Privacy Policy
Ngern Ngok · Ledger · com.midori.ledger
Last updated 14 October 2026
Ngern Ngok is a personal finance ledger that runs on your device. In the Android app you can use all of it without an account, without a network connection, and without giving us anything. Ngern Ngok on the web is part of Ngern Ngok Plus, so it needs you signed in. This policy explains the narrow set of cases where data does leave your device, and what happens to it.
The short version
- Your ledger lives on your device. Cloud sync is off until you turn it on by signing in.
- Ngern Ngok has no analytics, no advertising and no trackers. Nothing reports your behaviour to us or to anyone else.
- If you subscribe to Ngern Ngok Plus, Google Play takes the payment and RevenueCat tells the app you have paid. We never see your card.
- If you scan a bank slip, the photo you choose is sent to Google's Gemini model to be read, then discarded by Ngern Ngok. Only what is read from it enters your ledger.
- If you import a bank statement PDF, it is opened and read on your phone; the file and its password never leave it. Only if you ask Ngern Ngok to name and sort the rows are their descriptions (never amounts, dates or balances) sent to Gemini.
- If the app crashes, it sends us a crash report through Sentry: what went wrong and where in Ngern Ngok's code. Never your amounts, names, notes or account. You can turn this off in Settings › Crash Reports.
- Ngern Ngok never connects to your bank. There is no aggregator, no screen-scraping, and no credentials to hand over.
- Your synced ledger is encrypted before it leaves your device — but this is not end-to-end encryption. See below; we would rather say so plainly than let you assume otherwise.
- You can delete your account and everything in it at any time.
What Ngern Ngok collects
Only if you choose to sign in for cloud sync:
| Data | Why | Where it goes |
|---|---|---|
| Your email address and account identifier, from whichever you use to sign in — Google or Apple | To know whose ledger is whose, so the right device gets the right data | Supabase (our hosting provider), for as long as your account exists |
| Your ledger, encrypted — wallets, transactions, categories, budgets, schedules | So the same ledger appears on your other devices | Supabase, as a single encrypted record per account |
| Your IP address, in ordinary server logs | Security and abuse handling. Not linked to your ledger contents and not used to build a profile | Supabase, kept up to 30 days, then discarded |
If you never sign in, none of the above happens. The one thing Ngern Ngok sends without an account is a crash report, described below, which you can turn off.
Signing in with Apple, and Hide My Email
You can sign in with Google or with Apple. Either way we receive an email address and an account identifier, and nothing else — no name, no contacts, no profile.
If you choose Hide My Email, Apple gives us a private forwarding address ending in privaterelay.appleid.com instead of your real one. We never see the address behind it, and messages we send to it are relayed by Apple. That address is what we store, and it is all we have.
There is a consequence worth stating plainly, because it is not obvious and it affects your data: Hide My Email means we cannot tell that you are the same person as an existing account. If you already use Ngern Ngok with Google and then sign in with Apple using Hide My Email, you get a second, separate account with its own empty ledger — because the whole point of the feature is that the two cannot be connected. Signing in with Apple and choosing Share My Email instead, with the same address as your Google account, lands you on your existing account and your existing ledger. Ngern Ngok tells you in the app when this happens, before anything is uploaded, and lets you back out.
What Ngern Ngok does not collect
- No bank credentials. Ngern Ngok has no bank connection of any kind. Every figure in it is one you entered or imported yourself.
- No analytics or usage tracking. There is no measurement SDK in the app. We cannot see which screens you open or how often you use it.
- No advertising identifiers, and no data is sold, rented or shared with advertisers or data brokers. There is nothing to sell.
- No contacts, location, or device identifiers. The app does not request these permissions. Photos only if you turn on Find new slips (below), and even then the only photos that ever leave your phone are slips you choose to scan.
- The daily reminder and bill and budget notifications, if you turn them on, are set on your phone from your ledger there. Nothing about them leaves the phone.
- Voice entry, if you tap the microphone in Chat, opens your phone's own speech service (Google's on most Android phones), which listens and returns the words. Ngern Ngok does not record or keep audio and has no microphone permission; the speech service's own privacy terms apply to what you say. The words are read on your phone like typed text.
- Receipt photos. A photo you add to an entry is shrunk and kept in Ngern Ngok's private storage on that phone. It is not uploaded, synced, or put in backup files; another device signed in to your account sees that the entry has a photo, not the photo. Taking one opens your phone's camera app, so Ngern Ngok holds no camera permission. Deleting the entry, or your account, removes it.
