Trader Ledger Privacy Notice
Revision 2 · in force from 17 October 2026 · Ledgepod LLC, a New Mexico limited liability company · applies to the Trader Ledger software, its Trading Pods, the Ledgepod service, and the paired-phone companion
This is the public summary of the Privacy Notice. The full notice, shown in the Software before you accept it, is the one that applies to you.
The short version
The software runs on your computer and reads your own broker records. What reaches us is a report under a username: how the software is doing, how many orders were placed, which tickers traded and how well they bought and sold, and — if your tier requires it or you switch it on — your daily results. Reports never carry account numbers or any part of them, your name, your e-mail, your computer’s name, passwords, developer keys, sign-in tokens, or order identifiers. We hold an e-mail address only if you give us one: when you ask for an invitation, or ask for the phone app. We do not sell anything about you. Reports are deleted thirteen months after we receive them, or within twenty-four hours of your leaving. A few records are kept longer after you leave, as proof of what was agreed and said (Section 7). Everything the software sends is listed inside it under What this app sends, together with the last report it actually sent.
1. Who we are and what this Notice covers
Ledgepod LLC operates the Ledgepod service and publishes the Trader Ledger software (the “Software”). This Notice explains what information the Software transmits to the Ledgepod service, what the Ledgepod service keeps, what we do with it, and what choices you have. It is part of the Terms of Use (Section 7.8); words in capitals mean what the Terms say they mean. It does not cover your brokers or any website of theirs — their own notices apply there.
2. Information the Software sends to the Ledgepod service
The Software sends nothing until you accept the Terms, choose or accept a username, and enter an activation code. From then on it sends only the items below, and only those your tier requires or you have switched on. The exact list for your installation, and the last report sent, are shown in the Software under Settings → What this app sends.
2.1 Identity — the username and a machine key. At first run you choose a username, or the Software assigns one. The username is the only identity the Ledgepod service has for you. The Software also creates a signing key unique to that computer; the Ledgepod service keeps the public half so it can tell your computer’s reports from anyone else’s. The key identifies the installation, not you.
2.2 Health. Software version, Pod versions, the time of the last successful refresh, the Windows version (not the computer’s name), counts of broker requests, and error notes with file paths and account data removed. Sent while the Software is running and connected to the Ledgepod service.
2.3 Trading activity, by tier. Depending on the tier the Administrator has assigned to your username:
- the number of orders placed per trading day, per linked account (accounts are identified only by a code derived from the nickname you gave them — see 2.6);
- the tickers traded per account and broker, with buy-side and sell-side outcomes recorded separately (attempts, fills, cancellations, rungs sold or parked), and the strikes, widths, quantities and prices of filled and cancelled orders;
- daily and monthly realized results, gross, fees, and bank movements by day, amount and kind;
- allocation rules and notes, for the tiers whose terms include them;
- the operating parameters a Pod acknowledged, and the times a Pod started and stopped.
For tiers designated optional, results and allocations are sent only while Share my results is switched on in Settings; tickers, order counts and health are sent regardless, because the Ledgepod service needs them to check ticker conflicts between accounts and to watch order counts against the exchange rule. For health-only tiers, none of this section is sent. Your tier and its designation are shown in Settings.
2.3A Sharing you choose. Some features let you share results with a person you choose, inside the Software. They see only what you choose to share, and you can stop at any time. The details are in the notice inside the Software.
2.4 Things you write. Issue reports, suggestions and questions you send from the Software, the diagnostics you choose to attach to them and your answers to announcements. Some features for members are described in the notice inside the app. Write what you like, but please leave out account numbers and personal details: we strip what we recognize and the Software warns you, but text you type is sent as you typed it.
2.5 Acceptance records. The date and time you accepted the Terms and this Notice, their revisions, and a hash of the exact text — so both of us can prove which version you agreed to.
2.6 What is derived, not sent. The Software never sends an account number. Each linked account is identified to the Ledgepod service by a one-way code computed on your computer from the nickname you gave the account. The Ledgepod service can tell “this is the same account as last week” and nothing else. Renaming an account produces a new code; the Software asks you once, on your computer, whether it is the same account.
2.7 Files you send for checking. If you send us a file to check through the Software, it is sent once and stored encrypted, and it stays yours.
