Privacy Policy

Quick summary

• What Ledger collects: your email address, a password if you set one, a display name, your poll answers, your emoji reactions, a record of which version of the Terms and this policy you accepted, and, if you set one up, an authenticator app. If you choose to answer them, four optional profile questions: gender, an age range, a 5-digit ZIP, and a political leaning. See the full table in §2.
• What Ledger never collects: your street address, congressional district, coordinates, device location, date of birth, voter-registration details, government IDs, payment details, or anything from third-party trackers (Ledger loads none). A ZIP is collected only if you enter one.
• Your answers stay private. Nobody else sees your individual answer or reaction. Public results are aggregates: a poll's results show only once it has at least 10 responses, and each emoji's count only once at least 10 people have chosen it.
• No personal data goes to an AI model. Ledger uses AI only inside its own review and publishing process: helping founders draft proposed polls, grading proposed polls, screening stock photographs before a person vets them, and choosing which already-vetted library photograph accompanies a poll.
• How long Ledger keeps it: while your account exists. To delete your account, email the support address on the contact page.
• No analytics product, no marketing email, no tracking pixels, no data sold.

1. About Ledger and what this covers

This Privacy Policy explains how Ledger, Inc. (placeholder — entity formation pending) handles personal information for the Ledger service at ledger.vote: a public board of public-policy polls that anyone can read and signed-in users can answer. The Ledger iOS app is covered by its own policies, linked above.

Ledger is designed for US residents. Ledger treats the California Consumer Privacy Act (CCPA) as its national floor — the rights described below apply to every Ledger user, not just California residents.

2. What Ledger collects

Tables that hold no information about you. Ledger's other tables hold the polls themselves (polls) and each race poll's candidates (poll_options), the review pipeline's records (poll_generation_runs), each poll's last published results (poll_public_state, poll_reaction_public_state), time-series of each poll's aggregate counts (poll_trend_snapshots, poll_trend_hourly), the stock-photograph library (poll_stock_photos), social-post records (poll_social_posts), and Ledger's staff records: who can use the review tools (admin_users) and a record of certain actions staff take in them (admin_actions). None of them records a user's answer or reaction. The staff records name Ledger's own founders, not you. The record of staff actions keeps the staff account's identifier even after that account is deleted.

3. What Ledger never collects and never does

• Ledger does not collect a street address, congressional district, coordinates, or device location. An optional 5-digit ZIP is collected only if you enter one, and Ledger stores it as entered without resolving a state or district.
• Ledger does not collect voter-file data, government IDs, biometric data, health data, or payment details.
• Ledger does not load third-party tracking pixels from advocacy organizations, campaigns, ad networks, or analytics vendors. No Google Analytics, no Meta Pixel, no Segment, no Mixpanel, no Hotjar, no FullStory.
• Ledger does not send your personal information to an AI model (§6).
• Ledger does not share individual-level user data with third parties. Not for analytics, not for research, not for any product.
• Ledger does not sell personal information.

4. How Ledger uses your data

• Run your account. Your email and sign-in method let you sign in. A display name is stored with the account. Optional profile answers, if you give them, stay on the account.
• Count results. Your answers and reactions are counted into each poll's public aggregates (§7).
• Show you your own activity. The board shows you which answer and reaction you chose.
• Record consent. Your acceptances show which version of the Terms and this policy you agreed to.
• Keep the service running. Rate-limit counters, authentication cookies, server logs, and error reports exist so Ledger stays available and fair.
• Send sign-in codes. See §11.

What Ledger does not use your data for: no advertising, no model training, and no data sales. Optional profile answers are not used to choose which polls or sources an account sees, and they are not an advertising profile.

5. Sub-processors

Ledger relies on a small set of US-based service providers ("sub-processors") to run the product. Each processes data only on Ledger's instructions and for the purposes below.

Ledger updates this list when it adds or removes a vendor. Material changes follow the process in §18.

