The apps

We run no server for your data. Your day pages, notes, ink, tasks, contacts, mail, books and feed subscriptions live on your device. If you turn on sync, they go as plain files to a place you choose and control: your own WebDAV server or your own Google Drive. If you connect Google Calendar or a CalDAV task list, the events or tasks you make in Ledgable go there; with a WebDAV server and no task list chosen, tasks go to that server’s CalDAV address with the same login. If you allow Calendar, Reminders or Contacts, Ledgable reads them and writes the changes you make, and Apple or Google then syncs them the way your device is set up. We never see any of it.

Accounts you add talk only to their own service. A mail account talks to your mail provider. A feed account talks to your feed server, and the articles, pictures and episodes it lists come from their publishers: once a feed server is set up, the app (and your Apple Watch) fetches the newest of them in the background so they’re ready offline. Feeds you add without a feed server are read from their own sites. A WordPress site talks to your site, including its community, boards and support desk if you use them. If you connect the app to an account on this site, ledgable.cc, it talks to us the same way it talks to any site you add. When a site you added has its own search, Ask and the writing helpers also send it your question to find related pages on that site, and only once you’ve allowed your AI provider. Finding pages by a topic you choose sends that topic to your sites’ search; on Android, with an OpenAI key you’ve allowed, the topic and your sites’ page titles are also matched by meaning through OpenAI. Book catalogs, Audiobookshelf, a CalDAV server and comic trackers talk to the servers you give them; on Android, comic search also uses Comic Vine and Metron, with your own key or login. Webhooks you add (for a star, a panel, a page region or an exported picture) get what you send them. Passwords and keys are kept on the device in the system’s secure storage and are sent only to the service they belong to. If you turn on a watch feature that needs one, such as asking from the watch without your phone, that key is also kept on your Apple Watch, and your feed server’s login goes to the watch so it can fetch your feeds without the phone. If you export a settings backup, your keys and passwords go into it sealed; keep that file somewhere safe.

AI uses your own key, and only after you allow it. Ledgable works with Anthropic (Claude) and OpenAI. Nothing goes to either until you add your own key and say yes to that company on the permission screen. You can stop it any time in Settings › AI permissions, and your choice stays on that device (and on its paired Apple Watch, which follows it).

• With Anthropic as your chosen provider, Ask my Ledger, Synthesize, Brainstorm, the reader’s Outline and Writing prompts, Educate me, tag suggestions and the other writing helpers send Anthropic what that helper needs: your question, and the notes, pages, tasks, events, contact cards, mail lines or passages it looks at. When a helper reads the handwriting or a picture on a page, that page image goes too.
• With an OpenAI key, the same helpers, page images included, use OpenAI while it’s your chosen provider. An OpenAI key also powers search by meaning (in Ask, over the words of your notes, tasks, saved mail lines and feed excerpts; and on Android also when finding pages on your sites, and in Quick Wins and Missed connections), the words of your recordings and voice notes, Generate image, and reading aloud in the OpenAI voice.
• It all goes straight from your device to that company, under their terms and privacy policy (anthropic.com/legal/privacy, openai.com/policies/privacy-policy), which say how long they keep requests. Nothing goes to us.

A few public services, each for one job:

• Weather, only if you turn it on: your network address goes to ipwho.is (or ipapi.co on Android) to find your rough location, and that rough location goes to Open-Meteo for the forecast.
• Podcasts: searching and browsing shows uses Apple’s podcast directory (itunes.apple.com), and when a show’s own feed has no cover, Ledgable looks one up there by the show’s name.
• The Net, the built-in browser: DuckDuckGo Lite is its start page and search. The pages you open are fetched from their own sites. Articles and books you read in the app load their pictures from the sites they name. A link you save to Later or share into Ledgable is fetched from its site, with its picture and a readable copy (for a Reddit link, also the post’s feed). When Educate me’s answer names a link, that link is filed into Later and fetched the same way. When Educate me finds no link, it offers a DuckDuckGo search for the word, opened when you tap it.
• Free books: the Project Gutenberg and unglue.it catalogs, when you open them.
• YouTube: a video in an article shows YouTube’s picture of it, and playing it loads YouTube’s player; adding a YouTube channel as a feed looks up its page there.
• Google sign-in, only if you choose Google Drive or Google Calendar: Google learns which account you signed in with, under Google’s privacy policy.
• Asking by voice on iPhone uses Apple’s speech recognition, on the device when it can, otherwise through Apple. On Android, without an OpenAI key, dictation uses your device’s own speech service.
• Handwriting, printed text and comic speech balloons on Android are read on the device with Google’s ML Kit. ML Kit downloads its language model from Google and sends Google anonymous statistics about how its features run; what it reads stays on the device.
• GitHub (Android): About’s source, licence and upstream links open there when you tap them.
• Ratings on Android: Google Play may ask you, now and then, to rate the app.

