Privacy Policy

Last updated October 18, 2026

1. Overview and scope

This Privacy Policy explains what information Local Foundry Inc. (“LineLedger,” “we,” “us”) collects when you visit our websites at lineledger.ca, lineledger.com and lineledger.co.uk (the “Site”), how we use and share it, and the choices and rights you have. LineLedger is operated from British Columbia, Canada.

The short version: we don’t have your books. LineLedger is open source software you install and run on your own infrastructure. There is no hosted service, no account, and no login. Your ledgers, invoices, contacts, payroll records, and documents live on your server and never reach us — we have no copy of them and no way to obtain one.

This Policy therefore covers only the limited information this marketing Site collects: a message if you write to us, a post if you use the feature-request board, and aggregate analytics about page visits. Section 9 explains what this means for the data inside your own install.

2. Information we collect

We collect the following, and nothing else:

  • Messages you send us. If you use the contact form or email us, we receive your name, email address, and whatever you write. If you use the feature-request board, we receive your post and the email address you attach to it.
  • Usage and device data. IP address, browser and device type, operating system, pages visited, timestamps, and referrer — collected to operate and secure the Site.
  • Cookies and similar technologies. See section 4.

We do not collect account information, billing information, payment details, or any accounting data, because there is nothing on this Site to create an account for, nothing to buy, and nowhere to keep books.

3. How we use information

We use the information we collect to:

  • Reply to your messages and support questions.
  • Operate, maintain, and improve the Site and its documentation.
  • Detect, investigate, and prevent abuse and security incidents (including the bot check on our forms).
  • Analyze traffic in aggregate to understand which pages are useful and prioritize what to write next.
  • Comply with legal obligations and enforce our Terms.

Where Canadian privacy law applies, we rely on a combination of your consent (express or implied), performance of our contract with you, and our legitimate interests in operating the Site securely and lawfully.

4. Cookies and analytics

This Site uses Google Analytics to understand aggregate visitor traffic — for example which pages are most visited. Google Analytics sets its own cookies and processes data under Google’s terms. We do not use it to serve advertising.

The LineLedger application ships no third-party analytics at all. Your install does not report usage to us, to Google, or to anyone else. It has no telemetry, does not check in with a license server, and works fully offline on a private network.

Region preference. This Site sets a first-party cookie named ll_region, kept for one year, to remember which regional site you chose (lineledger.ca, lineledger.com or lineledger.co.uk) so we do not ask again. It stores only the value ca, us or gb — no identifier, no personal information — and it is not used for analytics, profiling, or advertising. We never redirect you automatically on the basis of it: we only offer the other site, and you can decline. If you clear the cookie, we simply ask again.

Bot protection. Our forms use Cloudflare Turnstile to distinguish people from automated submissions. It processes connection metadata and sets no advertising cookies.

You can block or delete cookies through your browser settings. We treat Global Privacy Control (“GPC”) signals as a valid opt-out request where required by applicable law.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below:

  • Service providers. A small set of third parties operate this Site — our Canadian cloud host, Cloudflare (content delivery, security, and Turnstile), our transactional email provider, and Google Analytics. Each is bound by confidentiality and data-protection obligations and may use the information only to provide services to us. We maintain a current, named list on our Sub-processors page.
  • Legal compliance and safety. We may disclose information if we believe in good faith that disclosure is required by law (for example, in response to a valid subpoena or court order) or is necessary to protect the rights, property, or safety of LineLedger, our users, or the public. Note that this can only ever reach the Site information described in section 2 — a legal demand for your accounting records would find nothing here to produce.
  • Business transfers. If LineLedger is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or material change in how your information is handled.
  • With your consent. We will share information for any other purpose only with your consent.

6. International data transfers

This Site is hosted in Canada (Ontario). Some providers that support it — Cloudflare’s global network, our email provider, and Google Analytics — may process limited information in the United States or other countries.

Where information is processed outside your jurisdiction, the laws governing data protection may differ from those at home. We use contractual and technical safeguards designed to provide a comparable level of protection consistent with applicable privacy law, including Canada’s federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), and, for transfers of data subject to it, standard contractual clauses.

7. Data retention

We keep contact-form messages and email correspondence for as long as needed to handle your enquiry and for a reasonable period afterwards for reference, then delete them. Feature-request posts remain on the board until you ask us to remove them. Analytics data is retained under Google Analytics’ configured retention window.

8. Security

We use reasonable technical and organizational measures to protect the information described in section 2, including encryption in transit (TLS), access controls, and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the appropriate regulators (such as the Office of the Privacy Commissioner of Canada) as required by applicable law.

