trip ledger

Privacy

Effective 2026-10-25. A change to what this server collects or shares is announced with an in-app notice and a new disclosure version.

What this server stores

Your account stores your name, your email address in lowercase, and the time the account was created when that time was recorded. An account copied from an older ledger can have no created time. A password is stored only as a salted scrypt hash. If you sign in only through a sign-in provider, the password fields stay empty.

The ledger_session cookie holds a random value. The server stores a SHA-256 hash of it, not the cookie itself. The cookie is HttpOnly, SameSite=Strict, Path=/, and lasts 30 days. It is marked Secure when this server's public address is https. While a sign-in provider finishes a sign-in, a short-lived HttpOnly cookie named ledger_oidc is set, SameSite=Lax, only on the callback path.

Preference cookies, all HttpOnly and SameSite=Strict, last one year: ledger_theme (light or dark), ledger_palette, and ledger_density. ledger_flash lasts about a minute and stores a status code, not the sentence you see. ledger_link lasts about a minute and holds an invitation token so the owner can copy the link.

A trip stores its name, its members and their roles, invitations (the invited email, the role, and the expiry; the token is stored only as a hash), travelers and households, legs and leg notes, expenses (description, amount, booking reference, notes, location, and a receipt link), repayments, and receipt names together with the receipt file bytes.

When someone connects an AI app, the server stores the app's name, its redirect addresses, a read grant (trips:read), token hashes, and the disclosure version shown at approval. A grant made before versions were recorded stays valid at version 0.

Sign-in attempts are counted in memory, by email and by client address, for about 10 minutes, and then discarded. That is not a record of pages you open. The server can write an error line to its own log.

Who else receives it

An AI provider receives data only when a member connects an app, and only what that trip's AI access level allows. Email addresses, passwords, and receipt files are never sent. Other travelers' entries are included in what the level allows. The provider keeps what it receives under its own policy and may keep it or train on it. Revoking the connection stops future requests and cannot recall data already sent.

A sign-in provider receives the sign-in only when one is configured, for example Google. Trip data is not sent to that provider. If none is configured, sign-in stays on this server.

This server does not send email. An invitation is a link the owner copies.

Reviewing and removing data

The owner can download a JSON backup, including receipt files. Owners and editors can download Excel, including notes and booking references. Viewers can read the trip and receipts in the app but cannot download either export. Owners and editors can change or delete trip records. Only the owner can restore a backup, clear the trip, or undo the last restore or reset. Before replacing the trip, the server saves a backup including receipts and keeps the newest five. The owner can remove someone else's access. A member who is not the owner can leave the trip. The trip's data stays. On the account page you can revoke a connected app. That stops future requests and cannot recall data already sent. There is no control here to delete an account.

How changes are announced

A material change to the AI disclosure gets a new version. Raising a trip's AI access uses the current version. An in-app notice tells members when sharing lowers the level, and when the owner raises it after a member lowered it. Notices are shown in the app. They are not emailed.

Use https for a public server. This server allows http only for localhost. Don't put card numbers, bank account numbers, or ID numbers in notes or booking references. Nothing here scans or removes them.

Home

Privacy