Privacy

Optional AI preferences

In versions offering “What your AI can see,” sharing starts off. You can preview and share selected property names, categories, allocation preferences, vendor names and helper first names with specific connected assistants. This does not give an assistant access to your saved receipts, transaction amounts or ledger.

We store an encrypted copy after you review your selections and confirm sharing. In versions with the confirmation flow, access expires after 30 days unless you confirm again; earlier versions may refresh an approved copy while you use the app. You can stop sharing and delete the server copy, including previously shared property and schedule copies. If your phone is offline, server deletion waits for a connection and access may continue until deletion succeeds or access expires. An assistant may retain information it already received under its own settings.

Suggestions based on your edits stay on your phone until you approve and share them. Assistant suggestions also need your review; they do not become preferences automatically. Pending suggestions expire within 30 days. We keep the time each assistant last read your preferences for up to 30 days. Provider backups may retain deleted information temporarily.

Draft delivery and review status

Compatible versions send a draft ID and whether you saved or discarded it, plus whether fields changed, without sending the saved record or edited values. Your connected assistant can see only the status of drafts submitted through its own connection. We use counts, sources and review timing to measure reliability; account-linked status facts are retained for up to 180 days and removed when the account is deleted. Weekly reports contain aggregates, not receipt content. Older drafts may have no review status.

Which product this covers

DOORLEDGE LLC, a Texas limited liability company, operates the doorledge mobile apps, website and connected features. The Android app is currently in testing, not publicly released on Google Play. The sections describing Apple sign-in, Apple purchase verification and connected workflows apply to iPhone versions that provide them.

doorledge is a native mobile app. This website provides help, account connections, team submission forms and private snapshot readers. It is not a browser version of the ledger. Connected features apply only to app versions that include them.

Android: local records and device access

The current Android test app stores property details, income, expenses, receipt images and recognized text, rental allocations, hours, mileage, checklists, supply reminders, helper contact details and booking-calendar links on your device. It does not sign in to a doorledge account or send these records to our service. Email forwarding, assistant connections, online team submissions, accountant links and Google Play billing are not enabled in this build. Descriptions of those connected features elsewhere on this page do not apply to it.

Android receipt recognition uses Google ML Kit on your device. Receipt images and recognized text are not sent to Google for recognition. ML Kit does send Google technical information, including device and app details, installation identifiers, processing times, errors and feature usage. Google uses this information for diagnostics and usage analytics. Read Google’s ML Kit data disclosure and Google’s privacy policy. We do not include an advertising SDK or use your rental records for advertising.

You choose photos, PDFs and CSV files through Android’s camera, file or photo interfaces, or share them from another app. doorledge does not scan your inbox, contacts or entire photo library. It does not request your location; mileage is entered by you. If you enable app lock, Android handles your fingerprint, face or screen-lock check; doorledge does not receive biometric templates.

Reminders and timer notifications are scheduled on the device with your permission. Notification details may be visible on your lock screen depending on your Android settings. When you add a booking-calendar URL, your phone contacts that provider directly to download the calendar; the provider receives your IP address and the requested URL. Calendar links may contain private access tokens, so keep them private.

Android automatic cloud backup and automatic device transfer are disabled for this build. Use Backup & restore to save a backup yourself. Backups include local records, receipt originals, extracted text, property and helper details, tasks and calendar links, including records in Recently deleted. Exports, checklist copies and backups leave the app only through the destination you select. The receiving app or storage provider handles that copy under its own terms; doorledge cannot recall it.

You can remove local data through the app’s deletion controls. Clearing the app’s storage in Android settings or uninstalling removes its private local data. Files you exported or backed up elsewhere remain until you delete them from those destinations. The current Android app has no doorledge account to delete, and our service cannot recover its local ledger. Support emails are handled as described under Feedback and support below.

iPhone: what stays on your phone

The app stores your ledger locally. Receipt scanning and text recognition happen on the device. Signing in or creating a helper link does not upload your ledger. Publishing an accountant snapshot sends the selected records and any originals you choose to include, as described below. Extracted receipt text is not uploaded as a separate snapshot field. Building and land measurements, team phone numbers and booking-calendar links remain local.

When you add a booking-calendar link, the phone requests that calendar directly from its provider. Exports and snapshots leave the app only when you choose to share or publish them. The app you share to then handles that copy under its own privacy practices.

Apple device backups may include local app data, depending on your settings. The team service cannot recover your ledger or receipt originals. The iPhone app contains no advertising or analytics SDK; Android’s ML Kit metrics are described above.

Checklists and supply reminders

In app versions with Tasks, checklist names, property names, tasks, check marks, completed-run history and supply reminders are saved on your iPhone. A reminder may also keep the vendor and date of the receipt you selected. These details are included in your local backup; they are not automatically sent to the team service or included in accountant snapshots.

