Privacy Policy for Summer Ledger

Last Updated: October 7, 2026

This Privacy Policy describes how Summer Ledger ("the Service", "we", "us", "our") collects, uses, and protects your information. Summer Ledger is a private journal for intimate and sexual-health information, so the data you enter is among the most sensitive there is. Your privacy is the cornerstone of our Service: your data is never sold and never shared without your permission.

1. Information We Collect

We collect information necessary to provide you with a secure and personal journaling experience.

A. Information You Provide Directly:

Account Information: When you sign up with email and password, you provide an email address and a password, and, if you set one, a Gallery Code for your private gallery. We never store your password or Gallery Code in a readable form.
Sign-In Provider Information: If you choose to sign in with Apple or Google, we receive and store a provider account identifier, and the email address and name that the provider shares with us. We use these only to create and authenticate your account. (Apple may provide a private relay email address if you choose to hide your email.)
Passkeys: If you register a passkey, we store its public credential and a name you choose; the private part never leaves your device. We never receive your device's biometric data. If you turn on app lock in the iOS app, Face ID or Touch ID is handled entirely by your device; we only store whether app lock is on.
Profile and Preferences: You may add a display name, your birthday, and your gender to your profile. Your birthday is used to calculate your age and to compare it with your partners' ages in Insights. We also store your settings, such as units, your activity list, and how the Ledger Companion should talk to you.
Companion Memory: If you have the Ledger Companion, you can write notes about yourself ("About you") and topics it should avoid. When you ask the Companion to remember something, it adds that to these notes; it can only add, never delete. You can view and edit them in Settings. How long your Companion chats are kept is up to you (see Section 5).
Journal Content: You may provide detailed information about partners and encounters, including names, ages or birthdays, notes, dates, times, locations (including geographic coordinates if you use the map feature), activities (which may include specifics such as whether protection, PrEP, DoxyPEP, or birth control was used), ratings, reflections, and contact details. This is your core data and is treated as highly sensitive.
Sexual-Health Records: You may record sexual-health information such as test dates, test types (for example a full panel or a specific test), results, and notes. This is sensitive health data and is treated with the same protection as the rest of your journal.
Media Files: You may upload photos and videos to your account profile and private galleries. These files are stored securely and linked to your account.
Audio Data: If you use the voice memo feature, your audio recordings are collected and sent for transcription. If you use the AI voice-call feature, your live microphone audio is streamed in real time to our AI provider for the duration of the call (see Section 2).
Support Requests: When you contact support (in the app, on the Support page or by email), we keep what you write, any screenshots you attach, your email address and, if you choose to include them, your plan, app version, device, time zone and the page you came from. We use these only to help you. Whoever on our team answers support can read them.

B. Information Collected Automatically:

Sign-Ins and Devices: Each time you sign in, we record a session: when it started and was last used, your browser or device type, and an approximate location (city, region and country) based on your network. We don't store your IP address. We use this to keep you signed in, to show you the devices signed in to your account so you can sign them out, and to help secure accounts.
Security: To protect accounts from password guessing and automated abuse, we keep short-lived records of failed attempts, in a form that doesn't reveal your IP address or email, and our sign-up and sign-in forms use Cloudflare Turnstile to check that you're a person. We don't use any of this for tracking or advertising.
Device Location: Only if you tap "use my location" on a map, your browser or device shares your current position with the app so it can place the pin. We don't collect your location in the background.
Device & Notification Data: If you enable notifications, we store a push subscription for your browser or device, its platform, and your notification preferences. We keep a log of notifications sent to you (title, message, and whether delivery succeeded).
Subscription & Purchase Data: If you purchase a paid plan, we store your plan, the provider used, a transaction identifier, and the expiration date, plus a record of subscription-related events (such as purchases, upgrades, renewals, and cancellations). Payment card details are handled by our payment processors and are never stored on our servers.
AI Usage Metering: We count your use of AI features (shown to you as "sparks", and monthly counts of summaries and voice notes) to apply your plan's fair-use limits. We store your device's time zone so these limits, and any test reminders you get, follow your local day.
Diagnostics: When something breaks, in the app or on our servers, we record the error so we can fix it: what failed, where in the app, and on which kind of device. Before it's stored, anything that could be your content (quoted text, emails, numbers) is removed, and it isn't linked to your account. We keep these for 30 days after the error last happens.
Site Analytics: Our website uses Cloudflare Web Analytics, which counts page views without cookies and without identifying you. It never receives your journal content.
Cookies and Local Storage: We use only essential cookies: one that keeps you signed in, a short-lived one that keeps your private gallery unlocked, one that recognizes browsers you've signed in from before, and one that remembers you're using our iOS app. The app also keeps a few display preferences on your device (such as your map style and messages you've dismissed). We don't use advertising or tracking cookies.

