Privacy policy

TokenLedger Ltd (“TokenLedger”, “we”) operates tokenledger.app. This policy says what we collect, why, where it lives, and how to take it away. It is written to be read.

The one-line version

TokenLedger has read-only access to usage metadata. No prompt or content data is ever collected — the keys you connect are not capable of exposing it.

What we collect

• Account data: email address, optional name, sign-in method (magic link or GitHub). No passwords exist.
• Usage metadata from providers: dates, model names, token counts, costs, API key identifiers and project identifiers — the numbers on your bill, never the content behind them.
• Revenue metadata from Stripe (Company mode, optional): customer names, emails, subscription amounts and statuses, read with a restricted key you create.
• Product analytics: feature events tied to your workspace (for example “autopsy generated”), plus optional cookieless page analytics via Plausible. No advertising trackers, no cookies requiring a banner.

What we never collect

• Prompts, completions, files, embeddings or any model input/output.
• Provider billing credentials or card details (provider keys are usage-scope only).
• Your customers' payment details (Stripe restricted keys cannot read them).

How keys are protected

Provider keys and webhook URLs are encrypted at rest with AES-256-GCM under a key held only in the server environment, decrypted server-side at sync time, displayed masked, and stripped from logs by a redaction layer. Deleting a connection destroys its key immediately.

Legal bases

Contract (running the service you signed up for), legitimate interest (security, abuse prevention, product analytics), and consent where required (marketing emails — each has a one-click unsubscribe).

Subprocessors

• Vercel — hosting
• Neon — PostgreSQL database
• Stripe — payments and billing
• Resend — transactional email
• Plausible — cookieless analytics (optional)

Retention and deletion

Data lives as long as your workspace does. Deleting a workspace (Settings → Data, typed confirmation) hard-deletes every row and key within 24 hours, confirmed by email. The full CSV export is available on every plan, any time.

Your rights

Access, rectification, erasure, portability, restriction, objection — the UK GDPR set. Most are self-serve (export, delete); for the rest, email privacy@tokenledger.app. You may also complain to the ICO.

Governing law

This policy and any dispute under it are governed by the laws of England and Wales, and TokenLedger Ltd is the data controller.

Changes

Material changes are announced by email and in the changelog before they take effect. The date at the top is the date that counts.