What we hold, and what happens to it

What is collected

Four things, and nothing gathered in the background.

• Your account. An email address and a password, which is stored as a hash and never in a readable form. Sign-up records which page you arrived from — the landing, a calculator, the guide, or nothing — so we can tell which doors people use.
• The books you keep. Everything you record: expenses, invoices, mileage and trips, vehicles, assets, bank transactions, sales tax figures, the corporation’s province and fiscal year end, and the names of the people and companies you enter on a record because the CRA rule asks who was there.
• The files you upload. Receipt photos and PDFs, and bank statement files — the CSV or the bank’s own PDF — kept as the documentary evidence behind the numbers.
• Product events. A short, fixed list of counters: a calculator page was viewed, a calculation was run, a result was copied, a guide page was viewed, a sign-up started or finished, a first expense was saved. Each row is a name, a timestamp, and a value from a closed list. There is no visitor ID, no session ID, no IP address, no user agent and no user ID on those rows, so an event cannot be traced back to a person or a visit. There is nothing that captures on its own and therefore nothing to turn off.

IP addresses are used, in memory only, to count requests per visitor so that one client cannot exhaust the service for everyone. They are not written to a database and are not kept.

Where it is kept

Records go into a PostgreSQL database. Receipts, statement files and generated exports go into private S3-compatible object storage, which is never public: a browser reaches a file through a signed link that expires in minutes, and the file bytes never pass through the API.

The servers those run on are in British Columbia, Canada. That is where your books and receipts are today; if it ever changes, this page changes with it, and the date at the top is how you can tell.

LedgerLodge is also self-hostable — the whole stack runs from a docker compose file with billing switched off, no telemetry and no licence check — so an owner who wants the data on their own machine can put it there. Left unconfigured, it makes one kind of outbound call: to the Bank of Canada, when you enter a foreign-currency amount and it does not already hold that day’s rate. The AI provider is called only when a model key is set, and mail and Google or Apple sign-in reach their providers only once you configure them.

Who else can see it

Four services, each doing one job. None of them receives your books as a whole.

• Payments — Stripe, Apple and RevenueCat. On the web, a purchase goes through Stripe Checkout; on iPhone, through Apple’s in-app purchase. RevenueCat joins the two into a single record of what you are entitled to. Card details are entered on Stripe’s or Apple’s own page and never reach LedgerLodge: all that is stored here is your account identifier, which plan you are on and when it renews. No card is taken for the trial, because the trial does not charge.
• Email — Resend, or an SMTP provider where the deployment is configured that way. Four messages exist: verify your address, your trial ends in seven days, your trial has ended, and an export is ready. The export message never contains the file or a link to it — you sign in to fetch it.
• AI capture — OpenAI, described in the next section.
• Bank of Canada, for published exchange rates. It is asked for a rate on a date; it is told nothing about you.

What the AI is shown

AI capture is part of the Complete plan and of the trial, and the model behind it is OpenAI’s. It is optional in the strongest sense: on the Manual plan, and on any install with no model key configured, nothing is ever sent to OpenAI.

• A receipt you photograph is sent to OpenAI as an image. A temporary, downscaled copy is made for the request; the copy is never stored on our side, and the original stays the evidence on your record.
• A bank statement is sent as text. The PDF is read on our side and only the extracted lines go to OpenAI — the file itself does not leave the storage it was uploaded to.
• A sentence you type is sent as you typed it, in whatever language you wrote it in.

What OpenAI does with it

OpenAI’s API documentation, read on 15 September 2026, says that data sent to the API is not used to train or improve its models unless the customer opts in — we have not — and that abuse-monitoring logs, which contain the prompts and responses themselves, are kept for up to 30 days unless a law requires longer. It is published at developers.openai.com/api/docs/guides/your-data.

On top of those logs, a request can ask OpenAI not to store it at all, and every request we send asks that — bank statement extraction and receipt and sentence capture alike. A receipt image, a described expense and an extracted statement line are each sent with storage switched off, so none of them is kept as a stored request.

That setting does not reach the abuse-monitoring logs described above. Those are OpenAI’s own retention — up to 30 days of prompts and responses — and asking not to store a request does not remove it from them.

OpenAI offers a zero-data-retention arrangement that removes customer content from those abuse-monitoring logs. It has to be applied for and approved, and we are not claiming it is in place — the sentences above describe the ordinary terms, which is what applies until an arrangement of that kind is confirmed here.

The public calculators

The calculators at /tools work without an account, and the figures you type into one are never recorded. They are a real corporation’s amounts, so what is stored is that a calculation happened and which calculator it was — never the inputs and never the result.

The bank statement converter is the same: a file uploaded there is read and converted and no business record or retained object is created from it.

Cookies and browser storage

Two cookies, access_token and refresh_token. Together they are your session: they are set when you sign in and removed when you sign out, and they are the only cookies the site sets. Neither is readable by scripts, and in production both are sent only over HTTPS. The second one is sent to a single address — the one that renews your session — and to nothing else.

There is no analytics vendor, no tag manager, no session replay and no advertising pixel anywhere on the site or in the app — which is why there is no cookie banner to dismiss. Two things are kept in your own browser and never sent anywhere: your light-or-dark preference, and a marker that stops one visit being counted twice.

How long it is kept

Your books are kept while your account exists, and the reason to keep them is not ours: the CRA expects books and records to be held for six years from the end of the tax year they relate to. The product is built around that expectation rather than around a tidier retention window.

• Exports work at any time, in open formats — XLSX and CSV, and ZIP packages carrying the receipt files themselves with a SHA-256 manifest.
• The trial ending does not lock your records. The account becomes read-only until you pick a plan: everything you recorded is still there to read and every export still works. The one exception is finalizing a year-end CPA package, because finalizing writes to the books rather than reading them.
• A generated export file is held for seven days, then removed. The records it was made from are untouched — you can make another.
• Deleting a record deletes its receipts with it. That is immediate and cannot be undone, so export before you tidy.

Getting it back, and having it removed

Getting it back needs nobody’s help: sign in and export. That works on any plan, during the trial, and after the trial has ended.

Removing it is not yet a button. Deleting your account and everything in it is done by asking us — write from the email address the account is registered to, using the contact details at the end of this page. In-app deletion is being built and this page will say so plainly when it lands. Export first: deletion removes the records and the receipt files, and there is no copy to hand back afterwards.

What is never done with it

• Your records are never sold, rented, or shared for advertising.
• Your records are never used by us to train a model, and OpenAI’s API terms say the same of data sent to it — see above for what its retention does cover.
• Your books are not read for any purpose but running the service — diagnosing a fault you have reported, or a legal obligation we cannot refuse.
• The figures typed into a public calculator are not recorded at all, by anyone.

Contact, and changes to this page

LedgerLodge is operated by Bolong Tech Inc., which is the company responsible for the information described on this page. Questions about any of it, a request for a copy of what is held, or a request to delete an account go to:

When this page changes, the date at the top changes with it, so the version you are reading is the version in force. See also the terms of service.