Last updated 17 September 2026

Privacy and data handling

Private access

The financial dashboard is restricted to authorised accounts. Profile names are not used to infer portfolio ownership.

Google and Gmail data

The Family Ledger requests read-only Gmail access solely to locate financial statements requested by the user. It cannot send, edit, move or delete email. Unrelated messages are not intentionally retained. Google data is not sold, used for advertising or used to train a general-purpose AI model.

Tokens and disconnection

Google refresh tokens are encrypted at rest. Disconnecting an account requests token revocation and deletes its stored connection and indexed document metadata.

Documents and passwords

Accepted files are stored privately. Statement passwords are encrypted using AES-GCM and used only to open matching document families. The service must never receive banking login passwords, OTPs, PINs, CVVs or transaction credentials.

Deletion

The dashboard provides permanent deletion of connected-account tokens, indexed email metadata, uploaded files, extracted portfolio records and saved statement passwords.

Read-only constitution

The Family Ledger cannot place trades, transfer funds, pledge securities or use derivatives, leverage or margin.