Security of your install is a separate matter, and it is yours — see our Security page for what the software provides and what you are responsible for.

9. Your own install

The data inside your LineLedger instance is not covered by this Policy, because we never see it. You are the controller of that data. If you keep records about employees, contractors, customers, or donors — and an accounting system inevitably does — you are responsible for your own privacy obligations toward those people, including your own privacy notice, retention schedule, security safeguards, and breach-notification duties.

That includes sensitive information the software can store, such as tax identification numbers (SIN, SSN, EIN, or business numbers), payroll details, and bank-account information. We are not a processor of any of it and cannot answer access or deletion requests about it — those come to you.

If you connect optional AI features, or a payment processor so your customers can pay your invoices, those integrations use your credentials under your agreements with those providers, and the data flows directly from your server to them.

10. Children

The Site is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Your privacy rights — Canada

If you are in Canada, you have rights under PIPEDA and, depending on your province, the BC Personal Information Protection Act (“BC PIPA”), Alberta PIPA, or Quebec’s Act respecting the protection of personal information in the private sector (commonly called Law 25). These rights include:

  • Access. You can ask what personal information we hold about you.
  • Correction. You can ask us to correct inaccurate or incomplete information.
  • Withdrawal of consent. You can withdraw consent to our processing, subject to legal or contractual restrictions.
  • Complaint. You can complain to the Office of the Privacy Commissioner of Canada or to your provincial regulator (for example, the Office of the Information and Privacy Commissioner for BC).

Quebec residents have additional rights, including the right to data portability and the right to be informed of any decision based exclusively on automated processing that produces legal effects. We do not use automated decision-making with legal effects on individuals.

12. Your privacy rights — United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you the following rights over personal information we hold about you:

  • Access. You can ask for a copy of the personal information we hold about you (a subject access request), free of charge, normally within one month.
  • Rectification. You can ask us to correct information that is inaccurate or incomplete.
  • Erasure. You can ask us to delete personal information where we no longer need it or where you withdraw the consent we relied on.
  • Restriction and objection. You can ask us to pause processing, or object to processing we carry out on the basis of legitimate interests — including the website analytics described above.
  • Portability. You can ask for the information you gave us in a structured, commonly used, machine-readable form.
  • Withdraw consent. Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.

Our lawful bases are your consent (for analytics cookies) and our legitimate interests (answering a message you send us, and keeping the Site secure). We are not established in the UK, and because our processing is occasional, low-risk and involves no special-category data at scale, we have not appointed a UK representative under Article 27; you can reach us directly at the address in section 15.

Complaints. You can complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk. We would appreciate the chance to resolve it first.

13. Your privacy rights — United States

If you are a resident of California, the California Consumer Privacy Act, as amended by the CPRA (“CCPA”), gives you the following rights:

  • Right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
  • Right to delete personal information we have collected from you, subject to certain exceptions.
  • Right to correct inaccurate personal information.
  • Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. As stated above, we do neither.
  • Right to limit the use of sensitive personal information. We do not collect sensitive personal information through this Site.
  • Right to non-discrimination for exercising any of these rights.

Categories of personal information we have collected in the past 12 months, by CCPA category, are limited to: identifiers (name, email, IP address), internet or network activity (logs, pages visited), geolocation inferred from IP, and the contents of messages you choose to send us. We collect this from you directly and from your interactions with the Site.

You may use an authorized agent to submit a request on your behalf. We will verify requests using information we already have.

If you are a resident of another US state with a comprehensive privacy law — for example Virginia, Colorado, Connecticut, Utah, or Texas — you have similar rights and can exercise them through the same contact below.

We do not respond to browser “Do Not Track” signals because no consistent industry standard exists, but we honor Global Privacy Control signals where required by applicable law.

14. How to exercise your rights

To exercise any of the rights above, email hello@lineledger.ca or hello@lineledger.com with the subject line “Privacy request” and tell us what you would like us to do. We will respond within the timelines required by applicable law (generally 30 days for PIPEDA requests and 45 days for CCPA requests, extendable as permitted by law). We may need to verify your identity before acting on your request.

Requests about data held in your own LineLedger install should go to whoever operates that install — see section 9.

15. Changes to this policy

We may update this Policy from time to time. When we do, we will post the revised Policy here and update the “Last updated” date above.

16. Contact

Questions, concerns, or privacy requests? Our Privacy Officer can be reached at hello@lineledger.ca or hello@lineledger.com, or write to us at:

Local Foundry Inc.
205 – 50 Lonsdale Ave
Office #2404
North Vancouver, BC V7M 2E6
Canada