Privacy Policy

Effective 18 October 2026

This policy explains what Ledger ("we", "us") collects when you use the Ledger app and ledgerapp.uk, and how we handle it. We keep it deliberately plain.

Who is responsible for your data

The data controller for your personal data is:

Mono Apps Limited
Mono Apps Limited
Email: support@ledgerapp.uk

1. What we collect

• No account is required. The app works without registration. We do not collect your name or contact details unless you email us — or unless you sign in with your email, in the app or on the web (below).
• Optional email sign-in. If you buy PRO on ledgerapp.uk, you can sign in to the app with the email used at checkout. We then store that email, the random device identifier it is linked to, a short-lived hashed sign-in code, and the subscription status we receive for your purchase. Signing out removes the link.
• Usage analytics. The app records product events (screens viewed, features used, subscription funnel steps) tied to a random device-generated identifier — not your identity. We use Amplitude and our own infrastructure for this.
• Preferences such as followed leagues, teams and strategies are stored on your device; anonymous copies of follow/notification choices may be processed server-side to deliver push notifications you request.
• Push tokens. If you enable notifications in the app, we store the token needed to deliver them.
• Device and app details. Our paywall and subscription providers receive standard device information — device model, OS version, app version, language, currency and Apple's per-vendor identifier (IDFV), which is scoped to us and is reset when you delete our apps. Requests to our own servers carry your time-zone offset so kick-off times show in your local time.
• Approximate location. The app has no location permission and never asks for GPS. Your country or region is nonetheless inferred from your connection's IP address by our analytics and paywall providers, and your App Store country reaches our subscription provider along with a purchase. On the web, our servers also read the country of your connection to set the default currency of your Journal; the country itself is not stored.
• Crash diagnostics. If the app crashes we receive a crash report — device model, OS version and where in the code it failed — labelled with the same random device identifier so a crash can be matched to the session that produced it. It carries no contact details.
• Purchases. In-app subscriptions are processed by Apple; web subscriptions by Stripe. We receive subscription status (e.g. active/expired) and, for web purchases, the checkout email — never your card details.
• Website. The marketing pages of ledgerapp.uk set no cookies; any analytics storage happens only after you accept the cookie banner, as described below. Page views and checkout steps are counted under an identifier derived from your connection address, browser and the current day, which cannot be reversed to your address and changes daily.
• Web app cookies. The web app's cookies are all strictly necessary and set without asking for consent. Sent only to ledgerapp.uk/football: ledger_session (keeps you signed in; we store only a hash of it; renewed while you use the site, at most once a day, so it ends no later than 30 days after your last visit; 24 hours inside Telegram, where it is never renewed), ledger_device (a random identifier for this browser, used to link email sign-in; up to 400 days), ledger_signin_email (holds the email between the two sign-in steps for 10 minutes), ledger_tg (set only when you open Ledger inside Telegram, so the site shows its Telegram version; up to a year). Sent to the whole of ledgerapp.uk: __Host-ledger_signed_in (set when you sign in on the website, not inside Telegram; holds only the time your session ends, so the session is renewed only when needed, and lets the front page take you straight to Matches while you are signed in; it cannot sign you in and does not say who you are or which plan you have; set, renewed and removed together with ledger_session), ledger_leagues (the leagues you follow; up to 400 days), and tz / tz_pinned (the time zone kick-off times are shown in; a year). None is used for advertising or tracking across sites. The web app also stores, in your browser's localStorage, whether you dismissed the "install the app" prompt and the "turn on notifications" prompt; this is functional and strictly necessary, and it is not used for analytics.
