Ledger · the fine print

Privacy Policy

Effective 24 September 2026.

FoxFire Solutions LLC, a Delaware limited liability company having its registered office at 3 Germay Dr Unit 4 1430, Wilmington, DE 19804 (“Ledger”, “we”, “us” or “our”), operates the Ledger application and the website at ledgerblackbook.com (together, the “Service”). This Privacy Policy describes the Personal Information we collect, the purposes for which we process it, the parties to whom we disclose it, and the rights available to you. We are the controller of that information.

In this Policy, “you” means an individual who uses the Service. “Subject” means an individual whose telephone number a user has entered into the Service and who is not themselves a user.

1. Information we collect

1.1 Information you provide. We collect your telephone number, your email address where you elect to provide one, and the municipality or neighborhood you select. We collect the records you create concerning individuals you are seeing, comprising nicknames, relationship statuses, the manner in which you met, tags, and the dates and categories of contact. One available status records that you are in a sexual relationship with an individual, and two available contact categories record that you or that individual attended the other’s residence.

1.2 Information encrypted before transmission. Your notes, pinned facts, self-assessment responses and thread messages are encrypted on your device, using a key generated on your device, before transmission to us. We store the resulting encrypted content. A copy of that key is stored with your account in encrypted form, under a separate key held in our server environment and not in the database, so that the content opens on any device on which you sign in with your telephone number. When the key is first stored, and each time it is made available to a new device, it passes in unencrypted form through the memory of our server for the duration of that request; it is not written to storage or logs at that time. Our servers do not decrypt that content in providing the Service. Section 8.1 describes who is able to read it.

1.3 Information we do not collect. We do not collect government identification, photographic self-portraits, facial geometry or any other biometric identifier. We do not collect or retain the telephone number of any Subject; your device derives a cryptographic code from that number and discards the number itself. We maintain no field for a Subject’s name, photograph, employer or address. We do not collect the content of your messages; import functions retain only timestamps and direction. We do not collect precise geolocation.

1.4 No cross-context tracking. We do not use your Personal Information to track you across applications or websites operated by third parties, and we do not sell it.

1.5 Usage and diagnostic information. On the pages anyone can open without signing in, and on the pages of the Service that list your entries or hold your settings without showing any one Subject, we record which page was viewed, the referring site, device and browser type, page load performance (public pages only), and a random identifier kept in your browser’s local storage so that repeat visits can be counted. On those pages where nothing is entered, we may record the session: how the page was displayed, scrolled and clicked. Within the Service that recording masks all text and form fields and omits every element that carries a label or title, so no entry, nickname or note is recorded. Once you open or add a Subject’s page, import entries or open a signal, we record nothing further until the Service is next loaded. We record no session, and send no usage event, from a Subject’s page, the health context and self-assessment pages, the steps where a passphrase or recovery phrase is shown or your area is chosen, or the administration pages; and we record no session on the steps where a telephone number or code is entered or on the self-check. When the Service fails, we record a technical description of the error, with addresses reduced to the kind of page, and telephone numbers, email addresses, request contents and cookies removed. None of this information is linked to your account.

2. Subjects

2.1 Purpose. Individuals recorded in the Service have not consented to that recording. This Section describes the limits we place on it.

2.2 Tokenization. When you enter a telephone number, your device derives a cryptographic code from it and discards the number. Where two users independently enter the same number, the derived codes coincide, which permits us to inform each user that another user has recorded that number (a “signal”). We do not store the number. The code is derived with a key held separately from the database, as described in Section 8.2, which also explains why you should not treat a code as anonymous.

2.3 Limits on disclosure. No further information passes between users except where both users affirmatively elect, at each stage, to permit it. Either user may withdraw at any stage.

2.4 Subject verification. A Subject may verify a telephone number by SMS and ascertain whether any flags are recorded against it. We disclose only the existence of one or more flags. We do not disclose which flags, how many, or the identity of the user who recorded them. Verification creates a record retaining that telephone number so that we may identify the Subject in connection with any subsequent dispute.

2.5 Disputes. A Subject may dispute a flag. We will conceal a disputed flag of a disputable category pending review and will notify the Subject of our determination. We will neither disclose the existence of, nor remove upon dispute, a record that a user felt unsafe, on the ground that a process permitting the subject of such a record to suppress it would afford less protection than no process. No such record is published, and it is disclosed only to a user who has independently recorded the same telephone number and who has affirmatively elected to receive it.

3. Health information

3.1 Self-assessment. The self-assessment collects responses concerning your own screening factors. Those responses are encrypted on your device before transmission. We retain only the resulting guidance level, being one of three values, which is not associated with any individual recorded in the Service.

3.2 Area data. Rates displayed in the Service are published population data concerning geographic areas, and not data concerning individuals. We do not associate any such figure with any individual.

3.3 Consumer health data. The self-assessment responses, the status recording a sexual relationship, and the contact categories recording attendance at a residence constitute consumer health data under the Washington My Health My Data Act, RCW 19.373. We obtain your consent to collection separately from your acceptance of our Terms of Service, obtain a further and separate consent prior to any sharing, and do not sell such data. You may withdraw consent at any time. Our Consumer Health Data Privacy Notice, linked from every page of the Service, sets out these matters in full and governs in the event of any inconsistency with this Section.

