Privacy Policy

What we collect

When you browse

Our host, Cloudflare, records standard server request logs, including your IP address, the pages requested, and your browser type. These are used to keep the site online and to protect it from abuse. We do not use analytics or advertising trackers.

When you place an order

• Your name and email address.
• Your shipping address, including city, province or state, postal code, and country.
• What you ordered, what it cost, and the shipping method.
• Your payment method and the status of your payment.

We never see or store your card number. Card details are entered directly into a payment form hosted by Stripe and are transmitted to Stripe, not to us. We receive only a payment reference, the amount, and whether the payment succeeded.

If you pay by Interac e-Transfer, the transfer takes place between your bank and ours. We see the sender name, the amount, and the reference code you include with the transfer.

When you create an account

Accounts are optional — you can check out as a guest. If you do create one, we store your email address, a securely hashed password, your name, and any shipping addresses you choose to save, so you do not have to type them again. Authentication is handled by Supabase on our behalf; we never store your password in a readable form.

How we use it

We use your information only to run the bookstore:

• To take payment for your order and to detect fraudulent payments.
• To pack and ship your books, and to send you a receipt, a shipping confirmation, and tracking information.
• To answer your questions if you contact us.
• To keep the financial records that Canadian tax law requires us to keep.

We do not send marketing email. If we ever start a mailing list, it will be something you opt into separately, and you will be able to leave it at any time.

Who we share it with

We share the minimum necessary with the service providers who make the store work. Each is bound by its own agreement with us and may not use your information for its own purposes.

• Stripe — processes card payments. Stripe receives your card details directly, plus your email address and order amount. Stripe is PCI-DSS Level 1 certified and may store and process data outside Canada.
• Supabase — hosts our order database and account sign-in.
• Cloudflare — hosts and delivers this website.
• Resend — sends our order and shipping emails.
• Canada Post or another carrier — receives your name and shipping address so your books can be delivered.

Some of these providers store data on servers outside Canada, including in the United States. While your information is in another country it may be accessible to the courts and law enforcement of that country under its laws.

We will also disclose information where we are legally required to, for example in response to a valid court order.

Cookies and browser storage

This site does not use advertising or analytics cookies. It uses your browser’s own storage for a small number of strictly necessary things:

• Your shopping cart, so it survives moving between pages.
• A checkout reference, so that reopening the checkout continues the same order rather than starting a duplicate.
• The shipping details you typed, so you do not lose them if the page reloads. These are cleared when your order completes.
• If you sign in, a session token that keeps you signed in.
• Stripe sets its own cookies on its payment form for fraud prevention.

You can clear this at any time through your browser settings. Clearing it will empty your cart and sign you out.

How long we keep it

Order records, including what you bought and where it was shipped, are kept for seven years. This is the retention period the Canada Revenue Agency requires for business records.

If you have an account and ask us to close it, we will delete your profile and saved addresses. We must keep the underlying order records for the period above, but they will no longer be linked to a login.

Your rights

You have the right to ask us what personal information we hold about you, to ask us to correct anything that is wrong, and to ask us to delete information we are not legally required to keep. Write to us at the address below and we will respond within thirty days.

If you are not satisfied with how we have handled your information, you may complain to the Office of the Privacy Commissioner of Canada or to the Office of the Information and Privacy Commissioner of Alberta.

Contact