questions, answered honestly

because typing them in by hand is the whole point, and we won't pretend that costs nothing. manual entry is a real cost — it takes a few seconds you wouldn't spend otherwise. here's the trade you're making for it: nothing of yours goes to a bank-data aggregator, ledgerpost works in places plaid and tink don't cover at all (a lot of the balkans, much of africa, asia, and latin america), there's no bank connection to silently break at 2am and leave your numbers stale, and you actually notice your own spending because you're the one writing it down. apple shortcuts and the api turn most entries into a two-second action anyway — tap a shortcut, type an amount, done.

for the first few entries, yes. once you've got a shortcut wired to your phone's automations (tap an nfc tag at checkout, or trigger one from your bank's own payment notification if it sends one), logging a transaction is about as fast as unlocking your phone. the api and shortcuts integration exist specifically so "manual" doesn't mean "tedious."

your account (email, a hashed password — never the password itself), your ledger content (wallets, categories, tags, transactions, including any notes you write), and a handful of security artifacts like hashed api keys and a hashed device fingerprint used only to notice an unfamiliar sign-in. the full breakdown, traced to the actual database tables, is on /privacy and /data.

no. we don't sell data, we don't run ad trackers, and we don't share your ledger content with anyone except the handful of companies that have to touch it to run the service at all — who hosts the servers, who sends transactional email. that list, and what each one actually receives, is on /privacy.

no, never. ledgerpost has no bank-linking feature of any kind. there's no bank login to hand over, because there's nowhere to hand it to.

on servers in germany. we don't have a live incident to report, obviously — but the honest answer on our actual breach-notification posture, our data-protection obligations, and where our security measures are described in detail all live on /privacy, not brushed aside here.

no. ledgerpost is a manual ledger — a place you write numbers down. it is not a bank, not a payment service, and not a regulated financial institution. it never holds your money, never moves your money, and never initiates a payment on your behalf. there is nothing for ledgerpost to lose, freeze, or mismanage, because it never has custody of anything. see /terms for the exact wording.

no. reports, totals, and forecasts are arithmetic performed on the numbers you typed in — not a recommendation, and not a substitute for someone who knows your actual financial situation.

two wallets, the trailing six months of history in the app, read-only api access, and full csv export — that last one isn't limited to paid tiers, see the export question below.

$2.99/month: unlimited wallets, full history (not just six months), read-write api access, and apple shortcuts / webhook automation. pro ($5.99/month) is coming soon on top of that.

billing doesn't exist yet — ledgerpost doesn't process any payments today, so there's nothing renewing and nothing to cancel. this answer will be replaced with the real mechanics (and a link to self-serve cancellation) the moment that ships, not before. the refund terms we intend to run once it does are already published at /refunds, ahead of time, on purpose.

nothing is ever deleted on downgrade. if you go over a lower tier's limit — an extra wallet, an extra api key — that specific item goes read-only instead of vanishing. archive one to get back under the limit, or upgrade again. the exact mechanics are in /terms.

yes, from a csv file — settings → import walks you through matching columns.

yes, and it's not a teaser. every entry you've ever written, as a csv, on the free tier, forever, at no cost. most apps make export a paid feature specifically so switching away from them is painful — we'd rather you stay because ledgerpost works for you, not because leaving is expensive.

for logging entries, yes — the public api and an apple shortcut can post transactions without you ever opening the app. you'll still want the app (or the api) to actually review your ledger.

settings → danger zone, confirm with your password, and it's immediate — wallets, transactions, categories, api keys, your activity log, everything. there's no waiting period, so export first if there's any chance you'll want a copy. the exact list of what's removed and the one narrow exception (a hash used only to avoid re-emailing a bounced address, which can't be traced back to you) is spelled out plainly at /deletion.

the web app today — works in any modern browser, desktop or mobile. an ios app is planned but not built yet. there's no android app planned right now. we'd rather say that plainly than let a roadmap slide imply something that isn't true yet.