Privacy policy

Bellhop is made by Fae Software Limited, a company incorporated in Ontario, Canada. This policy covers the website at bellhop.dev, the developer dashboard, the licensing API, and the Bellhop agent. We handle personal information under Canada's Personal Information Protection and Electronic Documents Act, which everyone calls PIPEDA.

Questions about anything on this page go to concierge@bellhop.dev.

What you give us. Creating an account asks for an email address. An account holds that address and, if you offer one, a name. Registering an app stores what you type: its name and an accent colour, plus an icon if you upload one. Agents carry a label, usually a machine or location name, chosen when the agent is paired.

What arrives on its own. Signing in opens a session. The session records the IP address and browser it was opened from, so that unfamiliar activity on your account has something to be compared against. Our servers keep ordinary request logs, which rotate on a short schedule.

What a passkey shares. A passkey gives us a public key and the nickname you give it. The fingerprint or face that unlocks it never leaves your device. That is how passkeys work everywhere, and here is no exception.

What an agent sends. An agent sends what licensing needs: its credential serial, its status, and the hostname of the server it answers to. Agents check in with the licensing API occasionally to confirm or renew their credential. The check carries nothing about what the agent has printed or weighed.

Print jobs and scale readings travel from your server straight to the agent at the desk. Our servers are not on the route. The documents your app prints and the weights it reads never reach us, so there is nothing for us to collect and nothing for us to lose. That is by design, and you can check it.

The website carries no advertising trackers and no third-party cookies. Even the typefaces come from our own servers. One outside request is worth naming: page views are counted by Plausible, an analytics service we chose because it works without cookies and without an identifier for you. It tells us which pages were read and nothing about who read them. The request that reaches it carries your IP address, as every web request does.

We do not sell or rent personal information. There is no version of this business that would.

Two, both functional. A session cookie keeps you signed in, and a security token protects forms from being submitted by an impostor page. Neither follows you anywhere else. There is no consent banner because there is nothing to consent to.

To run the service: accounts, pairing, licensing, and support. To send the email you asked for: the link that creates your account, and magic links when you sign in. To keep the service safe: spotting abuse and limiting how fast anyone can try things. And to understand usage in aggregate, with nothing in the figures that identifies you.

Under Canada's anti-spam law, the email above is transactional: you asked for each message by an action of your own. We will not send marketing without your consent, and anything promotional will carry a working unsubscribe.

Service providers who help us run Bellhop: the infrastructure that hosts it, and Postmark, which delivers our email. They process personal information on our instructions, for the purposes above and no other.

Some of these providers operate outside Canada, so personal information may be stored or processed in another country, most commonly the United States. While it is there it is subject to the laws of that jurisdiction, and its authorities may have lawful access to it.

Beyond that, we disclose personal information only when the law requires it, or as part of a sale or reorganisation of the business, in which case it stays under promises at least as protective as these.

For as long as your account is open. Close it and we delete the personal information it held promptly, keeping only what the law makes us keep, such as financial records. Server logs are short-lived by design.

Everything travels over encrypted connections. Your app's secret keys are stored only as digests, which means we could not read one back to you if we wanted to. If a key leaks, you rotate it; nobody can recover it, us included. Sign-in is passwordless: magic links expire quickly and passkeys resist phishing by construction, so there is no password of yours for anyone to steal from us.

No safeguard is perfect. If you find a weakness, tell us at concierge@bellhop.dev and we will take it seriously.

You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave earlier. Write to concierge@bellhop.dev and we will answer within thirty days, the period PIPEDA sets.

If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada.

Bellhop is built for businesses and the developers who work for them. It is not directed at children, and we do not knowingly collect their information.

When the policy changes, the new version appears here with a new effective date at the top. If a change matters, account holders hear about it by email before it takes effect.

Fae Software Limited, Ontario, Canada · concierge@bellhop.dev

The terms that go with this policy are at the terms of use.