• Website analytics (ledgerapp.uk). We use Amplitude to see which pages of the website and web app are visited. The site's other pages (such as PRO, FAQ and How it works) use the same choice and send nothing unless you have chosen Accept. Nothing is sent from your browser to Amplitude and no analytics identifier is created unless you choose Accept on the cookie banner. If you accept, a random analytics identifier is stored in your browser (localStorage, under ledger:analytics:device). Your choice itself is also stored in your browser (localStorage, under ledger:consent), whether you accept or reject. For each page you view we send the page path (without any query string), the event name, a timestamp, that identifier and the platform ("Web"). Amplitude also receives your IP address with each request and infers your approximate location from it. We never send your email, your stake amounts or anything from your Journal. You can withdraw consent at any time: open Cookie settings in the footer and choose Reject, which deletes the identifier and stops analytics from your browser.
• Account and purchase events. Separately from the cookie banner, our servers record a small number of account and purchase events in Amplitude, whatever you chose on the banner: for example that a web purchase was completed, a subscription started, renewed or ended, and the plan. These events are linked to your account's analytics identifier (a random code, not your email or card details) and are used to understand sales and keep the service running. They are deleted from our systems when you delete your account, and you can object to them by emailing us.
• Web account. If you sign in on the web we store your email, your account preferences (language, time zone, which emails and notifications you want), your subscription status, your sign-in sessions (only a hash of each session token, the browser identifier it belongs to and when it was last used), and a record of which emails and Telegram messages we have sent you, so that none is sent twice.
• Billing records. If you buy PRO on the web we keep a billing record linked to your email: your Stripe customer and subscription references, the plan, its status and the end of the current period.
• Journal. If you use the Journal, we store the bets you save, the stakes and odds you enter, results, and any money in or out you record, linked to your email, each with its currency. Unless you choose a currency in Settings, it is the one of your earlier entries or, for a first entry, the one for the country your connection comes from, so a currency stored on an entry may reflect where you were when you added it. Only you can see it. You can remove entries yourself, or delete all of it by deleting your account.
• Telegram. If you connect Telegram from your account, we store your Telegram user id, your Telegram username (if you have one), your Telegram language setting and your Telegram message settings, linked to your email, so our bot can send you the messages you choose. Disconnecting removes them. When you open Ledger inside Telegram, Telegram passes us your Telegram user id, which we use only to find your linked account and sign you in.
• Web push notifications. If you turn on push notifications on the web, we store the push subscription your browser gives us (an address at your browser's push service and the keys to encrypt messages to it) and your browser's user-agent string, linked to your email. Turning notifications off removes it.
• Abuse prevention on the web. Our web server passes your IP address to our API so rate limits apply to you rather than to everyone at once. It is used only for that and is not stored with your account.
• Server logs. Our infrastructure provider (Cloudflare) processes IP addresses transiently for security, rate limiting and abuse prevention.