4. Purposes of processing

We process Personal Information to operate the Service, comprising: presenting your own records to you; identifying coincident codes and notifying the affected users; presenting pattern observations derived from your own records; presenting area health data; authenticating you; and preventing fraud and abuse. Pattern observations describe your records and are not representations of fact concerning any individual. We do not process Personal Information for advertising, and we display no advertising.

5. Disclosure

5.1 Service providers. We disclose Personal Information to service providers to the extent necessary to operate the Service, comprising hosting and database providers, an SMS verification provider, a bot mitigation provider, an email provider, and error and usage monitoring providers. Each processes that information on our behalf, under contract restricting its use to that purpose. We will identify any such provider on written request to privacy@ledgerblackbook.com.

5.2 No sale or sharing. We do not sell Personal Information and have not done so. We do not share Personal Information for cross-context behavioral advertising.

5.3 Legal process. We require a warrant or court order before disclosing the contents of any individual’s records, and will not respond to informal requests. We will notify you of a request concerning your information unless prohibited by law or court order, and will seek to narrow or resist any request exceeding what the law requires. Material portions of your records are stored encrypted. Because we hold the means to decrypt them, as described in Section 8.1, we may be compelled to produce their content, and will do so only as the law requires.

6. Retention

6.1 General. We retain the records comprising your book for so long as your account subsists, subject to Sections 6.2 and 6.3.

6.2 Threads. Messages within a thread between users are deleted ninety (90) days after the thread is opened.

6.3 Archived records. Where you archive an individual, we delete that individual’s contact log twelve (12) months thereafter. The individual record, your notes and your flags are retained. You are advised to export before archiving where you may require the contact log.

6.4 Deletion. Deletion of your account removes your book, codes, contact events, notes, flags and threads, and dissolves any signals. Deletion is irreversible.

7. Your rights

7.1 All users. You may export the entirety of your data from the You page. Your notes, pinned facts and self-assessment responses are decrypted on your device when the export is prepared and appear in the export in plain text, together with the remainder of your data. Any person who obtains the export file is able to read it. You may delete your account from the You page upon typing a confirmation.

7.2 California residents. We collect the categories of Personal Information identified in Section 1, comprising identifiers, coarse geolocation, internet activity in the form of scrubbed diagnostic and usage events, and sensitive Personal Information, being information concerning health and information concerning sex life. We collect each for the purposes stated in Section 4 and retain each for the periods stated in Section 6. We have not sold or shared Personal Information within the preceding twelve months within the meaning of the California Consumer Privacy Act. We do not use or disclose sensitive Personal Information for any purpose other than those permitted without a right to limit under Cal. Civ. Code § 1798.121 and its implementing regulations. We do not knowingly sell or share the Personal Information of consumers under sixteen years of age. You may request access, correction, deletion, and a portable copy, and we will not discriminate against you for exercising any right. Submit a request to privacy@ledgerblackbook.com. We verify a request against the telephone number associated with the account. An authorized agent may submit a request on your behalf upon presentation of written authorization we are able to verify.

7.3 Washington and Nevada residents. Rights in respect of consumer health data are set out in our Consumer Health Data Privacy Notice.

7.4 Illinois residents. You may contact us at privacy@ledgerblackbook.com in respect of any matter arising under the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505. We will notify you of a breach of the security of your data in accordance with the Personal Information Protection Act, 815 ILCS 530.

7.5 Territorial scope. The Service is offered in the United States. It is not offered to residents of the European Economic Area or the United Kingdom.

8. Security

8.1 Measures. Access to records is restricted to the account to which they belong by row-level authorization within the database; the public credential distributed with the application confers no read access of its own. Content within Section 1.2 is encrypted on your device before transmission. The key that decrypts it is stored with your account only in encrypted form, under a separate key held in our server environment and not in the database, such that a copy of the database alone does not permit decryption. Any person able to sign in to your account, including a person who obtains control of your telephone number, is able to read that content. A person holding both our database (or a backup of it) and that separate key would also be able to decrypt it, and the key passes through our server’s memory, unencrypted, whenever it is stored or made available to a device (Section 1.2). For accounts created before 29 September 2026, a further copy of the key, protected by the account holder’s passphrase, is also retained.

8.2 Tokenization key. The key used to derive codes from telephone numbers is held in a deployment separate from the database, such that a copy of the database alone does not permit derivation of a telephone number from a code. We do not combine the two and do not test lists of telephone numbers against stored codes. Because we hold both, you should treat codes as capable of being linked to a telephone number by us and not as anonymous.

8.3 Disclosure of vulnerabilities. We do not publish details of our infrastructure. Security researchers may contact security@ledgerblackbook.com. We will not pursue any claim against a researcher who reports a vulnerability in good faith.

8.4 Breach notification. We will notify affected individuals and, where applicable, the relevant Attorney General, within thirty (30) days of confirming a breach of the security of Personal Information, and earlier where practicable.

9. Children

The Service is not directed to, and may not be used by, individuals under eighteen (18) years of age. We do not knowingly collect Personal Information from any such individual. Where we become aware that we have done so, we will delete it.

10. Amendment

We will publish any amendment to this Policy on this page and will notify you within the Service prior to its taking effect.

11. Contact

Privacy inquiries and rights requests: privacy@ledgerblackbook.com. Security reports: security@ledgerblackbook.com. All other matters: legal@ledgerblackbook.com.

FoxFire Solutions LLC, 3 Germay Dr Unit 4 1430, Wilmington, DE 19804.