6. AI use

Ledger uses AI models (Anthropic's Claude, and OpenAI's models for drafting) in four places, all inside Ledger's own review and publishing process:

• Drafting proposed polls. A founder may use an AI writing assistant to find a vetted source and draft a poll's question and summary. The assistant sees public news pages and the founder's instructions, never user data. A founder edits every draft, and every draft is checked (by the model check, or against the certified list for race polls) before a founder can publish it.
• Checking proposed polls. Before a poll can be published, a model checks the draft against Ledger's editorial rules and gives the reviewing founder a recommendation. A poll about a race, whose options are the candidates on the state's certified list, is instead checked against that list, and no model is involved. A Ledger founder decides; the model never publishes.
• Screening stock photographs. When Ledger adds a photograph to its library, a model gives an advisory check and a one-line description. A person vets every photograph before it can be used.
• Choosing a poll's photograph. When a proposed poll reaches founder review, a model chooses which photograph from Ledger's library accompanies it. The model sees the poll's text and the photographs' one-line descriptions, and a person has already approved every photograph it can choose from.

A news-drafting feature is switched off. Ledger's code contains a feature that drafts candidate poll questions from news feeds with an AI model. It is switched off in production. If Ledger turns it on, a new version of the AI Policy will say so first, and every drafted poll still passes the check above and a founder's publish decision.

Ledger has no AI assistant, chat, or explain feature. Nothing you enter on Ledger — your email, name, answers, or reactions — is sent to an AI model. For grading and photographs, Anthropic receives only poll text, photographs, and photograph descriptions; a drafting assistant, Anthropic's or OpenAI's, receives only public news pages and a founder's instructions. Ledger's editorial rules for its AI use are in the AI Policy.

7. Poll data

Poll answers and reactions are political-opinion data, and Ledger handles them accordingly.

• An answer row holds the poll, your account, your answer, and when you answered and last changed it. Nothing else about you is recorded with it — no location and no demographic group. Optional profile answers live on the account, in profile_answers, and are not copied onto an answer row. Political leaning on that row is political-opinion data, stored separately from poll answers.
• Your individual answer and reaction are never shown to anyone else and never shared outside Ledger.
• Results are public aggregates. Every visitor, signed in or not, sees each poll's aggregate results: the split between the answers (for a race poll, each candidate's share), the number of responses, charts of the split over time, and reaction counts.
• Ledger's founders answer polls like anyone else, and each answer counts once.
• A minimum-response floor protects small counts. A poll's split, chart, and movement are not shown until it has at least 10 responses. Below that, the number of responses is not shown either; the board says only that there are fewer than 10. From 10 to 99 responses the number shown is rounded down to a multiple of 5, and from 100 responses on it is exact. Each emoji's count is shown only once at least 10 people have chosen it, and the reaction total counts only those emoji, so a small group cannot be worked out by subtraction.
• Closed polls keep their last published result on the board. Results are published in steps: once at least 10 responses have been added, changed, or removed since the last publish, the next scheduled update (every 10 minutes) publishes them. The last published result can therefore lag the final count by fewer than 10 responses.
• Account deletion removes your answers and reactions. They drop out of a poll's results the next time that poll's results are published. A result already published for a closed poll is not recalculated.

8. Social posts

Ledger mirrors published policy polls to its own accounts on X, Instagram, and Facebook, and may post a poll's aggregate results there. Race polls are not posted. A Ledger founder approves every post. A results post is made only once a poll has at least 50 responses, and it shows whole-poll aggregates only. Social posts never contain individual answers, reactions, or anything that identifies a user.

9. How long Ledger keeps your data

Deleting your account. Email the support address on the contact page from the address on your account. Deleting your account removes your authentication record (including its sign-in sessions and audit-log entries), your profile, your optional profile answers, your acceptances, your poll answers, and your reactions. Aggregate counts already recorded in a poll's history are not rewritten, because they hold no individual answer. A staff account's identifier stays in the record of staff actions (§2).

Certain records may be retained briefly after deletion for legal or fraud-prevention reasons, or preserved under a specific legal hold.

10. Your rights (CCPA, applied nationally)

Ledger extends the rights California residents have under the California Consumer Privacy Act to every Ledger user, regardless of state. You have the right to:

• Know what personal information Ledger holds about you.
• Get a copy of it.
• Delete it, with the scope described in §9.
• Non-discrimination. Exercising these rights does not change the service Ledger provides to you.

How to exercise them. Email the support address on the contact page from the address on your account. Ledger responds within 45 days (extendable once by 45 days for a complex request — Ledger will tell you if that happens).

