This Privacy Policy explains how You Jern Veen("we," "us," or "our") collects, uses, and protects information when you join the Loot & Ledger waitlist or use the Loot & Ledger application (together, the "Service"). By using the Service, you agree to the collection and use of information as described here.
1. Information We Collect
We collect different information depending on how you interact with the Service.
Waitlist visitors
- Your name and email address, submitted voluntarily to join the waitlist.
Registered app users
- Your email address, used for authentication and account-related communication.
- Your sovereign name (in-app display name) and other profile details you set, such as your currency and monthly tribute.
- Your financial transaction data — the entries you log, including amounts, categories ("wards"), remarks, and associated bank or account labels.
- Your account balances — the balances you manually enter for accounts you add (Loot & Ledger does not connect to your real bank or financial institution; nothing is imported or synced automatically).
- Your reflections — the answers you provide to the guided Sanctuary reflection prompts, and the AI-generated responses returned to you.
Automatically collected
- Standard technical data generated by your use of the Service, such as request logs collected by our hosting provider, which may include IP address and browser information.
2. How We Use Your Information
- To provide, operate, and maintain the Service.
- To send waitlist confirmation emails and account-related emails (such as login and security notices).
- To power the AI Reflection feature in the Sanctuary, which generates a personalized response to the entries you submit.
- To maintain the security and integrity of the Service and prevent abuse.
- To comply with legal obligations.
3. Third Parties We Share Data With
We do not sell your data. We do share data with the following service providers, each of which processes data on our behalf and only to the extent needed to deliver the Service:
- Supabase — our database and authentication provider. Supabase stores your account credentials, profile, transaction, and reflection data.
- Resend — our transactional email provider. Resend processes your email address to deliver waitlist confirmations and account-related emails.
- Google Gemini API — powers the AI Reflection feature. When you submit a reflection, the text you enter (your answers and related transaction context) is sent to Google's Gemini API to generate a response. Do not include sensitive information beyond what's necessary in your reflection entries.
- Vercel — our hosting provider. Vercel serves the application and processes standard request/server log data as part of hosting.
4. Data Storage & Security
Your data is stored in Supabase with row-level security (RLS) enabled, meaning database rules enforce that you can only access your own records — no other user, and no part of the application itself outside of authenticated requests, can read your data directly. All data in transit between your device and our servers is encrypted using HTTPS/TLS. No method of transmission or storage is 100% secure, but we take reasonable technical measures to protect your information.
5. Data Retention
We retain your data for as long as your account remains active, or as needed to provide the Service. If you delete your account, your data is deleted as described in Section 6 below. Waitlist entries are retained until the waitlist closes or you request removal.
6. Your Rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data — most profile and entry data can be edited directly in the app.
- Delete your data.
Registered users can permanently delete their account and all associated data at any time using the "Delete my account" feature in the app's Garage / account settings. This immediately and permanently removes your profile, accounts, ledger entries, and reflections from our database, and deletes your authentication record. This action cannot be undone.
For waitlist-only entries, or if you need help exercising any of these rights, contact us at contact@loot-and-ledger.com.
7. Malaysia — Personal Data Protection Act (PDPA) 2010
You Jern Veen is based in Malaysia, and our processing of personal data is carried out in accordance with the Personal Data Protection Act 2010 (PDPA). Under the PDPA, you have the right to access and correct your personal data, to withdraw consent to its processing, and to request that we limit how it is processed. To make a request under the PDPA, contact us at contact@loot-and-ledger.com.
8. GDPR — Rights for EU/EEA Users
If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) gives you additional rights over your personal data.
Lawful basis for processing
We process your data on the basis of: (a) your consent, where you voluntarily provide information such as joining the waitlist or submitting a reflection; (b) performance of a contract, to provide the Service you've signed up for; and (c) legitimate interests, such as maintaining security.
Right to erasure
You may request full erasure of your personal data at any time, either using the in-app "Delete my account" feature or by contacting us directly. We will delete your data without undue delay, except where retention is required by law.
Data portability
You may request a copy of your personal data in a structured, commonly used format by contacting contact@loot-and-ledger.com.
International transfers
Because we use service providers such as Supabase, Resend, Google, and Vercel, your data may be processed on servers located outside your country of residence, including outside the EU/EEA. Where this occurs, we rely on our providers' respective data protection safeguards.
9. Cookies & Local Storage
We do not use advertising or third-party tracking cookies. The app uses your browser's built-in storage for functional purposes only:
- sessionStorage — used to remember your selected in-app "mood" and today's spend total for the duration of your browser session. This is cleared automatically when you close the tab.
- localStorage — used to remember whether you've completed a short in-app tutorial step (visiting the Vault), so it isn't shown to you again on future visits.
None of this data leaves your browser or is transmitted to us.
10. Age Requirement
Loot & Ledger is a financial tracking application and is not intended for use by anyone under the age of 18. By using the Service, you confirm that you are at least 18 years old. We do not knowingly collect data from anyone under 18, and will delete any such data if we become aware of it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
12. The Monument
Loot & Ledger's first one hundred registered users ("Founding Sovereigns") may choose to have their chosen sovereign name displayed publicly on the Monument page, which honors the Service's earliest members.
- This is opt-in and disabled by default. Your name is never shown publicly unless you explicitly enable it in your Garage settings.
- Only your sovereign name (in-app display name) is shown — never your real name, email address, or any financial data.
- You may opt out at any time from the Garage, which immediately removes your name from the public Monument.
- The name displayed is a snapshot taken at the moment founding status was granted. It does not automatically update if you later change your sovereign name elsewhere in the app; Founding Sovereigns may amend this snapshot once.
- If you delete your account, your name is permanently removed from the Monument along with all other personal data — it is not retained.
13. Contact Us
For any questions about this Privacy Policy or to make a request regarding your data, contact us at:
contact@loot-and-ledger.com