Your book stays on your phone.

Updated 29 September 2026 for version 0.4.0. This covers the Ajo Ledger app and this website.

The short version: Ajo Ledger has no account, no server and no analytics. We never receive your group's records, so we cannot see, sell, share or lose them.

What the app stores

The names of your groups and members, members' phone numbers if you choose to add them, contribution amounts, dates, the collection order, which contributions you have marked as paid, fines, payouts and your settings. This is stored in the app's private storage on your device and nowhere else. If you set an admin PIN, only a one-way scrambled form of it is kept, in the phone's secure storage.

What we collect

Nothing. The app does not send your records to us or to anyone else. It contains no analytics, advertising or tracking code, and it works without a data connection.

Updates. When “Check when the app opens” is on in Settings, or when you tap “Check for updates”, the app asks Expo's update service (expo.dev) for newer app code and asks this website which version is current. Those requests carry the app's version number, a random installation ID that Expo's service uses to deliver the right update (it is not linked to your name, phone number or records), and the ordinary details every internet request has, such as your IP address — never your records. This website adds one to a daily count of update checks for that version; it keeps no IP address or anything else about your phone. Turn the setting off and the app only checks when you ask.

Permissions

Ajo Ledger never asks for your contacts, location, camera, microphone or photos, and you never need an account, phone number or email address to use it. Two permissions are optional, and only requested if you turn on the feature that needs them:

Notifications — for collection-day and missed-round reminders.
Alarms & reminders — lets those reminders arrive on the hour instead of up to an hour late. You turn it on yourself in the phone's settings; the app only schedules its own reminders.
Fingerprint or face unlock — to unlock the app or admin settings without typing your PIN. The phone checks your fingerprint or face itself; Ajo Ledger never sees it.

The app does not read your files. When you back up, restore, export or share, Android's own file picker or share sheet opens and you choose the file or destination. With Pro, you can add a logo to your shared cards: Android's photo picker opens, and the app receives only the one picture you choose. It keeps a small copy on your phone and never uploads it.

Money

Ajo Ledger does not handle, hold, move or process your group's money, and never asks for bank, card or wallet details. It only records what your group tells you has been paid. The one payment it knows about is your own Pro subscription, which Google Play takes (see below). If you add your payment details in Pro (a bank account or your own payment link), they stay on your phone and appear only in the reminders, summaries and statements you choose to send. Members pay you directly; the app never checks or tracks it.

Your control over your data

Because the record lives only on your device, you are in full control of it. You can edit or delete any group in the app. Uninstalling the app deletes everything it stored. We cannot recover a deleted record for you — we never had a copy.

A record leaves your phone only when you choose to send it: a statement image or reminder you share into WhatsApp, a spreadsheet export, or a backup file. It goes only to the place you pick. Reminders open WhatsApp with a message already written; you decide whether to send it.

This website

This site sets no cookies and loads no third-party scripts, fonts or trackers. To know whether our links work, it keeps daily totals of visits to the home and download pages and of downloads, by country and by the campaign tag in the link you followed (for example ?ref=whatsapp). Those totals are just numbers: no IP address, browser details or anything else that could identify you is stored. It is hosted by Cloudflare, which processes the technical information needed to deliver and protect the page — such as your IP address and browser type — under Cloudflare's privacy policy.

Ajo Ledger Pro

Ajo Ledger Pro is an optional subscription, sold through Google Play. When it is available and you subscribe, Google Play handles the payment: your card or payment details go to Google, never to us. To know whether you have Pro, the app uses RevenueCat, a subscription service. RevenueCat receives a random app user ID (made up by the app, not your name, phone number or email), your subscription status and the purchase details Google reports. It never receives your groups, members, phone numbers or any other record, and it works under RevenueCat's privacy policy. Until Pro can be bought in your version of the app, the app doesn't contact RevenueCat at all. Pro's terms are at ajo.umoh.name.ng/terms.

The Pro waitlist

If you join the Ajo Ledger Pro waitlist, we keep the email address you type, the date, the country Cloudflare reports for the visit and the campaign tag of the link you came from. We use the address for one thing: to tell you when Pro is ready. We don't share it or add it to any other list. Email ajoledger@umoh.name.ng and we'll delete it.

Children

Ajo Ledger is not directed at children and collects no personal information from anyone.

Contact

Questions about this policy or the app: ajoledger@umoh.name.ng.

Changes

If this policy changes, the new version will be posted here with a new effective date. A change that affected what leaves your device would be stated plainly in the app before it took effect.