2.8 Crash reports. If the Software or a Pod stops unexpectedly it sends the version, a fingerprint of where it stopped, and the error text with paths and account data removed — never a memory dump and never your files.
2.9 The e-mail address for the phone app. If you ask for the phone app in the Software (Settings → Get the phone app), you type the e-mail address of the Google account on your phone. The Ledgepod service keeps it with your membership, uses it to e-mail you the install links, and keeps a record of when each e-mail was sent and whether it was delivered. It is not used for anything else and is erased when your membership ends. This is the only e-mail address the Software ever sends, and only when you type it.
2.10 Request access. If you ask for access from inside the Software instead of entering an activation code, it sends once, when you press Send request: your username, the brokerage you picked, the note you typed, the Software version, and a one-way fingerprint of your computer (never the computer’s own identifier). If the request is declined, repeated requests from the same device may be blocked.
3. Information the Software never sends
Account numbers or any part of them, not even the last digits; your legal name, e-mail address (except the one you choose to give for the phone app, 2.9), postal address or telephone number; your computer’s name or Windows user name; broker passwords, developer keys, sign-in tokens or refresh tokens; order identifiers issued by a broker; bank names or memo text from transactions; file paths; the contents of your Statements; anything outside the Software’s own folders. The Software does not read your files, your browser, your e-mail, your camera or microphone, or your location. It contains no analytics or advertising library and sets no tracking identifier.
3.1 Invitation requests are a separate thing. Everything above is about what the Software sends. If you asked for an invitation, you typed your name, e-mail address, a chosen username, the brokerage you use and a note yourself. The Administrator uses them only to reply to you and to send your invitation code. They are kept apart from your username: they are never copied to your reports, the audit log, a Pod or our own tools, and the Software never receives them. A declined request’s name and e-mail are deleted at once; if an invitation code is never used, they are deleted ninety (90) days after it expires.
4. What the Ledgepod service does with reports
We use reports to keep the Software and Pods running and to support you when you ask; to distribute signed updates and Pods to the usernames entitled to them; to detect two accounts trading the same ticker at the same broker on the same day; to watch order counts against the exchange rule; to decide and record tier, approval and pod entitlements; to produce aggregate statistics that identify no username; and to keep an audit log of what the Administrator did and when. We do not use reports to market to you, to build a profile of you, or to make automated decisions about you other than the checks the Terms describe — signature, approval, seats, tier, entitlements and order limits. Some features for members are described in the notice inside the app.
5. Who can see it
The Administrator — the Company and the persons it authorizes to operate the account-management tools — sees reports by username. The Ledgepod service does not link a username to a person unless you have told the Administrator who you are; that mapping, if it exists, is never kept with your reports.
Service providers. We use a few companies to run the service and describe them by type: our hosting provider, which runs the Ledgepod service’s server and sees encrypted traffic and the machine it runs on; our website and network provider, which runs our websites, forwards e-mail sent to our addresses; an e-mail delivery service, which receives the address and the message for each e-mail we send; an e-mail inbox provider, which holds the e-mail you send us; and the app store you install the phone app from, which handles the download under its own terms. Each receives only what it needs for its job. We use no analytics providers, no advertising networks and no data brokers.
Other members. A person you choose to share with sees only what you share (2.3A).
No one else, except as the law requires — a subpoena, a court order, a regulator’s lawful demand — or as needed to establish or defend legal rights. If we are ever required to disclose reports we will, where the law allows, tell the affected usernames through the Software.
We do not sell reports or any information about you, and we have never done so. If the Company is sold or merged, reports transfer with the Ledgepod service under this Notice, and you are told in the Software before the transfer takes effect.
6. What passes through our servers without being kept
6.1 Paired phone. If you pair a phone, it talks to your own computer through the Ledgepod service over an end-to-end encrypted channel. The Ledgepod service relays sealed messages it cannot open and keeps only what it needs to deliver them: the pairing identifiers and the time of the last message. It never sees your ledger on the way past.
