What data does LADLE store about me?

Six things. That's the whole list of what LADLE keeps in our own systems (separate from what Anthropic sees during inference, which we cover in the training-data article).

**1. Your email address**. Required for account access, billing notifications, and the WFP receipt cadence. Stored as-provided.

**2. A bcrypt hash of your password**. We never see the plaintext password itself; only the one-way hash. If our database were breached, the passwords would still be protected.

**3. Your Stripe customer ID**. A pointer to your billing information at Stripe. We never see your card number — Stripe does. If you deleted your account, the Stripe customer ID is deleted with it and Stripe's own retention applies to the payment record separately.

**4. Your chat history**. Server-side encrypted at rest. Includes your prompts, the assistant responses, any files you attached, and the metadata about which project or chat container they belong to.

**5. Your personal meal ledger**. The record of your subscription's contribution to each month's donation batch. Includes the meal count, the reference number, and the date. This is not sensitive but is stored for the My Table screen and for your own records.

**6. A minimal audit log**. Login events, subscription changes, chat deletion events. Retained 90 days. Used only for security and compliance.

We do not store: phone number, physical address, birthday, gender, employer, IP address geolocation, device fingerprint, third-party analytics events, marketing pixel events, A/B test bucket assignments. We don't have those fields because we don't collect them.