Privacy policy

Effective August 20, 2026

Sorted (sortedbooks.app) is bookkeeping software and a bookkeeping service for e-commerce sellers, operated from Ontario, Canada. This policy explains, in plain language, what information we handle and how we protect it. It applies to the Sorted application (my.sortedbooks.app), our website, and the connections you authorize.

What we collect, and why

• Account information — your name, email address, and a password (stored only as a salted cryptographic hash; we cannot see it). Used to sign you in and control who can access which company's books.
• Your business's financial data — the documents and records needed to do your bookkeeping: supplier invoices you upload or forward by email, marketplace settlement and payout reports (for example from Amazon, Walmart, Shopify, or PayPal) retrieved with your authorization, and the accounting entries we prepare in your own QuickBooks Online company file.
• Activity records — an audit log of processing actions (who did what, when) and technical logs needed to run the service. Used for accuracy, support, and security.

We collect nothing beyond what the bookkeeping requires. We do not collect data about your customers' identities from marketplaces (no buyer names or addresses), and we do not use tracking or advertising technologies on the application.

What we never do

• We never sell your information, to anyone, for anything.
• We never share your financial data with third parties except the service providers listed below, and only so the bookkeeping itself can work.
• We never post to your accounting file automatically — entries reach your books only from an explicit action by you or your bookkeeper.

Where your data lives and how it's protected

• Data is stored in a managed database (hosted by Railway, United States region), encrypted at rest, with daily automated backups.
• All connection credentials and access tokens are additionally encrypted at the application level with a key held outside the database — a copy of the database alone is unreadable ciphertext.
• Every connection uses TLS (HTTPS) in transit.
• Access is role-based and organization-scoped: people see only the companies they've been granted, with the role they've been granted.

Service providers we rely on

These providers process data on our behalf, only as needed to run Sorted:

• Railway — application hosting and database (US).
• Cloudflare — website hosting and DNS.
• Intuit (QuickBooks Online) — your own accounting file, which you connect and can disconnect at any time.
• Postmark — receiving the invoices you forward by email.
• Anthropic — we use artificial intelligence (Anthropic's Claude) to read uploaded invoice documents and extract their details (vendor, amounts, taxes). Every extraction is reviewed by a person before anything reaches your books. Processed under commercial terms; never used to train AI models.
• Google — our business email, and the fonts on these pages.

How long we keep things

Bookkeeping records are tax records: Canadian rules (CRA) require keeping them for six years. Within that constraint, if you leave Sorted we disconnect all authorizations immediately and delete your stored documents and data on request, except what the law requires us to retain.

Your choices and rights

• You can disconnect any platform authorization at any time — in Sorted or from the platform's own settings.
• You can ask us what we hold about you, ask us to correct it, or ask us to delete it (subject to the retention rules above). Email security@sortedbooks.app.
• We handle personal information in accordance with Canada's PIPEDA.

If something goes wrong

If we ever discover unauthorized access to your data, we will notify you within 72 hours with what happened, what was affected, and what we've done about it — and notify platforms and authorities as their rules and the law require.

Changes

If this policy changes in a way that matters, we'll tell you in the application and update the date at the top. Questions: security@sortedbooks.app.