Sale of personal information. Ledger does not sell personal information, so there is no sale to opt out of.

11. Email

Ledger sends no marketing, newsletters, reminders, or notifications. The only email is the 6-digit code Ledger's authentication provider sends to confirm your email address at signup and to sign you in without a password. Ledger does not send password-reset email; the email sign-in code is the way back into your account.

If Ledger ever adds another kind of email, that is a material change to this policy under §18.

12. Cookies and browser storage

• Authentication cookies. First-party cookies on ledger.vote, set by Supabase's sign-in library, keep you signed in. Ledger's own page scripts can read them; no other site can.
• Acceptance cache. A signed, HTTP-only first-party cookie records that your account has accepted the current Terms and Privacy Policy, so Ledger does not have to look it up on every page.
• Sign-up cookie. While you finish signing up, a signed, HTTP-only, first-party cookie on the /signup path carries your email address and pending account id. It lasts up to one hour and is removed when sign-up completes.
• Google sign-in marker. When you start a Google sign-in, a short-lived marker is kept in your browser's session storage for that tab and removed when the sign-in completes.
• No third-party cookies and no fingerprinting. Ledger does not set cookies for ad networks, analytics vendors, or any other third party.

Because every cookie Ledger sets is necessary to run the service, there is no cookie-consent banner.

13. Analytics and error reporting

Ledger runs no analytics product. There is no analytics script and no behavioral event store. Ledger does not record which pages you viewed or how long you stayed.

What exists instead. Vercel, Ledger's hosting provider, keeps ordinary server logs and runtime metrics so the service can stay up and be debugged. They are not assembled into user profiles and not shared.

Error reporting. Ledger uses Sentry to learn when its code fails, and only from its servers — Sentry does not run in your browser. Before an error leaves Ledger's servers it is scrubbed: no user account information, no request bodies, no query strings, no cookies, no authorization headers. Performance tracing and session replay are off. Because error reports carry no account identifier, they cannot be looked up and removed per person.

14. Security

• Row-level security on every table. Your answers, reactions, profile, optional profile answers, and acceptances can be read only by your own account.
• Writes go through checked paths. Answers and reactions are recorded through database functions that accept them only while a poll is open. Optional profile answers are written by your account to its own row, and only the listed choices are accepted.
• Server-only secrets stay server-only. Keys that can bypass row-level security never ship to the browser.
• Encryption in transit. Every request to ledger.vote and every connection to Ledger's sub-processors is TLS-encrypted.

15. Children

Ledger is not directed at children under 18 and does not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created a Ledger account, contact Ledger through the contact page and Ledger will delete the account.

16. International

Ledger is designed for US residents, and its servers and sub-processors are in the United States. If you are outside the US and want Ledger to delete any record it may hold, contact Ledger through the contact page.

17. Breach disclosure

If Ledger suffers a security incident that affects your personal information, Ledger will notify you at your account email address, typically within 72 hours of confirming the incident, publish a note describing what happened and what Ledger is doing about it, and comply with applicable state disclosure law.

18. Changes to this Privacy Policy

When Ledger makes a material change — anything beyond a typo fix, a clarifying sentence, or a stylistic edit — Ledger will publish the new version at /legal/privacy, list it with a summary at /legal, and ask you to accept it the next time you sign in after it takes effect.

Ledger publishes only the current version. The version history is summarized at /legal, and the full text of any earlier version is available on request to the support address on the contact page.

19. Contact

Privacy questions, access and deletion requests, and complaints can reach Ledger through the contact page.

20. Effective date and version

• Version: v6.0.0
• Effective date: October 7, 2026
• Prior versions: v5.0.0, v4.0.0, v3.1.0, v3.0.0, v2.0.0, v1.0.0.

What changed in v6.0.0. The profile page can record four optional answers: gender, an age range, a 5-digit ZIP, and a political leaning. Every question can be left blank, changed, or cleared. Ledger stores a ZIP as entered and does not resolve a state or district from it. Declining the ZIP stores no digits. Those answers stay on the account. They are not recorded on a poll answer, not shown next to a vote, and not used to choose which polls or sources an account sees. The display name is set at sign-up and is not edited on the profile page. Deleting the account removes the optional answers. This is a material change under §18, so Ledger asks you to accept it the next time you sign in.