Privacy Policy

1. Overview

Ledge ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. By using Ledge, you agree to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

• Account information: Name, email address, and hashed password when you register with email/password, or your Google profile data when you sign in via Google OAuth.
• Usage data: Actions taken within the app (check-ins, check-outs, inventory updates), timestamps, and associated job site or crew information you enter.
• Device and technical data: IP address, browser type, operating system, and session identifiers used for security and authentication.
• Communications: Messages you send to our support team.

We do not collect payment card details directly — payments are handled by our third-party payment processor.

3. How We Use Your Information

We use your data to:

• Provide, operate, and improve the Ledge Service
• Authenticate your identity and protect your account
• Send transactional emails (password resets, billing receipts)
• Respond to support requests
• Analyze aggregate usage patterns to improve the product
• Comply with legal obligations

We do not sell or rent your personal data to third parties.

4. Data Storage and Security

Your data is stored in secure, encrypted databases hosted on infrastructure compliant with SOC 2 standards. We use industry-standard TLS encryption for all data in transit. Access to production data is restricted to authorized personnel only and is protected by multi-factor authentication.

5. Cookies and Tracking

We use session cookies to maintain your logged-in state. We do not use third-party advertising cookies. If you sign in via "remember me", a persistent authentication token is stored in a secure, HTTP-only cookie.

6. Third-Party Services

We use the following third-party services, each governed by their own privacy policies:

• Google OAuth — optional social sign-in
• Vercel — application hosting and edge delivery
• Cloudflare — DDoS protection and CDN

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal or accounting obligations.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing of your data
• Data portability — receive a copy of your data in a structured format

To exercise any of these rights, contact us at privacy@ledge.app. We will respond within 30 days.

9. Children's Privacy

Ledge is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or via an in-app notice. Continued use of the Service after changes constitutes your acceptance of the revised policy.

11. Contact

Questions or concerns about this policy? Reach out to us at privacy@ledge.app.