Privacy policy

Last updated October 26, 2026

Who this covers

Ledger is a personal dashboard written by and for Michael Kelley (the "owner"). It runs only on the owner's Mac. It is not offered to the public, and it has no other users. This policy describes exactly what Ledger does with data, including data it receives from Google.

Google data Ledger accesses

With the owner's permission, Ledger requests two read-only Google permissions:

• Gmail, read-only (gmail.readonly): to show the owner's recent messages in Ledger's inbox and reading pane.
• Google Calendar, read-only (calendar.readonly): to list the owner's calendars and show their events in Ledger's agenda and calendar views.

Read-only means Ledger cannot send, delete, archive, or change email, and cannot create, change, or delete calendar events.

How the data is used

Google data is used only to display the owner's own email and calendar to the owner, on the owner's Mac. If the owner turns an email into a to-do item, that item is saved locally on the same Mac.

Where the data is kept

• Ledger stores copies of recent messages and events in a local database on the owner's Mac (in ~/Library/Application Support/Ledger), protected by the Mac's FileVault disk encryption. The copies are refreshed as Ledger syncs.
• The Google sign-in token is stored in the macOS Keychain, never in the database or in any file.
• Ledger only accepts connections from the same Mac; it cannot be reached from the network or the internet.

Sharing

• Ledger does not send Google data to any server or third party. There is no Ledger server. Data travels only between Google and the owner's Mac, over encrypted connections.
• Google data is never sold, shared, or transferred to anyone, and is never used for advertising.
• Google data is not used to develop, improve, or train artificial intelligence or machine learning models.
• No person other than the owner reads it.

Ledger also fetches weather for a town the owner chooses and headlines from news feeds the owner adds, and can connect to the owner's other accounts. None of those requests include Google data.

Google API Services User Data Policy

Ledger's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access and deleting data

• The owner can revoke Ledger's access to Google at any time from the Google Account permissions page: myaccount.google.com/permissions. After that, Ledger can no longer read Gmail or Calendar.
• Deleting Ledger's data folder (~/Library/Application Support/Ledger) removes every local copy.

Changes

If Ledger's handling of data changes, this page will be updated and the date above will change.

Contact

Questions about this policy: michaelkelley5765@gmail.com