2. What we do NOT do

• We do not sell your data.
• We do not build behavioural profiles of identified individuals.

3. Why we process data (legal bases)

We process the data above to run and improve the Service (legitimate interests); to provide what you ask for, such as your account, the Journal, PRO and notifications (performance of a contract); to keep the billing records that tax and accounting law requires (legal obligation); and, where required, with your consent. Website analytics from your browser on ledgerapp.uk (Amplitude) rely on your consent, which you can withdraw at any time through Cookie settings in the footer. The account and purchase events our servers record (section 1) rely on our legitimate interest in understanding sales and running the service; you can object by emailing us. In the iOS app, App Tracking Transparency is requested once, shortly after first launch; your answer does not change the in-app analytics described above, which are first-party and anonymous either way. You can use the core app without granting optional permissions.

4. Third parties

We share only what each provider needs to do its job:

• Amplitude — product analytics for the app and, only after you accept the cookie banner, for the website and web app; it also receives the account and purchase events our servers record. Receives the events described above and infers approximate location from the connection IP.
• Cloudflare — hosting and security, and the database holding your account data and our own copy of the product events. When it is switched on, Cloudflare Turnstile checks that a sign-in comes from a person and not a bot.
• Cloudflare Web Analytics — cookieless, aggregate page statistics for our website. It stores no identifier in your browser.
• Apple — payments and notification delivery.
• Expo — turns your device's notification token into one we can send to.
• Firebase Crashlytics (Google) — crash diagnostics. Google also registers an installation identifier and app-session events that Crashlytics depends on.
• RevenueCat — subscription status for the app. Receives your App Store receipt, which products you bought, and your store country and currency. If you sign in to the app with the email you bought PRO with on the web, we ask RevenueCat to mark that device as subscribed for the paid period.
• Stripe — payment processor for web purchases. Receives your payment details and checkout email directly; we receive the subscription status and checkout email, never your card details.
• Resend — sends our emails: the one-time sign-in code and, if you have PRO and leave them on, the new-signal and weekly summary emails. Receives your email address and the content of each email.
• Cloudflare Turnstile — a security check on the web sign-in form that keeps automated sign-up floods out. It runs in your browser and receives your IP address and browser details; it is not used for advertising.
• Telegram — if you connect Telegram, our bot's messages to you are delivered by Telegram, which receives what the bot sends you. Your Telegram account itself is covered by Telegram's own privacy policy.
• Browser push services — if you turn on push notifications on the web, the push service run by your browser's maker (for example Google, Mozilla, Microsoft or Apple) delivers each notification to your device. It receives the notification and the push address, not your email.
• Anthropic — writes and translates the plain-English analysis of each match. It receives match data only (teams, statistics and team news), never anything about you or any other user.
• Superwall — paywall delivery. Receives which paywall you were shown and standard device details, including the IDFV and your region.
• Sports data providers — match data flows to us; none of your data flows to them.

Apart from Cloudflare, which hosts our database, only Stripe and Resend receive your email address, and only to take a payment or send you an email. The Meta SDK is compiled into the app but is not configured and transmits nothing; if we ever switch it on, we will update this policy first.

Some of these providers, including Amplitude and Cloudflare, process data in the United States; transfers rely on the UK International Data Transfer Addendum or the UK–US data bridge, as applicable.

5. Retention

• Your account (email, preferences, Journal and billing record) is kept until you delete it. Your Telegram link and web push subscriptions are kept until you disconnect them, turn them off or delete your account.
• Sign-in. A sign-in session ends 30 days after you last use it (24 hours inside Telegram), or when you sign out. Sign-in codes work for 10 minutes and are deleted within a day.
• Analytics. Our own copy of product analytics events is deleted after 30 days, and app usage events after 90 days. Amplitude keeps a longer history, so we can see trends over time. The web analytics identifier stays in your browser until you choose Reject in Cookie settings or clear your browser storage; your consent choice stays until you change it or clear storage.
• Notifications. Records of which app notifications were delivered are deleted after 14 days. Server-side push tokens are removed when notifications are disabled or invalid.
• When you delete your account, everything above that is linked to you is deleted straight away, except the billing records of web purchases: we keep those with your email removed, because UK tax and accounting law requires us to keep records of sales, and delete them six years after the end of the financial year they belong to. Stripe keeps its own records of your payments under its own legal obligations.
• On your device. Crash reports are retained by Firebase Crashlytics under its own standard retention. Device-local data (preferences) lives on your phone and is deleted when you delete the app — the random identifier goes with it, because it is stored inside the app rather than on the device, so a reinstall starts a new one.

6. Your rights

Under UK GDPR you may request access, correction or deletion of personal data we hold, object to processing, or complain to the ICO. If you have a web account, you can delete it yourself at any time under Account › Delete my account on ledgerapp.uk/football. If you have an active web subscription, cancel it first in Account › Manage subscription; any PRO time you have already paid for ends when you delete the account. If you use the app without signing in, requests concern the random device identifier — include it where possible, or simply reset it by reinstalling the app. Contact: support@ledgerapp.uk.

7. Children

Ledger is not directed at children under 13, and we do not knowingly process their data.

8. Changes

We will post any changes here with a new effective date; material changes will be signposted in the app.