Last updated: September 2026
LineLedger ("the app") is built for journeyman linemen to track employers, hours, per diem, credentials, and benefit-fund statements, and to check pay and fund contributions against a labor agreement. This policy explains what the app does with your information.
There is no sign-in and no user account. We do not run a server that holds your data, we do not know who you are, and we cannot look up your information.
Everything you enter — employers, labor agreements, logged hours, pay documents, benefit-fund statements, fund rules, credentials, and chat history — is stored only on your device, in app storage protected by iOS Data Protection and encrypted at rest while your phone is locked.
The photo or PDF of a benefit statement you add is kept on your device and is never uploaded. When the app reads a statement, the text is pulled off it on your phone first; only that text is ever sent anywhere, and only if you agree to it.
API keys you enter for your own model provider are stored in the iOS Keychain.
Your saved credentials (CPR card, DOT physical, dues receipt, and any photos of them) are kept in the app's on-device database, behind the app's Face ID lock if you enable it, and are never sent off the device.
The app sends data off your device only when you ask it to — when you run a pay analysis, ask a question about your agreement, read a benefit statement, or read the benefit-fund rules off your agreement. Nothing is sent in the background, and each of those four asks a separate time.
Where it goes depends on the model you pick in Settings → Analysis Brain:
Each job sends only what that job needs, and they are not the same. Before anything goes out, the app shows you a screen naming exactly what is about to leave the phone, and offers the on-device model instead.
A pay analysis, or a chat question about your agreement, sends:
Reading a benefit statement sends that one statement's text, and nothing else. The scan itself stays on your phone; what goes out is the text read off it, which is whatever the fund printed — the fund's name (NEAP, NEBF, Lineco, an HRA, or a local fund), the period it covers, hours reported, contributions received, any beginning or ending balance, investment change and fees, and the contributions table: each employer name and dollar amount as printed. Your hours, your pay, your tax details, and your agreement are not sent for this.
Reading fund rules sends the benefit sections of your agreement — the parts about NEAP, NEBF, Lineco and the other funds, so the app can read the contribution rates your employer owes. Not the whole contract, and none of your hours or pay.
Fund balances and contribution amounts are money information about you, so they are declared on the App Store privacy label. Nothing about your health is sent: a Lineco or HRA statement is read for hours and dollars only, and the app never asks for or transmits medical or claims information.
Your IBEW local is included with a pay analysis or chat so it can tell which agreement applies. Union membership counts as sensitive information, so it is declared on the App Store privacy label even though it is never linked to your identity.
We do not send your name, email address, phone number, or device identifiers, and because there is no account, a request cannot be tied back to you.
When you dictate notes, speech recognition runs on your device wherever the device supports it. On older hardware that cannot do it locally, iOS sends the audio to Apple to transcribe. That is Apple's service, not ours — we never receive the audio, only the text you keep. If you would rather no audio ever left the phone, type your notes instead.
Our proxy passes requests through and keeps nothing on disk — it does not store your contract, pay, or benefit-fund data. Anthropic processes the request as our service provider under its own API terms. If you use your own API key, retention is between you and that provider.
Delete any employer, document, credential, benefit statement, or pay period at any time inside the app. Deleting the app removes everything it stored on your device. Choosing Apple On-Device in Settings stops the app from sending anything off your phone at all.
LineLedger is an informational tool and can make mistakes. It is not legal advice. Always verify important pay, contract, and benefit-fund questions with your local union hall or business rep before acting on them.
Questions about this policy: mike.v.moore@protonmail.com