Website, demo and installation notice privacy

The public website

The marketing pages serve their fonts, images and scripts locally and contain no analytics or advertising trackers. The contact link on the funding page opens your own email client to send a message to [email protected]; the site does not submit or store anything. External links and email services have their own privacy practices.

The shared public demo

The demo is one shared installation with a public account. Visitors can complete the actual installer and explore the same sample records. Other visitors may see information entered there. Use fictional sample data only: never enter customer details, private credentials or real financial records.

The demo uses necessary session cookies. At each scheduled UTC hour, it resets the database and removes server-side PHP sessions, returning to the uninstalled state. Existing sessions expire with that generation. Resets can briefly interrupt access, and outages can delay cleanup. Database fields shown in the installer contain clearly labelled dummy values; actual hosting credentials stay on the server. This demo does not send visitor IP addresses to an IP-geolocation service.

Installation notices

Every PHP Ledger installation from 1.4.5 sends an anonymous technical notice when setup completes, when an administrator checks for updates and when registration details change; earlier releases offered it as a default that could be switched off, and an installation upgraded from one of them sends its first notice on its next update check. There is no switch for the anonymous notice. Named registration is off unless explicitly selected and can be removed at any time under Updates and privacy. An unavailable receiving service does not restrict installation, updates or accounting.

A notice contains a schema number, random installation identifier, event (installation, update check or preference change), application version and release channel, PHP version, database engine and version, operating-system family, deployment mode and timestamp. It contains no journals, balances, customers, database credentials or anonymous installation URL. The stable identifier is pseudonymous and allows the latest notice to replace the previous one.

If you explicitly register, the notice also contains the name and email you provide and, optionally, your website and company. Registration records are private, with no public named directory. Removing the registration sends an anonymous notice that replaces the named record; it does not itself send a deletion request.

Notice retention and abuse protection

The receiving service retains only the latest notice for each installation for 90 days after receipt. Hourly maintenance removes expired records; outages can delay deletion. It transiently uses the connecting IP address for rate limits, storing a daily keyed hash rather than the raw IP. Rate metadata expires after 48 hours. Private operator summaries contain aggregate technical counts, not names, emails or installation identifiers. These are self-reported statistics, not verified deployment counts.

Operational logs

The notice receiver and its internal gateway disable access and error logs. The public web host can separately log IP addresses, paths, timestamps, browser information and errors. Hosting logs and any operational backups are operator-managed; a fixed retention period has not been established in the application configuration. Hourly demo resets remove demo database records and server sessions, but do not promise deletion from hosting logs, email or backups. Avoid personal information in URLs.

Your own installation

Self-hosted accounting records remain on the operator's infrastructure. That operator controls access, backups, hosting logs and retention. This notice does not replace their privacy notice. Installation notices are separate from those accounting records.

Contact and deletion

For a confidential privacy question or a request to delete an installation notice sooner, use the private contact route in the security policy. Provide the installation identifier privately if available so the operator can locate the notice. Do not include passwords or financial records, and do not post personal registration information in a public GitHub issue.