2. How We Use Your Information

Our primary use of your information is to operate the Service and provide you with its features. We never sell your data, never share it without your permission, and never use your content for advertising or to train AI models.

To Provide the Service: We use your journal content to display it back to you in your ledger, on your dashboard, on maps, and within your galleries. Insights (patterns, your type, ages, and trends), recaps and achievements are calculated within the Service from your own data; they are not sent to an AI provider (except a recap story you ask for, below).
To Secure Your Account: We use your email, credentials, registered passkeys, linked sign-in providers (Apple, Google) and sign-in sessions to authenticate you and secure your account. We also remember the browsers and devices you've signed in from, and the countries your account is used from (based on your network, not GPS), so we can alert you to sign-ins from somewhere new and ask for extra confirmation when it's needed. This is never used for tracking or advertising, and signing a device out forgets it.
To Process AI Features: Some optional features send your content to third-party AI providers for processing. AI features are off until you turn them on: we ask before you first use one, and you can turn them off at any time in Settings → Preferences. With them on, when you use a feature, the data it needs is transmitted to the provider named below to perform that specific operation:
- Voice Transcription (Cloudflare Workers AI): When you record a voice memo, the audio is sent to Cloudflare Workers AI to be converted into text.
- Summaries, Companion Chat, Voice Calls, Ask Your Ledger, Import, Add with AI, Recap Stories & Partner Briefs (Google Gemini): On Plus and Pro, if AI features and "Write summaries automatically" are both on, each time you save an encounter with notes, its notes and details are sent to Google's Gemini AI service to write a short summary. You can switch automatic summaries off separately, and still ask for a summary yourself. When you use the "Ledger Companion" chat, place an AI voice call, search with "Ask your ledger", or use AI-assisted import, the relevant data is also sent to Gemini. Depending on the feature, this can include your encounter notes, partner details, location names, your profile and Companion memory, and, if you ask the Companion about them, your sexual-health records. The AI voice-call feature streams your live microphone audio to Google for the duration of the call and returns synthesized audio and a transcript. When you use "Add with AI" to add a partner, the description you write or dictate and any screenshot you choose (for example of a dating-app profile or a chat) are sent to Gemini to fill in the form for you to check. If the screenshot shows their face, Gemini also returns where it is (only its position; it doesn't identify or describe anyone), and the app crops that part on your device to use as their photo, which you can change or remove. We don't store the rest of the screenshot, and nothing is saved until you save the form. On Pro, when you open the story card of a recap, that period's entries (dates, first names, places, activities, how it went and your notes) are sent to Gemini to write a short story of it, along with your Companion memory and tone (so it follows your "About you" notes and never brings up your topics to avoid), which we keep with your account so it isn't written again each time. In the same way, on Pro, a partner's brief and the chapter summaries of your story with them are written by Gemini from that partner's details, your notes about them and your encounters with them (first names only), and kept with your account until what they were written from changes, or the partner is deleted.
Your content goes to an AI provider only with your permission. While AI features are off, nothing is ever sent to one. These providers process your data only to perform the requested operation and return the result to you; we do not authorize them to use your content for their own purposes, to train their models, or to sell it.
To Improve the Service: We look at anonymous totals across all users, such as how many encounters are logged, which activities are most common, and how often features are used. These figures never identify you.
To Send Notifications: If you opt in, we deliver push notifications through web push and, on the native app, through Google's Firebase Cloud Messaging. The notification content passes through the applicable push service to reach your device.
To Send Email: We email your account's address to confirm it, to reset your password when you ask, with sign-in codes, and with security notices: a sign-in from a new browser or country (which names the device type and an approximate location from the network; you can turn these off), repeated wrong passwords, and changes to your password, email, passkeys, Apple or Google sign-in, gallery code or app lock, or when your account is deleted. If you turn them on, we also email test reminders and recap announcements, each with a one-click unsubscribe link. Emails are kept discreet: they never include your journal content, partners or health records. We never send marketing email, and never share your address.
To Process Payments: If you purchase a subscription, we process the transaction through the relevant payment provider (Stripe for web card payments, Apple for in-app purchases on iOS, or Google Play for in-app purchases on Android) and verify your entitlement.
To Check Storage Quotas: We calculate the total size of your uploaded media to enforce storage limits.