Share checklist opens the iPhone share sheet with a text copy of that checklist's title, property, current tasks and check marks. It excludes earlier completed runs and your ledger. You choose the destination and recipient. That app handles the copy under its own privacy practices. Changes do not sync back and sent copies cannot be recalled by doorledge.

Supply reminders use Apple's local notifications with your permission. The notification says it is time to check supplies without naming the item or property. No push server or inventory tracking service is used.

Backups you save

Settings → Backup & restore lets you save a complete local backup to Files. It includes original receipts, extracted text, records, property setup, calendar links, helper contact details, private team links and scheduled visits. Account passwords, sign-in tokens, Apple purchases and the app lock are not included. Keep this file private. The storage provider you choose handles the file under its own terms.

A records export is a separate file for reading or sharing. A records export and the team service do not replace a complete backup of your app data and receipt originals.

What the team connection sends

doorledge uses Sign in with Apple inside the iPhone app. Apple provides an identity identifier and the email address you choose to share, which may be a private relay address. Supabase Authentication handles the doorledge account and sign-in session. Your Apple password is not shared with doorledge. Earlier email-based accounts remain associated with their existing identity.

Creating a team link sends the helper’s name, the property display name, role and language, together with identifiers used to route submissions to your account. The helper sends a work date, duration, optional note and optional photo. The service records receipt and delivery status so a retry can be handled without adding a duplicate.

We verify Apple-signed purchase information, including product and transaction identifiers, purchase status and renewal or expiry dates, to check connected access. We do not receive your payment-card details.

Team links and photos

A team link includes a member’s name, role, selected property and language. Anyone with that private link can see the member and property name and submit a work date, duration, notes and one photo. It does not expose the host’s financial ledger. New links remain open until you replace or close them. Links created in earlier versions may still have an expiry date.

The form keeps an unfinished draft, including a resized photo, in that browser tab’s session storage so an interrupted submission can be retried. It clears the draft after a confirmed submission; closing the tab also ends that session. The form asks the sender to agree before submitting and does not request GPS. Images are resized and embedded image metadata is removed. The host receives submissions as drafts and may download a photo to the iPhone. Receiving a draft marks it delivered; it does not immediately erase its work details from the service.

Server photos are available to the host for 30 days after submission. The host needs to open doorledge online and receive the photo within that time to save a copy on the iPhone. Routine cleanup deletes server photos after 30 days, including interrupted uploads. A downloaded copy remains on the host’s phone until the host removes it and can be included in a backup or records export. Closing a link stops new submissions; it does not erase earlier work records.

Reports you share with AI

Share a report with AI uses the private snapshot service described below. Choose the period and property, review the selected records and confirm before a copy is uploaded. This flow excludes original receipt files. Sharing the link or its downloaded CSV sends the selected information to your assistant provider under its own terms. Where supported, the connector reads only that report from the connected owner’s account with a valid private link, not the live ledger. Closing the link stops future access but cannot recall copies already received.

Copies you share with an accountant

In Export → Share with accountant, choose a period and property, preview the selected confirmed records and decide whether to include originals. Publishing sends the selected property names, vendors or people recorded, amounts, rental and personal allocations, categories, mileage, hours, dates, notes, attribution and record identifiers to our service. Original receipts are included only when you select that option.

Original files are preserved, including embedded metadata and any personal purchases, addresses or other information visible on them. Selecting one property does not crop or redact its full receipt. Check the preview and share only information you have permission to disclose.

Anyone holding the private link can read and download the snapshot without an account. It shows the dated copy you published; later edits on the iPhone do not change it. Helpers cannot access it through their team links. The reader removes the private token from the address bar and keeps it in that browser tab’s session storage. Record responses are not browser-cached; downloaded copies remain with the recipient.

A link expires after 90 days or when you close it in Export → Manage shared links. Closing it prevents new access. An original download already opened can finish for up to 60 seconds, and previously downloaded copies cannot be recalled. You can close existing links after your paid access ends.

Closed or expired snapshot contents are removed by routine cleanup, normally within 12 hours. Unfinished uploads expire after 24 hours and are then cleaned up. An upload already in progress may finish after closure and be removed on a later cleanup pass. Minimal link metadata remains for account management until the account is deleted. Provider backups may retain deleted information temporarily under their backup schedules.

Optional company names and fees

A host can include a team member’s company name when preparing a private work link. A team member can submit an optional total fee with their work details. These details pass through the existing private team service. The fee becomes an expense draft for the host to review; submitting it does not collect payment or establish that payment was made.

Forwarded emails and AI assistants

In version 1.3, Records → Email receipts gives you a private forward-to address. Earlier test builds place this under Settings → Forward & connect. When you forward an email to it, our service receives the message through our email provider and keeps its readable text, subject and any PDF, JPEG or PNG attachments as one draft for your account. Other attachments are not kept. Receipt details are read on your iPhone, not by our service. Forwarded message text and attachments may contain sender addresses or other personal details. These remain part of the original you choose to forward.