Google data. If you connect Google Drive or Google Calendar, Ledgable asks Google only for what those need (on Android one Google sign-in serves both, so connecting either asks for both): access to the files it makes in your Drive (on Android also its own hidden folder there, used only when Drive is your sync folder), and your calendar’s events, so it can add, change and delete the events you make in Ledgable. Those files and events go straight between your device and Google; nothing reaches us. If you allow an AI provider, the pages and notes a helper looks at can include ones that came through your Drive, as described above. Ledgable’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnect in Settings, or remove Ledgable’s access at myaccount.google.com/permissions.

Your watch and glasses. Your Apple Watch talks to the same services you connected, directly, when your phone isn’t near. The MemoMind glasses add-on reads what’s playing from your own sync folder, and it can also use a short private line inside your phone that never leaves it.

No analytics, no advertising, no tracking. The apps contain no analytics library and no advertising library, and they never track you across apps or sites.

Reports. If you report a post, a message or an AI answer, the report comes to us: by email from your own mail account or, when there’s no mail account the app can use, through the form on our Write to us page, which the app opens already filled in. A report carries what you reported, the reason, your note and the app version (on iPhone and iPad also the device model and system version), plus your email address if you send it by email or choose to give it on the form. The app also copies the report to your clipboard in case the form opens empty; on iPhone and iPad that copy stays on the device and clears itself after an hour. We read every report within a day and pass on what’s needed to the people who run that community. We keep a report only as long as we need to deal with it.

Purchases. Ledgable is free to try for two weeks; after that, a one-time unlock (no subscription) keeps writing open — reading and exporting what you made stay free forever. When you buy the unlock, Apple or Google handles the payment, and we never see your card. The app keeps only whether it’s unlocked and when your free trial began, on your device.

Nothing is passed on. We share, sell and rent your data to no one. What leaves your device goes straight to a service you chose, for the job you asked for, under that service’s own privacy policy (linked above where it matters). We build in only services whose policies protect your data at least as well as this page does, and we’ll take one out if it stops.

Stopping and deleting. Stop AI sending in Settings › AI permissions. Remove an account or a key in Settings, and the app forgets it. Deleting the app deletes everything it kept on that device; your sync folder, calendars and sites are yours to delete where they live. For anything this website holds, see below.

Crash reports and backups. Crash and diagnostic notes stay on your device unless you choose to copy or share them. If you opted in to sharing crash data with Apple or Google, they may pass an anonymous crash log to us. Your device’s own backups (iCloud, Google) may include Ledgable’s files, the way your device is set up.

Permissions, and what each is for.

• Calendar: to show your events on the day’s schedule, and to add the events you make.
• Reminders: to turn handwritten tasks into Reminders.
• Contacts: to fill your rolodex from your address book when you choose to import, and to save the changes you make to a card.
• Photos: to place a picture on a page, and to save a page image you export.
• Camera: photos and short videos for your pages.
• Microphone and speech recognition: voice notes, recordings, and asking by voice.
• Notifications: new-article alerts, asked for only once a feed server is set up.
• Local network: to reach servers on your own network, like a home audiobook or feed server.
• Journaling suggestions (iPhone): the places, workouts, songs, podcasts and photos you pick to add to a page.

Each can be refused, and the app keeps working without it.

This website

Reading it stores nothing about you beyond ordinary server logs (address, browser, page, time), kept by our host for security and deleted on their schedule.

A support ticket stores the name and email you give, the ticket text, and any screenshot you attach, so we can answer you. We keep it while the conversation is open and for a reasonable time afterwards to recognise a repeat problem. Ask and we delete it.

The Write to us form needs no account. What you send with it comes to us by email, with your address if you give one; our mail system keeps a log of the messages it sends, text included, for 14 days. The site keeps nothing else from the form, apart from a count per network address for an hour to stop floods.

An account on this site (made to open a ticket, join the community or connect the app) stores a username, an email address and a hashed password. If you log in, WordPress sets cookies to keep you logged in; they carry no personal data and expire on their own. You can delete the account yourself at any time on the Delete my account page (ledgable.cc/delete-account/).

Comments, if enabled, store what you typed, your name and email, and your address and browser string for spam detection.

We do not sell, share or rent any of this to anyone. No third-party analytics runs on this site.

Your rights, and who to ask

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted, at any time, including your account on this site. Write to michaeljoelhall@gmail.com, use the Write to us page, or open a ticket on the Support page. We answer within a few days.

Ledgable is made by Michael Joel Hall. This page was last revised on 1 November 2026.