7. How long we keep things
| What | How long | Why |
|---|---|---|
| Reports — health, activity, results, things you write | 13 months from the day the Ledgepod service received them, then deleted | a full year of statements plus one month |
| Reports after you leave or are removed | deleted within 24 hours, except the records this table keeps after you leave | the Terms promise it |
| Acceptance records — revision, hash, time | while your username exists, plus 13 months | proof of the agreement |
| A file you sent for checking | until you ask us to delete it, or 13 months after your username is removed | so it can be checked again against a new version |
| Audit log of Administrator actions | 13 months | accountability for the Administrator |
| Connection logs — time, address, request, result; no bodies | 30 days | fault-finding |
| Backups | kept up to 30 days, then overwritten | recovery |
| Name and e-mail from an invitation request | deleted at once if declined; 90 days after an unused invitation code expires | kept apart from your username (3.1) |
| The phone-app e-mail address, and when each e-mail was sent | until your membership ends, then erased | to send the install links, and proof they were sent |
| Sharing and consent records: what you switched on or off, and when | 6 years after your membership ends, then deleted | proof of what you agreed to |
| Messages between you and another member | 2 years after your membership ends, then deleted | a record both sides can rely on |
| Aggregate statistics identifying no username | indefinitely | they are not about you |
Deletion runs regularly. A deleted report is gone from the live database at once and from the last backup within thirty days.
8. How we protect it
Messages between the Software and the Ledgepod service are signed and checked, and anything altered or replayed is refused. Traffic runs over encrypted connections. The Software’s settings on your computer are encrypted and protected against tampering. The Ledgepod service keeps the minimum described above and no more — reports have no field for a name. Access is limited to authorized personnel, and every action is logged.
No system is perfectly secure. If we learn of a breach affecting reports we will tell affected usernames through the Software without undue delay, and by other means where the law requires it.
9. Your choices
- See what is sent — Settings → What this app sends shows the list for your tier and the last report exactly as it was sent.
- Share my results — on optional tiers, switch results off or on at any time in Settings; the change applies from the next report.
- Sharing you choose — stop it at any time in the Software (2.3A).
- A copy of your reports — ask through the Software (Report a problem in the Software, or any message to the Administrator) and the Ledgepod service answers with a file you can save.
- Correct something — reports are computed from your broker records; correcting a record at the broker and refreshing corrects the next report. Tell us through the Software if a report looks wrong.
- Leave — Leave, in the Software, stops all reporting and deletes your reports within twenty-four hours. Uninstalling removes the Software and its data from your computer; your Statements are written to Documents first unless you have turned that off.
- Delete your data — Leave deletes your reports within twenty-four hours, except the records Section 7 keeps as proof. If you can’t use the Software, e-mail support@ledgepod.app from the address you gave us, or quote your username, and we will delete them for you.
- Unpair a phone — at any time, from either side.
- Ask us anything about this Notice at support@ledgepod.app, or through the Software: Report a problem in the Software.
We do not treat anyone differently for exercising these choices; a health-only or optional tier is a tier like any other.
10. Children
The Software is for adults who hold brokerage accounts. We do not knowingly collect anything from anyone under eighteen; if you believe we have, tell us and we will delete it.
11. Where the Ledgepod service runs
The Ledgepod service runs on servers in the United States. If you use the Software from outside the United States, your reports travel to and are stored in the United States under this Notice and United States law.
12. State-specific disclosures
California. We do not sell personal information and do not share it for cross-context behavioural advertising. We honour the choices described in Section 9 for everyone, whichever state they live in. Categories collected: identifiers (a username you choose, a per-installation key, a one-way computer fingerprint if you request access (2.10), and an e-mail address only if you give us one); commercial information and internet activity limited to the items in Section 2. We collect no sensitive personal information as that term is defined by the CPRA. Source: the Software on your own computer. Purposes: Section 4. Retention: Section 7.
New Mexico. The Company is organized in New Mexico and the Terms choose New Mexico law. New Mexico’s Data Breach Notification Act governs notice of a breach involving personal identifying information — which the reports described above are designed not to contain.
Other states. Where a state has a comprehensive privacy law, the same practices and the same choices apply.
13. Changes to this Notice
We may change these Terms and the Privacy Notice at any time. The Software shows each change; it takes effect when you accept it or continue using the Software after it is shown. A change never applies to a dispute that arose before it took effect. Your ledger, Statements and exports never wait for a change, and the Software records the date and a hash of each revision you accept. The current Notice is always in Settings → Privacy Notice, and at ledgepod.app/privacy.
14. Contact
Ledgepod LLC · support@ledgepod.app · or through the Software: Report a problem in the Software. E-mail is the way to reach us about this Notice; we deal with people online and do not publish a mailing address.