- Google Play Integrity. When you are signed in, the Android app asks Google Play to confirm it is the genuine Ngern Ngok from Play, so the web app stays part of Ngern Ngok Plus. Google Play sees that request as part of its own service. Our server keeps only whether your sign-in session passed, why not if it did not, and when.
Scanning bank slips
Scanning is optional and needs you signed in. When you choose slips with your phone's photo picker, Ngern Ngok shrinks each image and sends it to our server, which passes it to Google's Gemini model to read the amount, date, names, and reference number printed on it. On Android you can also share slips to Ngern Ngok from another app, such as your bank app or Gallery; Ngern Ngok asks before it reads them. Unless you turn on Find new slips, Ngern Ngok never asks for access to your photo library and only sees the images you pick or share.
Find new slips (Android, off by default). If you turn it on, Ngern Ngok asks for access to your photos (all of them, or only those you select). Each time you open Ngern Ngok it looks at the photos added since it last looked and reads any QR code in them, on your phone, to find the verification code banks print on transfer slips. Nothing is sent while it looks. The photos it finds are offered to you, and only the ones you choose to read are sent to be scanned as above. You can turn it off in Settings, and remove the access in Android's settings, at any time.
Our server does not store or log the image. Google processes it under its paid Gemini API terms, which do not allow it to be used to train Google's models. Those terms do let Google keep a copy of the request for a limited time to detect misuse of its service and for security and legal reasons, so we cannot say the image is gone from Google the moment it is read. What is read from the slip is returned to your phone, where it becomes transactions in your ledger, synced like the rest of it.
To count your monthly scans, our database keeps a few numbers per month: how many slips you scanned, and how much of Google's model processing (counted in "tokens") they used, so we can see what scanning costs. It records nothing about what was on them.
To tell money you sent from money you received, Ngern Ngok compares the names on each slip with the names you give it in Settings › Names on Your Slips. Those names are stored in your ledger's settings and sync with it. Ngern Ngok also keeps the name of the other side of each scanned slip with its transaction, so the next slip to or from that person starts in the same category; it stays in your ledger and syncs with it.
Importing bank statements
You can import a statement PDF from your bank app. Ngern Ngok opens it on your phone; if the PDF has a password, you type it there. Neither the file nor the password leaves your phone, and neither is kept once you close the import. Ngern Ngok reads every date, amount and balance itself and checks them against the running balance and the totals the bank prints.
Naming and sorting the rows is optional and needs you signed in. If you choose it, each page's row descriptions are sent to our server, which passes them to Google's Gemini model together with the names of your categories. A description is the bank's wording for a movement. It usually names the person or business on the other side and includes the masked account number the bank prints (for example X1234). Amounts, dates, balances and your own account number are never sent. Gemini answers with a name for each row, a category from your own list, and whether the other side is a person, a business or the bank.
Our server does not store or log the descriptions. Google handles them under the same paid Gemini API terms as slip images, described above. Each page counts as one scan in your monthly count.
Ngern Ngok Plus subscriptions
Ngern Ngok Plus is optional and needs you signed in. Google Play handles the payment under its own terms; we never receive your card or bank details.
To know whether you have Plus, Ngern Ngok uses RevenueCat, a subscription service acting as our data processor. It receives your Ngern Ngok account identifier and the purchase records Google Play provides for this app: which plan, when it started and renews or ends, whether it is a trial, and the price, currency and store country of the purchase. It does not receive your ledger, your email address or your name. The app and our server ask RevenueCat whether your subscription is active, and nothing else.
So that the web app and slip scanning can check your subscription without asking RevenueCat every time, our database keeps one record per subscriber: that your account has Plus, and until when. It is updated each time the subscription is checked, removed when the subscription ends, and deleted with your account.
When you delete your Ngern Ngok account, we delete your RevenueCat record as part of it. Deleting the account does not cancel the subscription itself; cancel that in Google Play › Subscriptions, and Google Play keeps its own record of the purchase under its policy.
Crash reports
When Ngern Ngok hits an error it did not expect, it sends a crash report to Sentry, a crash-reporting service that acts as our data processor, so we can find and fix the fault. This happens whether or not you are signed in, and it is on unless you turn it off in Settings › Crash Reports. The setting applies to the device it is changed on.
A report contains the type of error, its message with every number, quoted text, non-English text and email address removed, and the file and line in Ngern Ngok's code where it happened. Messages from reading data, which repeat the data they could not read, are left out entirely. Sentry also sees the app version and, from the request itself, your operating system and browser version. A report is not sent with your ledger, account, email or a record of what you tapped. Error messages are written by the app and by your phone's system, so we cannot promise that one never carries a word of English text from your ledger past these filters; if that matters to you, turn crash reports off. Ngern Ngok asks Sentry not to work out or store your IP address.
