Key Ledger privacy policy
Key Ledger is a key-custody app for shops. Without an account, it works on your device alone and nothing leaves it. With an account, it shares one ledger with the other members of your shop through servers we run for that purpose. This page says what is collected, who can see it, where it is kept, for how long, and how to delete it.
Without an account: nothing is collected
Key Ledger has no analytics, advertising or tracking code. Used on one device without signing in, the key sets, owners, workers and checkout history you enter are saved only on your iPhone or iPad, in the app's own storage, which iOS encrypts while the device is locked. Deleting the app deletes them. We receive nothing about you, your business or the people and properties in your ledger.
With an account: what is collected
- Your sign-in email address, to send you sign-in codes, and shown to the other members of your shop.
- Your name: the worker name you give when you create or join a shop.
- Your direct phone number, given when you create or join a shop so keys can be checked out to you.
- An account identifier, which records which member made each checkout, return and change.
- The shop's records: key sets, property addresses, property owners' names, phone numbers and email addresses, workers' names and phone numbers, job notes and the custody history that members enter.
- Invitations: the email address an owner invites, kept with the invitation and emailed once.
All of it is used to run the app and for nothing else. It is linked to your account, never used for advertising or tracking, and never sold or shared with anyone outside your shop except the service providers named below.
Who can see it
- Every member of a shop sees the whole shop: every key set, worker, checkout and return, every member's name and email address, and every worker's phone number, including the direct phone you gave.
- Owners also see the shop's activity log: who changed what and when, including undone checkouts, imports, invitations and exports. Owners can invite, remove and promote members.
- Exports: an owner can export the whole shop as a CSV file. Each export is recorded in the shop's activity log with who made it and when. Employees cannot export.
- Nobody outside the shop can see its records. We do not look at them except to fix a problem you report.
Where it is kept
Accounts and shop records are stored by Supabase on servers in the eastern United States (Northern Virginia), encrypted in transit and at rest. Sign-in codes and invitations are emailed through Resend. Supabase's sign-in logs hold email addresses and the times of sign-ins for a limited period, to protect accounts. This website, including invitation links, is served by Cloudflare.
On your device, the app keeps the last synced copy of the shop in its cache so the ledger can be read offline; that copy is removed when you sign out, leave the shop or are removed from it. Your sign-in session is encrypted with a key kept in the iOS keychain of that device.
How long it is kept
- Your account, until you delete it. A shop's records, for as long as the shop exists.
- A deleted shop, 30 days, so a mistaken deletion can be undone by writing to us; then it is erased with everything in it.
- The change feed that keeps phones in step, 30 days.
- Checkouts undone with Undo, 30 days after the undo.
- Invitations, 90 days after they are sent.
- The activity log, 24 months.
Deleting your account
In the app, open Settings, tap your account at the top, then Delete account. Deletion is immediate: your sign-in, your email address and your memberships are erased, and the shop's copy leaves your device. The shop keeps past checkouts with the name and phone it recorded at the time, so its history stays complete, and the activity log keeps its entries, without your email address, for their 24 months. The only owner of a shop that still has other members must make someone else an owner, or delete the shop, first. Leaving a shop without deleting your account keeps your sign-in and removes that shop's copy from your device.
Backups and imports
When you export a backup, the app creates a CSV file and hands it to the iOS share sheet. It goes only where you send it, for example Files on the device. Backup files are not encrypted by the app, so keep them somewhere you control. Importing or restoring reads only the file you pick. Moving this device's ledger into your shop sends its sets, workers and history to the shop once, when you choose to, and leaves the copy on the device as it was.
Reminders
If you allow notifications, the app schedules overdue reminders on the device itself: every overdue set for an owner, the sets checked out to you for an employee. A reminder shows the set's tag and the holder's name, never an address. Nothing about reminders is sent to a server.
Calls and email
Tapping Call or Email opens your phone or mail app with the number or address filled in. Key Ledger does not see or record the call or message.
Children
Key Ledger is a business tool and is not directed at children. It knowingly collects no personal information from anyone under 13.
Changes
If this policy changes, the new version will be posted here with a new effective date before the change takes effect in the app.
Contact
Questions about privacy, or a deletion request you cannot make in the app: keyledgerapp@gmail.com