Privacy Policy

1. About LedgeSync and this policy

LedgeSync is an independent, open-source desktop project maintained through the official LedgeSync repository. This policy describes the official application and ledgesync.com. Independently modified versions and third-party services may have different practices.

LedgeSync supports local file browsing, policy explanations and Google Drive authorization. Starting with version 0.1.0-alpha.4, desktop and native CLI builds also support explicitly approved folder uploads. Earlier alpha.3 downloads provide authorization and simulated previews only. Connecting an account does not start a transfer; uploads require selecting a destination, reviewing the folder preview and choosing Upload folder in the app or confirming its exact digest in the CLI.

2. Local files and settings

When you choose a local folder or configuration, the application processes file names, paths, metadata, contents and selected policy/configuration files on your computer to display decisions and compute content checksums. A local preview does not upload your files. After you approve an upload, included file contents, file and folder names, checksums and operation identifiers are sent directly from your computer to Google Drive in the selected account and destination. LedgeSync servers do not receive them.

Settings and preview files you choose to save remain where you save them. Their locations may be included in your own backups or synchronization tools. Do not put confidential data in a public support report.

3. Google account information and permissions

Connecting Google Drive is optional. LedgeSync opens Google’s authorization page in your system browser and receives the result through a temporary callback on your computer. Your Google password is entered on Google’s page; LedgeSync does not receive it.

Starting with version 0.1.0-alpha.7, the application requests https://www.googleapis.com/auth/drive, which Google describes as access to see, edit, create and delete all of your Google Drive files. Two-way sync needs it to see and download files that you add to a synced folder through the Drive website, your phone or other apps; earlier versions requested only per-file drive.file access. LedgeSync uses this access only for the folders you choose to sync or copy and for listing folders when you choose where a synced folder lives. It does not read, change or delete anything outside those folders. The connection retrieves your account display name, email address and an account identifier so you can recognize the account and the app can detect an account change. It also receives the authorization tokens and granted scope needed to maintain that connection. While a folder syncs, the app reads the names, identifiers, parents, type, size, checksums, modification times and version metadata of the items in that Drive folder, reads the Drive change list to notice new changes, downloads the content of files that are new or changed in Drive, uploads new and changed local files, and moves items to the Drive trash when you delete them on your computer.

Sync also writes on your computer, inside the folder you chose: it creates and replaces files and folders that are new or changed in Drive, and when an item is deleted in Drive it moves the local item to a hidden .ledgesync-trash folder inside that folder, where it stays for 30 days. When the same file changed on both sides, both versions are kept. If many files would be deleted at once, sync pauses until you confirm or restore them.

We use Google data only for the visible connection and file-management features you authorize. We do not sell it, use it for advertising, transfer it to data brokers, or use it to train generalized AI or machine-learning models. The app does not automatically send Google data to maintainers or support systems.

LedgeSync’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. New uses of Google data will require updated disclosures and consent where required before that use begins.

4. Storage, security, and retention

Refresh tokens and the saved account connection are stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service. Access tokens are kept in backend memory. Tokens are not included in the application’s frontend, project exports, or ordinary diagnostics. If the supported credential vault cannot be used, the application reports a failure instead of saving tokens in an unprotected file.

The saved connection remains on your computer until you disconnect it or remove its vault entry. Uninstalling the app may leave operating-system vault entries behind; disconnect first if you want to remove the local grant. Local files and exports remain under your control. We cannot remotely erase credentials or files stored only on your device.

Upload builds keep a private local SQLite transfer journal containing local paths, account references, destination and object identifiers, rule-source history, checksums, approved plans and transfer results. It contains no file-content copies, OAuth tokens or resumable upload-session URLs. Upload-session URLs exist only in backend memory. The journal remains until you remove the local application data; uninstalling or disconnecting may leave it behind. Removing the journal loses copy and recovery history and does not delete any Drive files. Completed and partially completed copies remain in Google Drive until you manage them there.

Starting with version 0.1.0-alpha.5, the app also keeps a private local catalog of saved sync pairs and run history: local folder paths, destination names and identifiers, selection policies, automatic-copy authorizations, counts, status messages and the relative paths of items that were not copied. It contains no file contents or tokens and stays on your computer. Optional automatic copies run only for sync pairs you explicitly authorize, while the desktop app or the CLI command you start is running. Restoring a copy downloads files that LedgeSync previously uploaded from your Google Drive into a new local folder you choose.

Connections to Google use HTTPS. These protections reduce risk but do not make a compromised computer or altered installer safe. No security method provides an absolute guarantee.

5. Disconnect, revoke, and delete

Use the disconnect action in the app’s Connections screen to remove the locally saved authorization. Disconnecting does not delete files in your Google Drive and is different from revoking the grant at Google.

You can cancel an active upload in the app. Files already created may remain in Drive, and a new preview is required to reconcile and continue. You can manage or delete those copies in Google Drive. You can revoke access through your Google Account connections. If your version offers “Revoke access on Google,” that action requires a separate confirmation. Google revocation can affect the account’s authorizations for other OAuth clients in the same Google Cloud project. Review the confirmation and the connection shown by Google before proceeding.

If the app reports that local credential removal failed, unlock the credential vault and retry. Do not assume that an uninstall or an unsuccessful disconnect erased the entry. A revoked or expired grant requires reconnection before further authorized use.

6. Website, downloads, and support

The website and download infrastructure process ordinary request data such as IP address, requested URL, time, browser information, and referrer to deliver content, investigate errors, and protect the service. Origin web logs use daily rotation with seven retained rotations; security investigations or legally required preservation may require longer retention. Infrastructure providers maintain their own records under their policies.

Cloudflare handles website delivery and security, and may use security cookies. The website uses Google Fonts, so your browser may request font resources from Google. GitHub hosts source code, release downloads, and project support. These services may process request data under their respective Cloudflare, Google, and GitHub privacy policies, including processing outside your country.

The official app has no advertising, usage analytics, or automatic crash-report uploads. The website does not add advertising trackers or an analytics product. If you choose to submit a support report, maintainers receive what you submit. Public GitHub issues are public and may remain in project history. Never include tokens, credentials, or private file contents; contact alex@alexandro.net before sharing sensitive details.

7. Privacy requests and updates

Depending on the law that applies to you, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, or to contact a privacy regulator. You can manage local data and Google grants using the controls described above. Contact the maintainers about data you provided to the project or website records; we may need enough information to locate the records and verify the request, and some records may need to be retained as required by law.

LedgeSync is not directed at children under 13. We do not knowingly solicit children’s personal information. Contact us if you believe such information has been submitted to the project.

Updates to this policy will appear on this page with a revised effective date. Material changes to how Google data is used will be disclosed before the new use begins.

8. Contact

For privacy questions or requests, email the LedgeSync maintainer at alex@alexandro.net. General support is also available through project support; do not post personal data in public issues. For a suspected security vulnerability, follow the security reporting instructions.