The free version stores personal entries, accounts, categories, budgets, schedules, settings and receipt images in the app’s private storage on your phone. Google sign-in is required for both Free and Pro. Each Google account has a separate local ledger and receipt storage on a phone. Personal financial records remain local unless you explicitly export them or enable Pro Drive backup. Signing out hides the account’s data and stops local reminders, household updates and automatic backups. Signing back into the same account on this phone reopens its saved ledger; it does not recover unbacked-up data after uninstalling or changing phones. You may explicitly export a file and import its financial records into another account as private copies. Android’s device backup may also retain app data if you enable that device feature. HomeLedger does not read your bank accounts, SMS, contacts or email messages.
Google sign-in and household sharing
For every Free or Pro account, Firebase Authentication processes your Google account identifier, name, email and profile photo. We save your profile and household membership in Google Firebase. Records marked shared, including financial amounts, dates, descriptions and who added an entry (plus payer/split metadata retained from older versions), are stored in Firestore and available to current household members according to their roles. Receipt images attached to shared entries are optimized and uploaded to private Google Cloud Storage. Only current household members with access to the entry, or the owner of a frozen archive containing that receipt, can download them through authenticated checks. Images are cached in each account’s private phone storage and included in private Drive backups. Removed members cannot access future receipts or newer versions. Unreferenced cloud images are cleaned up after a seven-day grace period. Personal receipt images remain local unless included in a private backup or explicit export. Invite recipients’ email addresses are stored to restrict invitation redemption. Invites expire after seven days or when revoked or redeemed. Leaving, removal and household deletion end future access. A frozen copy of previous shared entries, household names and payer/split names is kept in each departing member’s private archive and on their phone. Deleting a household removes all active members and invitations; it preserves each member’s past financial history. Only the archive’s account can read its cloud copy. You can delete a saved entry from your own history without changing anyone else’s copy. These copies remain until the account or saved records are deleted, and can be included in private backups and exports.
Private Google Drive backups
If you enable Drive backup, HomeLedger requests access only to its private appData folder. The backup includes your local ledger and available attached receipts, including shared and archived household receipts. Backups use lossless data compression. Photos may be resized and compressed to reduce storage while keeping receipt text readable. Restored household entries are saved as private historical copies; restoring a backup does not grant or restore household membership. Current shared entries are refreshed from the household service. It does not grant access to your other Drive files. Automatic backup uses Android background scheduling and an internet connection; delivery depends on device restrictions. You can turn it off, restore the latest backup, and delete HomeLedger backups. Backups stay in your Drive until you delete them or remove the app’s hidden data in Google Drive settings. A copy you export or share is controlled by you and its recipient.
Pro subscriptions and complimentary codes
Google Play processes payments. We do not receive your card details. Our server verifies purchase tokens and stores entitlement status, expiry and account linkage to prevent duplicate claims and manage renewals, cancellations and refunds. Complimentary codes are stored as hashes and can be claimed once. A lifetime complimentary entitlement is linked to the Google account that redeems it, without recurring charges.
One-month subscription trial
Subscription trials start only through an eligible Google Play purchase. Google Play processes your payment method and trial eligibility; HomeLedger receives purchase verification and entitlement status, including whether a trial is active and when it ends. We do not receive card details. Signing in alone no longer grants a trial. Historical welcome-trial identifier hashes and original trial dates may remain to prevent repeated promotional claims; they contain no email, name or financial records.
Permissions and service providers
Camera and image access are used only when you attach a receipt or scan an invitation. Notification permission is used for reminders and optional household entry notifications. When you enable household notifications, we store a Firebase Cloud Messaging registration token and a random per-installation device identifier with your account, household and notification preference. These are used only to deliver shared-entry alerts to your devices. We do not track online presence or display financial amounts or descriptions in these alerts. You can switch these alerts off on the Household page; signing out removes the current device’s notification registration. Precise alarm access is optional for timed reminders. Google Firebase, Google Drive and Google Play process data under their own terms and security practices; processing may take place outside your country. Firebase services process authentication identifiers, IP addresses, installation identifiers and technical request information for functionality, security and account management. Operational server logs may contain technical error and security information.
QR scanner diagnostics
The invitation scanner uses Google's ML Kit barcode SDK. Camera images are processed on the device. The SDK sends technical information to Google, such as device model and operating system, app version, per-installation identifiers, scanning feature events, configuration, performance measurements and error codes, for diagnostics and SDK usage analytics. These diagnostics are separate from your financial entries and receipt images. HomeLedger includes no advertising, advertising identifiers or sale of your data. We do not include Google Analytics or use your financial records for advertising.
Retention and deletion
Personal records remain on the device until you delete them or remove the app. You can export your records or use Settings → Your data → Reset your ledger to erase this phone’s entries, accounts, budgets, schedules, archived household history and receipts while keeping your cloud account and Pro entitlement. Reset signs you out and can optionally erase HomeLedger Drive backups. Shared records belonging to other household members remain. Currency selection changes how the same numeric amounts are displayed and does not erase or convert your records. You can request deletion of your connected cloud account in Settings → About & support → Delete account, or through the public account deletion page. Deletion removes the Firebase profile, memberships and Pro entitlement. Shared entries in homes you do not own are anonymised to preserve other members’ financial history. The live household owned by a deleted account, including its shared records and invites, is deleted; other members lose active access. The deleted account’s own cloud archives are removed. Its identity in other members’ frozen cloud history is anonymised. Copies already exported, backed up or held locally by other people cannot be recalled. Raw purchase tokens and the deleted app account’s entitlement are removed from our database; Google Play retains its own payment records. A minimal purchase-recovery record remains so the original Google account can restore a paid plan after rejoining and so refunded or replaced purchases cannot be claimed again. This server-only record contains one-way hashes of the Google account identifier, purchase reference and original app-account link, plus the product identifier and revocation status. It contains no name, email, raw purchase token, expense entries or receipt images. We retain it while the purchase may need to be restored or checked for refunds or misuse. Restoration always requires the same verified Google account and a fresh Google Play purchase check. You can optionally delete Drive backups and local data. Deleting an account does not cancel a Google Play subscription; cancel separately in Google Play. Support deletion requests are normally completed within 30 days after identity verification. We may retain information when legally required, and will explain any exception.
Security and your choices
Access to shared financial records is limited by Firebase authentication and membership rules. Google services encrypt data in transit and at rest; exported files and device access remain your responsibility. Leave a household, revoke invites, disable backups, or revoke Google access at any time. We do not guarantee that a device or internet service can never fail. HomeLedger is intended for adults managing their own or their household’s money.
Contact and policy changes
Contact Codegully at monu.giri.work@gmail.com or WhatsApp +91 7669006847 for privacy, support or deletion requests. We will publish material changes with a new effective date. This policy describes HomeLedger’s intended production configuration; test releases may identify cloud features as beta.
