Privacy
Most privacy policies describe what a company promises not to do. This one mostly describes what the software cannot do, which is a stronger guarantee — and every claim names the code that makes it true.
The short version
On the free plan, Ledgeur does not have your data. Not encrypted, not anonymised — it never reaches us. Your audio is transcribed by models running inside your browser, and the result is stored in your browser. There is no account, so there is nothing to associate it with.
On the paid plan you choose to sync meetings to a database so they reach your other devices and your workspace. That is a deliberate act, per meeting, and it is the only thing that changes.
What is true, and why
Audio is never uploaded.
Transcription and speaker separation run as WebAssembly and WebGPU inside your browser (packages/asr). There is no upload endpoint for audio in this product — not a disabled one, not an optional one.
Your library lives on your device.
Meetings are stored in your browser's IndexedDB (packages/core/src/browser/library.ts). On the free plan they are never sent anywhere.
Voice prints never leave the device that heard the voice.
They are stored separately from meetings and are excluded from sync. A voice print identifies a person even after the transcript is deleted, so it is treated as the most sensitive thing the product holds.
On the paid plan, only what you choose to sync is synced.
Synced meetings are rows in a Postgres database behind row-level security (supabase/migrations/0002_rls.sql). Policies are written so a query returns your rows, or rows shared into your workspace, and nothing else.
An agent reading your meetings reads them as you.
An access token resolves to a short-lived session for its owner, so the same row-level security applies (packages/mcp/src/auth.ts). The endpoint holds no standing privileges of its own.
We do not train anything on your meetings.
There is no training pipeline in this product. The speech, speaker and summarisation models are pre-trained and read-only; the summariser on the free plan is a deterministic function over your transcript, not a model call.
All of this is checkable: the source is public, and you can watch your browser’s network tab while you record.
What we collect
- Your email address — Only if you create an account. To sign you in, and to email you about your subscription. Not used for marketing.
- Your meetings, transcripts and notes — Only on a paid plan, and only meetings you sync. So they are available on your other devices and to your workspace.
- Payment details — Only if you subscribe. Handled entirely by Stripe. We never see or store a card number.
- A hash of each access token — Only if you generate one. To check a presented token and to let you revoke it. The token itself is never stored.
That is the complete list. There is no analytics script on this site, no advertising pixel, no session recorder and no third-party tag manager.
Who else is involved
Three companies process data on our behalf, and only on the paid plan:
- Supabase — the database and authentication behind sync.
- Stripe — payments. Card details go directly to Stripe and never touch our servers.
- Vercel — hosting for this website and the agent endpoint.
One more is involved even on the free plan, and it matters that you know: the first time you record, your browser downloads the speech and speaker models from Hugging Face’s CDN. That request tells Hugging Face your IP address and which model you asked for. It contains none of your audio, and it happens once — after that the models are cached and Ledgeur works offline.
How long things are kept
Local meetings are kept until you delete them or clear your browser storage — we cannot delete them for you, because we cannot see them. Synced meetings are kept until you delete them or close your account, after which they are removed within 30 days.
Your rights
If you are in the UK or the EU, you have the right to access, correct, export and erase personal data we hold, and to object to processing. In practice, for Ledgeur, this is usually simpler than the law expects: on the free plan we hold nothing, and on the paid plan every meeting can be exported from the app and deleted from it.
To make a request, or to complain about how we have handled one, . You may also complain to your local supervisory authority — in the UK, the Information Commissioner’s Office.
Children
Ledgeur is not intended for people under 16, and we do not knowingly hold their data.
Recording other people
This is your responsibility, not ours, and it is worth stating plainly. In many places it is unlawful to record a conversation without the consent of the people in it, and the rules differ by country and by state. Ledgeur does not announce itself in a meeting — deliberately, because a bot in the participant list is exactly what people dislike about the alternatives — which means telling people they are being recorded is on you. Please do.
Changes
If this notice changes materially we will say so on the changelog. The date at the top is when it was last reviewed.