If you connect an AI assistant such as Claude, ChatGPT, Gemini or Meta Muse, you approve it on doorledge’s connection screen. It can then add expense, income or service-date note drafts, with receipt files and source text you or it provide, and see the property names you choose to share. It can’t read, change or delete your saved financial records through doorledge. In compatible versions, you can separately share a property schedule: planned visit days and cached booking spans for the next 180 days. No guest names, calendar links, visit notes or financial details are included. The copy updates while you use the app; assistants cannot read it after 24 hours without a refresh. It is retained until replaced, sharing is turned off, the property is unshared or your account is deleted. Schedule sharing is off by default and can be removed independently for each property. We record the assistant’s name, when you approved it and when it was last used. The assistant’s own provider handles what you share with it under its own terms.

Forwarded email text, assistant-supplied source text and files are removed from our service when your iPhone receives the draft, and otherwise after 30 days. Structured draft details and delivery status remain in your connected account to prevent duplicate deliveries until the account is deleted. Source text supplied by an assistant is labeled as a copy, not a verified original receipt. Suggested service dates do not create calendar visits or payments automatically. Replacing your forward-to address stops the old one right away. Disconnect an assistant from your account page or the assistant’s settings.

An “Approve with my iPhone” code signs a browser in to your account for connecting an assistant. It works once, for 10 minutes, and only in the browser that asked for it.

Feedback and support

You can email support@doorledge.com with something you like, an improvement or a problem. Your sending email address and any content you choose to include are routed by Resend to our Gmail support inbox, operated by Google, so we can respond, investigate problems and improve the app.

In app versions with Settings → Share feedback, your unfinished message and selected feedback type stay on your iPhone until you clear the draft. Review email opens a message with your text, app version and iOS version. You decide whether to send it in your email app. No ledger records, receipt files or account identifiers are attached automatically.

Our support team uses AI-assisted tools to organize feedback and help investigate problems. Your message and email address may be processed by third-party AI service providers for these support tasks. Replies and app changes are reviewed before they are sent or released. We do not use feedback for advertising. Your email provider's privacy practices also apply. Clearing a local draft does not delete a sent email. Contact the support address to request deletion of feedback we hold.

Services we use

We use these providers to run the connected service:

• Supabase handles account sign-in, team links and submissions, purchase verification records, historical connected data and private team-photo and snapshot storage.
• Vercel serves the website and connection endpoints.
• Resend handles service emails, including account-deletion confirmation, and routes messages sent to our support address.
• Short-lived request counters are stored in the existing Supabase database using hashed identifiers. Routine cleanup removes counters older than two days.
• Sentry receives limited technical error reports from the web service. Request bodies, cookies, user details, breadcrumbs and variable error messages are removed. We do not record browser sessions.

Providers may process IP addresses, request times and other technical information needed to operate and protect the service. Apple handles app purchases. We do not sell your records or use them for advertising tracking.

App Store campaign links

Some ads and website download buttons include an Apple campaign label. It identifies a marketing campaign, not an individual visitor. Apple uses these links to report campaign results, such as downloads, subject to its reporting thresholds and privacy practices.

For visitors arriving through a labeled ad, our website carries that campaign label into its App Store buttons. This uses the page address without storing an advertising cookie or sending rental records. It does not add an advertising or analytics SDK to the iPhone app. Read about Apple’s App Store privacy practices.

Keeping and removing data

Helper work details and delivery records remain on the service after receipt on the phone. They are removed when the connected account is deleted. Closing a link stops new submissions; deleting a local record does not delete the service’s submission. Team-photo retention is described above. Provider backups may retain deleted information temporarily under their backup schedules.

You can export saved local records, disconnect the phone, close team or accountant links, or delete your connected account from the app. The website deletion page remains available for existing email-based accounts. Deletion includes the shared doorledge identity and historical web-service data attached to it. Local iPhone records remain until you remove them locally. Deleting an account does not cancel an Apple subscription.

We may retain information needed to meet legal obligations or resolve a billing or security issue. If this prevents us from fulfilling a deletion request, we will explain what remains and why.

Data from earlier connected versions

Earlier connected versions sent a shared copy of structured records: property names and measurements, vendors, amounts, rental and personal allocations, categories, dates, mileage, hours and notes. They also recorded sync times. Receipt originals and extracted receipt text were not part of that upload.

Updating to the new version stops automatic host-ledger uploads; it does not automatically erase historical cloud records. Those records remain associated with the original account and are included when that connected account is deleted. Local records stay on the iPhone.

Questions and requests

Contact support@doorledge.com to request access, correction, export or deletion of connected information, or to ask about privacy. Depending on where you live, you may have additional rights to object to processing, restrict it or contact your local data-protection authority.

doorledge is intended for adults managing rental records, not children. If a child’s personal information has been submitted, contact us so we can review and remove it.

We will update the date on this page when the policy changes. Material changes to connected data use will be explained in the app or account flow before they take effect.