运营。联系方式： [email protected]。
2. 我们收集什么
什么都不收集。我们没有服务器，也没有账号体系，无法访问你的任何数据。具体来说：
- 无需注册、无需登录。
- 应用未声明
INTERNET权限，Android 系统会阻止它联网。 - 不含统计、崩溃上报、广告等任何第三方 SDK。
- 不收集设备标识、广告 ID、位置、通讯录或使用行为。
3. 数据存在哪里
- 账本、账单、分类、标签、备注、预算、提醒：存于应用私有目录下的 SQLCipher 加密数据库。
- 凭证照片：存于应用私有文件目录，不写入系统相册，且会移除 EXIF 位置信息。
- 加密密钥：由 Android Keystore 保管（设备支持时为硬件级）。
其他应用无法读取这些数据，这是 Android 应用沙箱的强制隔离。
4. 什么情况下数据会离开设备
只有你主动操作时才会：
- 导出 / 备份：由你用系统文件选择器指定保存位置（可存到你安装的网盘）。
- 分享：由你在系统分享面板中选择目标应用。
文件由你创建、交给你选择的应用，我们不参与也看不到。备份包用你自己的口令加密。
5. 权限与用途
| 权限 | 用途 | 申请时机 |
|---|---|---|
CAMERA | 拍摄消费凭证，照片仅存本机 | 仅在你点击拍照时 |
POST_NOTIFICATIONS | 发送你自己设置的记账提醒 | 仅在你开启提醒时 |
USE_BIOMETRIC | 用指纹 / 面容解锁应用 | 仅在你开启生物识别时 |
SCHEDULE_EXACT_ALARM | 让提醒准点触发；拒绝则降级为略有延迟 | 仅在你开启提醒时 |
拒绝上述任何权限都不影响记账主流程。我们不申请通讯录、短信、通话记录、精确位置或后台位置。
6. 第三方共享
不存在共享，因为我们不接收任何数据，应用内也没有能独立上传数据的第三方 SDK。
7. 数据保留与删除
数据一直保存在你的设备上，直到你自行删除：
- 删除单笔账单（进入最近删除，可清空）。
- 在账本管理页删除整个账本。
- 在「设置 → 数据 → 删除全部数据」清除，或在 Android 设置里清除应用存储、直接卸载应用。
因为我们从未持有副本，所以无需也无法向服务器提交删除请求。
8. 未成年人
记账库不面向 13 岁以下儿童。由于我们不收集任何数据，也不会有意收集儿童信息。
9. 安全
数据库以 SQLCipher（AES-256）加密存储，密钥由 Android Keystore 保护， 可额外要求设备凭据或生物识别。你还可以开启 PIN 应用锁。 任何存储方式都无法做到绝对安全，但我们通过「全部本地化 + 切断联网」把风险面降到最小。
10. 你的权利
依据《个人信息保护法》《个人信息安全规范》以及 GDPR 等法规，你享有查阅、更正、导出、删除个人信息的权利。 在记账库中这些权利都可以离线直接行使：数据就在你的设备上，可随时查看、编辑、导出、删除。我们不持有副本。
11. 政策更新
本政策如有变更，会更新页面顶部的日期并在本网址发布新版本；重要变更也会写入应用更新说明。
12. 联系我们
隐私相关问题：[email protected]