Privacy

What this is

The Bookman is a private bookkeeping application used by three Canadian corporations — rali Apparel Inc., If Not Now Then When Inc., and 16699987 Canada Inc. It is not a public service and there is no sign-up. An account exists only because an administrator created it, and it can reach only the companies it has been granted access to.

What it stores

• People. Your name, your email address, and a cryptographic hash of your password. The password itself is never stored and cannot be recovered from the hash.
• The books. The financial records of those companies — transactions, bank statements, categories, and the notes people write against them.
• Expense claims and receipts. What somebody spent on a company’s behalf, and the photograph or PDF of the receipt.
• An audit trail. Who changed what, and when. This is kept deliberately: these are corporate books, and the record of how a figure got there matters as much as the figure.

Data is held in a Postgres database hosted by Neon in the United States, and the application runs on Vercel. Receipt files are held in Google Drive, in an account belonging to the company’s own administrator.

The Google Drive connection

An administrator may connect a company to Google Drive so that receipts can be uploaded from a phone. This is what that connection can and cannot do.

• The only permission requested is https://www.googleapis.com/auth/drive.file. It grants access to only the files this application itself creates.
• It cannot read, list, download or modify anything else in your Google Drive — not documents, not photos, not files that were already there, and not files in the same folder that it did not create.
• On connecting, the application creates one folder for that company and uploads receipts into it. You may move or rename that folder freely.
• It also reads your Google account’s email address, and does so for one reason: so the settings screen can tell you whose Drive the receipts are going to.
• A Google refresh token is stored so uploads keep working. It is encrypted at rest with a key held outside the database, and it is never shown in the application, sent to a browser, or written to a log.
• Disconnecting revokes the application’s access. It deletes nothing: your files stay in your Drive. You can also revoke access yourself at any time at myaccount.google.com/permissions.

The Bookman’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide the receipt-storage feature described above. It is not sold, not transferred to third parties except as needed to provide that feature, not used for advertising, and not read by any human except the people within the company who are already entitled to see that company’s books.

Who can see what

Access is granted per company. A person with access to one corporation cannot reach another’s records — not by changing a web address, and not by guessing an identifier. Within a company, expense claims and their receipts are visible to everyone who has access to that company’s books; that is deliberate, so the same cost is not claimed or paid twice.

How long it is kept

Financial records are kept for as long as Canadian tax law requires them to be available, which is generally six years from the end of the tax year they relate to. Transactions are never permanently deleted; removing one marks it as removed and keeps the record. If your access is revoked, your name and email remain on the entries you made, because the audit trail would otherwise be incomplete.

No third-party tracking

There is no analytics, no advertising, and no tracking of any kind. The only cookie set is the one that keeps you signed in.

Getting in touch

To ask what is held about you, to correct it, or to ask for it to be deleted, write to theshanthads@gmail.com.