3. Data Storage and Security

We protect your data with industry-standard security, designed for information this personal.

Data Storage: Your account, journal and media are stored with our hosting provider, Cloudflare.
Encryption: All data is encrypted in transit and at rest. Your password, Gallery Code and other sign-in secrets are never stored in a readable form.
Sessions: Signing a device out, or changing your password, takes effect immediately.
Media Access Control: Your photos and videos are only available to you. If you set a Gallery Code, viewing them also needs a separate unlock (your Gallery Code or a passkey), which expires after a short time.

4. Third-Party Services

We use a limited number of trusted third-party services (subprocessors) to provide our features. Your data flows to them only as needed to deliver the feature you are using.

Cloudflare: Our primary infrastructure provider: hosting and data storage, voice-note transcription, scheduled jobs such as reminders, sending account email (which involves your address and the email's content), bot checks on our sign-up, sign-in and password-reset forms, and cookieless site analytics.
Google: We use several distinct Google services: Google Gemini (AI summaries, Companion chat, voice calls, and import parsing); Firebase Cloud Messaging (push notifications on the native app); Google Play billing (verifying Android in-app purchases); and Google Sign-In (authentication, if you choose it).
Apple: Sign in with Apple (authentication, if you choose it) and the App Store (processing and verifying in-app purchases on iOS).
Stripe: Processes web card payments and subscriptions, including plan upgrades. Stripe handles your card details directly; we do not store them.
Nominatim (OpenStreetMap): When you search for a place in a map, your search text is sent to Nominatim to find it. When you drop a pin, its coordinates are sent to suggest a place name. No other journal data is included.
Maps: Map imagery and styles are provided by Esri (ArcGIS) and, for the street map style, OpenStreetMap. Your browser or device requests these map tiles directly, so these services see the area of the map you're viewing and your IP address, but no journal data.

5. Data Retention and Deletion

You are in control of your data.

Retention: We retain your data for as long as your account is active.
Companion Chats: Your chats with the Ledger Companion, including transcripts of voice calls, are saved to your account so you can return to them. In Settings → Companion you can keep them until you delete them, have each one deleted 30 days after its last message, or not save them at all (which also deletes any saved so far). You can delete any chat, or all of them, at any time.
Recently Deleted: When you delete a partner or an encounter, it moves to Recently deleted (in Settings) for 30 days so you can restore it. During that time a deleted partner's photos and videos are kept too, and still count toward your storage. After 30 days, or sooner if you choose "Delete forever", it and its media are permanently deleted.
Other Deletions: Individual photos and videos, and health records, are deleted immediately when you delete them.
Sign-In Records: Records of devices that were signed out or have gone unused for a while are cleared out over time, and all of them are deleted with your account.
Emailed Links and Codes: Password-reset, confirmation and unsubscribe links, and sign-in codes, work for a limited time and are deleted after they expire. Remembered browsers and countries are forgotten after a period without use.
Support Requests: Your support requests and their screenshots are kept so you and we can look back at them, and are deleted with your account. A request sent while signed out, from an address with no account, is deleted on request.
Account Deletion: When you use the "Delete Account" feature in your settings, all of your associated records (including anything in Recently deleted) and stored media files are permanently and irreversibly deleted. We keep a record of past subscription transactions, no longer linked to your account, where needed for accounting and tax purposes.

6. Your Rights and Choices

You have the right to access, manage, and export your data.

Access and Correction: You can access and update your profile, account information, partner details, encounters, health records, and Companion memory directly within the application.
Data Portability: You have the right to export your data. The "Create Backup" feature allows you to download your journal data and, optionally, all associated media files.
Deletion: You can delete anything you've recorded, restore items from Recently deleted within 30 days, and delete your account and all associated data at any time.
Devices: You can see the devices signed in to your account and sign them out in Settings.
Notifications and Email: You can enable or disable notifications, sign-in alert emails, and reminder and recap emails at any time in Settings → Notifications, or unsubscribe from the link in any reminder or recap email.

7. Age Restriction

The Service is intended only for adults. Because Summer Ledger is designed for recording intimate and sexual-health information, you must be at least 18 years old (or the age of majority in your jurisdiction, if higher) to create an account or use the Service. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from a person under 18, we will take steps to delete it.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes. Your continued use of the Service after such changes constitutes your acceptance of the new policy.

9. Contact

If you have any questions about this Privacy Policy, please contact us at [email protected].