1. Plain-English summary
The short version. We collect your bookkeeping data (transactions, classifications, business name, contact info) so we can run the product. We store it in Canada. We don't sell it. We share it only with the narrow list of sub-processors required to run the product (hosting and database). You can export everything or delete everything by emailing privacy@loonieledgr.ca.
2. Who we are
LoonieLedgr is operated as a sole proprietorship based in Vancouver, British Columbia, Canada. We are the data controller for the personal information described in this policy.
For privacy questions, or to reach the individual accountable for privacy compliance: privacy@loonieledgr.ca.
3. What we collect
3.1 Information you provide directly
- Account info: name, email, password (hashed), phone number (optional, for 2FA only)
- Business info: legal business name, GST/HST number, business address
3.2 Information you authorize us to fetch on your behalf
- Platform earnings data from YouTube and Patreon, read-only, and only for the accounts you explicitly connect and the scopes you explicitly grant
- Transaction data from CSV or spreadsheet files you upload yourself
3.3 Information we collect automatically
- Log data (IP address, browser, OS, pages visited within the app)
- Performance metrics (page load times, error reports — never including the content of your books)
4. How we use it
- Run the product. Classify your transactions, prepare your tax forms, send you alerts.
- Improve the product. Aggregated, anonymized analytics on which features get used. We never train any ML model on identifiable customer data without explicit opt-in consent.
- Communicate with you. Transactional emails (receipts, security alerts, deadline reminders). You can opt out of optional marketing emails at any time; you cannot opt out of essential service emails while you have an active account.
- Comply with law. CRA s.230 record retention. PIPEDA breach reporting. Quebec Law 25 requirements.
5. Sharing and sub-processors
We do not sell your data. We do not share your data with advertisers. We rely on the following sub-processors to operate the product. Each publishes its own data processing terms, which we have accepted:
- Supabase (Canada Central region, running on AWS
ca-central-1) — database, authentication, and server-side functions. Your bookkeeping data lives here.
- Cloudflare — DNS and static site hosting. Cloudflare serves the pages and scripts that make up the site; it does not store your bookkeeping data.
We will share your data without your consent only when required by law (e.g., a valid CRA records request under s.231, a court order, or to prevent imminent harm). We will notify you of any such disclosure unless we are legally prohibited from doing so.
5.1 Sharing with your accountant
If you grant your CPA access to your books through the accountant portal, you authorize us to share all your bookkeeping data with them for the purpose of tax preparation. You can revoke this access at any time from your settings. The CPA is bound by their professional code of conduct (CPA Code of Professional Conduct) regardless of any agreement with us.
6. Retention
We retain your data for as long as your account is active, plus a 6-year period after cancellation to comply with CRA record-keeping requirements under s. 230 of the Income Tax Act. After 6 years, we permanently delete your data unless you have explicitly requested longer archival.
You may request immediate deletion before the 6-year retention period ends; we will comply within 30 days, subject to legal obligations that may require retention (e.g., an open CRA audit).
7. Your rights
Under PIPEDA (federal) and Law 25 (Quebec, if applicable to you), you have the right to:
- Access your data — download a complete export at any time from your settings.
- Correct inaccurate data — edit directly in the product, or email us if a system field is incorrect.
- Delete your data — see retention above.
- Withdraw consent — disconnect any integration or close your account.
- Object to specific processing — email privacy@loonieledgr.ca.
- Lodge a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.
8. Cookies and analytics
We use a small number of strictly-necessary cookies: session identifier, 2FA state, theme preference. No advertising cookies. No third-party tracking pixels.
We do not currently run any third-party analytics or tracking service. If we add one, it will be a privacy-focused, cookie-free provider, and this policy will be updated before it goes live.
9. Children
LoonieLedgr is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, contact us and we'll delete the account.
10. International data transfers
Your bookkeeping data is stored and processed in Canada, in Supabase's Canada Central region (AWS ca-central-1).
Two honest qualifications. First, the static files that make up this website are distributed through Cloudflare's global content delivery network, so the pages themselves may be served from a server outside Canada — those files contain no personal data. Second, when you connect a platform such as YouTube or Patreon, the request necessarily travels to that platform's own servers, which are outside Canada and governed by that platform's privacy policy.
11. Google & YouTube user data
If you connect your YouTube channel, LoonieLedgr uses Google's YouTube Analytics API to read your channel's estimated revenue reports (read-only). We use this data for one purpose: displaying your own earnings inside your own LoonieLedgr account for bookkeeping and tax-estimation. We do not sell it, use it for advertising, or share it with anyone except as this policy describes (for example, an accountant you have invited).
LoonieLedgr's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Because this feature uses YouTube API Services, by connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
You can disconnect at any time from your LoonieLedgr Connections page, and you can also revoke LoonieLedgr's access directly in your Google account at myaccount.google.com/permissions. When you disconnect, we stop syncing and delete the stored access credentials; previously imported figures remain in your books until you delete them (see Retention, section 6).
12. Changes to this policy
If we materially change this policy, we'll email you 30 days in advance. Minor edits (typos, clarifications) we'll just publish. The "last updated" date below always reflects the most recent change.
Questions, complaints, or data requests:
- Email: privacy@loonieledgr.ca
- Post: available on request by email — we are a small operation and do not publish a street address.
Last updated July 28, 2026.