Reporting a problem. The Crash Reports page in Settings also has a box to tell us about a problem. Only when you press Send, what you typed there goes to Sentry with the app version and whether you use Android or the web. Nothing else from your ledger or account goes with it, so please leave amounts, names and account numbers out of it. With crash reports off, Send opens your own email app with the message instead, and nothing is sent unless you send that email.
About the encryption — please read this part
Your synced ledger is encrypted on your device before it is uploaded, and it is stored as encrypted bytes. It is not end-to-end encrypted, and we will not describe it that way.
The encryption key is derived from your account identifier, which is also the identifier of the record it protects. That means our hosting provider is technically capable of deriving the key and reading your ledger. We do not do this, but a promise is not the same as being unable to — and only the second one would be end-to-end encryption.
What the encryption does protect against is real and worth having: another Ngern Ngok user cannot reach your record (each account can only read its own, enforced by the database, not by the app asking politely), and the stored bytes alone are not readable finances. It does not protect a stolen copy of the database itself, because your account identifier, which the key comes from, is stored alongside the record.
What it does not protect against is us, or anyone who compels us. If that distinction matters to you, use Ngern Ngok without signing in. Everything except cross-device sync works exactly the same, and your ledger never leaves your device.
Exchange rates
Ngern Ngok shows figures converted into your base currency. At most once a day it requests a public table of exchange rates from open.er-api.com. That request contains no account, no identifier and no ledger data — it asks for the same table for everyone and carries no API key. As with any web request, that provider can see the IP address it came from. If the request fails, Ngern Ngok keeps using the rates it already has.
Where your data is processed
Sync is hosted on Supabase, crash reports on Sentry in the United States, slip images and statement descriptions are read by Google (Gemini API), and subscriptions are tracked by RevenueCat in the United States; all four act as our data processors. If you are in Thailand, the European Economic Area, or the United Kingdom, your data may be processed outside your country. The privacy terms published by Supabase, Sentry, Google and RevenueCat govern their handling of it.
The app itself is distributed through Google Play and the Apple App Store. Each collects its own data about downloads and, where applicable, purchases, under its own policy that we do not control and cannot see into. If you install a test build through TestFlight, Apple additionally shares your email address and basic install and crash information with us as the developer, under Apple's terms rather than this policy.
How long it is kept
- Your account and ledger: until you delete them. There is no separate archive and no backup we could restore from afterwards.
- Server logs: up to 30 days.
- Crash reports: up to 90 days, then deleted by Sentry.
- Slip images: not stored by Ngern Ngok at all. Google may keep a copy for a limited time under its Gemini API terms, as described above. The monthly scan count is kept until you delete your account.
- Bank statements: the PDF and its password are never sent anywhere. Descriptions sent for naming are not stored by Ngern Ngok; Google may keep a copy for a limited time, as for slip images.
- Subscription records at RevenueCat: until you delete your account. Google Play's own purchase records are kept under Google's policy.
- On your device: until you erase it or uninstall the app. Uninstalling removes the local ledger; it does not delete your account. The ledger on your phone is not encrypted by Ngern Ngok: Android keeps each app's storage private to that app, and Ngern Ngok leaves it out of Android's backups and phone-to-phone transfers. The app lock hides the screen; it does not encrypt the data.
Your choices and rights
- Do not sign in. The most complete privacy control in Ngern Ngok, and it costs you only cross-device sync.
- Export everything. Settings › Backup and Restore writes your whole ledger to a file you keep. No request to us, no waiting.
- Stop syncing. Sign out. Your ledger stays on the device.
- Stop crash reports. Settings › Crash Reports. Nothing is sent from that device afterwards.
- Delete everything. Delete your account, in the app or by email if you have uninstalled it.
Under the GDPR and the UK GDPR you have rights of access, correction, erasure, restriction, objection and portability; under the PDPA in Thailand you have equivalent rights. Access and portability are built into the app so you do not have to ask. For anything else, email us and we will respond within 30 days.
Our lawful basis for processing, where the GDPR applies, is performance of a contract — you asked us to sync your ledger, scan your slips, or provide the subscription you bought — and legitimate interest for the security logs and for crash reports, which you can switch off.
Children
Ngern Ngok is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change what we collect, we will update this page and its date before the change ships, not after. Material changes will also be noted in the app.
Contact
Ngern Ngok is built by PlainPoint. Questions about your data, or a rights request: support@plainpoint.net.