Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use TracLedger, you may provide:

• Name, email address and password
• Business name, business type and filing status
• State and city of residence (for tax estimation)
• Accountant or CPA email address (if you choose to send quarterly packets)

1.2 Financial Data Accessed Through Third-Party Services

When you connect financial accounts through our Service, we access the following data through our integration partners:

Through Plaid: Bank account transaction history (up to 24 months), including transaction amounts, dates, merchant names, transaction categories, account names and account types. Plaid may also provide account balances. We access this data with your explicit authorization through Plaid Link. By using our Service, you acknowledge and agree that your financial data will be accessed through Plaid's services. For more information on how Plaid handles your data, please review Plaid's End User Privacy Policy.

Through Stripe Connect: Payment transaction history from your Stripe account, including charge amounts, dates, customer information associated with charges and payout details.

Through Square (when available): Point-of-sale transaction data including daily sales totals, itemized line items, refunds, tips, taxes collected, payment method breakdowns, payout schedules and processing fees.

Through Google (if connected): Limited access to Google Sheets and Google Drive for the sole purpose of creating and updating your TracLedger financial export spreadsheet. We request only the spreadsheets and drive.file scopes, which limit access to files created by TracLedger. We do not access any other files in your Google account.

1.3 Documents You Upload

You may upload financial documents (receipts, invoices, tax forms) to TracLedger's document vault. These are stored securely and are accessible only to you.

1.4 Information Generated by the Service

TracLedger generates the following data based on your financial information:

• AI-powered expense categorizations
• Quarterly self-employment tax estimates (federal, state and local)
• Accountant packet reports (PDF)
• Conversation history with Marie-Flynn, our AI assistant

1.5 Technical Information

We automatically collect:

• IP address and approximate location (for rate limiting and security)
• Browser type and device information
• Pages visited and actions taken within the Service
• Error logs and performance data (via Sentry)

2. How We Use Your Information

We use your information solely to provide, maintain and improve the Service:

• Display unified income and expense data across your connected platforms
• Categorize expenses using AI based on IRS tax codes
• Calculate estimated quarterly self-employment tax obligations
• Generate CPA-ready accountant packets
• Power Marie-Flynn, our AI assistant, to answer your financial and tax questions
• Send transactional emails (account verification, password resets, quarterly tax reminders, accountant packet delivery)
• Monitor service health and debug errors
• Prevent fraud, abuse and unauthorized access

We do not use your data for advertising. We do not sell, rent, license or trade your personal or financial data to any third party.

3. How We Share Your Information

We share your information only with the following categories of service providers, solely to operate the Service:

We may also disclose your information if required by law, legal process or government request, or to protect the rights, property or safety of TracLedger, our users or the public.

4. Data Security

We implement the following security measures to protect your data:

• Encryption at rest: All financial credentials, access tokens and account identifiers are encrypted using AES-256-GCM before storage in our database. The database is hosted on Railway, which provides infrastructure-level encryption at rest.
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher, enforced through Cloudflare.
• Access controls: All database queries are scoped to the authenticated user's ID. No user can access another user's data. API routes verify both session existence and user ownership.
• Input validation: All user inputs are validated using Zod schemas before processing.
• Password security: Passwords are hashed using bcrypt with a cost factor of 12. We never store, log or transmit plaintext passwords.
• Webhook verification: All Stripe webhook events are verified by cryptographic signature before processing.
• Rate limiting: Login attempts, registration, API calls and sync operations are rate-limited to prevent abuse.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

5. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide the Service.

Account deletion: You can delete your account at any time from Settings. When you delete your account, we permanently delete all associated data including your profile information, connected account tokens, transactions, documents, AI conversation history, notification preferences and tax estimates. This deletion cascades through all related records and is irreversible.

Connected account tokens: If you disconnect a financial platform (Plaid, Stripe, Square, Google), the associated OAuth tokens are deleted immediately.

Backup retention: Database backups maintained by our hosting provider (Railway) may retain deleted data for up to 7 days before permanent removal.

6. Your Rights

You have the following rights regarding your data:

• Access: You can view all data TracLedger holds about you through the Service dashboard, including transactions, documents, tax estimates and AI conversation history.
• Correction: You can update your profile information, recategorize transactions and edit document metadata at any time.
• Deletion: You can delete your account and all associated data from Settings.
• Export: You can export your financial data to Google Sheets. Accountant packets are available as downloadable PDFs.
• Revocation: You can disconnect any connected financial platform at any time, which immediately revokes our access to that platform's data and deletes the stored tokens.

7. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use and disclose
• The right to request deletion of your personal information
• The right to opt out of the sale of personal information — we do not sell your personal information
• The right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at [email protected].

8. Children's Privacy

TracLedger is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

9. Cookies and Tracking

TracLedger uses essential cookies for authentication and session management. We do not use advertising cookies, tracking pixels or third-party analytics cookies. Error monitoring through Sentry may collect anonymized session data for debugging purposes.

10. SMS Communications

If you opt in to phone verification, we send SMS messages solely for account verification purposes. Message frequency is limited to verification requests you initiate. Reply STOP to opt out at any time. Message and data rates may apply. SMS verification is optional and not required to use the Service.

11. Third-Party Links

The Service may contain links to third-party websites or services (such as IRS.gov for tax reference). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (sent to the email address associated with your account) or by posting a prominent notice within the Service at least 7 days before the changes take effect. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: [email protected]

Website: tracledger.com

Operated by: TracLedger