Who we are
Bobby Tables is made by Altumo Software, a company in Vancouver, British Columbia, Canada. We are the organization responsible for the personal information described below. Write to licenses@bobbytables.app about anything on this page.
The short version
The app is a desktop client that talks to your own databases and storage. Almost nothing about that reaches us.
- No telemetry and no analytics. There is nothing to switch off.
- Your connections, credentials, queries, results, schemas and files never leave your machine.
- The free trial needs no account and sends one update check.
- A license sends its key, a hashed machine identifier, your hostname, your platform and the app version.
- This website sets no cookies and runs no analytics.
- We do not sell personal information and we do not use it for advertising.
What the app sends
The free trial makes one request: an update check asking whether a newer build exists. It carries the platform and the version you are running. There is no key and no account behind it.
Activating a license sends the key, a machine identifier, your hostname, the platform and the app version to api.bobbytables.app. The machine identifier is a salted SHA-256 hash of the identifier your operating system already exposes, so what we hold cannot be turned back into it.
An activated app then sends its signed receipt to the same host about once a day. That check-in is what lets the account page show you which machines are in use, and what carries a renewal or a refund through to the app. It keeps making the same update check as the trial.
That is the whole list. The app never sends connection details, credentials, queries, query results, schemas, row data or file contents. Connection secrets are held in the operating system keychain and are read only by the app on that machine.
Crash reports you choose to send
When the app hits an error it offers to send a report. Nothing is sent unless you press Send.
A report carries the app version, the build, the operating system, the error and its component stack, and whatever you type into the note and contact fields. File paths, connection names, hostnames, email addresses, license keys and machine identifiers are stripped out on your machine before the report leaves it.
Reports are not written to our database. They arrive in our support inbox, we read them to fix the bug, and we reply only if you gave us an address.
Buying a license
Checkout runs on Stripe. Stripe collects your email address, your payment details and the billing location it needs to calculate tax. We never see or store your card number.
What we keep from a purchase:
- Your email address.
- Stripe customer and payment identifiers, and how many days each payment bought.
- Your license key, encrypted, and a hash of it we look it up by.
- How many seats the license carries and the day its term ends.
- One row per activated machine: the hashed machine identifier, the hostname, the platform, the app version, and when it was first and last seen.
The account portal
bobbytables.app/account signs you in with a link emailed to your purchase address. We store a hash of each link, when it was issued and used, and the IP address that asked for it, which is what stops a stranger from turning your inbox into a firehose of sign-in mail.
Being signed in sets one cookie. It is scoped to the account pages and signed so it cannot be edited, and it holds a customer identifier and an expiry. It is not a tracking cookie and no third party is in it.
This website
bobbytables.app sets no cookies, runs no analytics, embeds no third-party scripts and loads no third-party fonts. Reading it leaves nothing behind.
Cloudflare serves the site and keeps the request logs any host keeps, including IP addresses, for a short period and for security and abuse handling.
Who else handles it
Three processors act on our instructions and nobody else does:
- Cloudflare: hosting, the database behind licensing, and the storage the downloads come from.
- Stripe: payments, receipts and tax.
- Resend: the mail carrying your key, your renewal confirmation and your sign-in links.
Where it is stored
All three operate outside Canada, including in the United States, so information covered by this policy is stored and processed there and may be reachable by the courts of those countries.
How long we keep it
Customer and license records stay while the license exists, and afterwards for as long as Canadian tax law requires us to keep records of the sale, which is six years.
An activation row stays while the license does. Deactivating a machine marks the row deactivated rather than deleting it, so coming back to that machine later does not cost you a second slot.
Sign-in links are kept only as hashes, which cannot be turned back into a working link. Crash reports live in the support inbox and are deleted with the rest of that mail.
Your rights
The Personal Information Protection Act of British Columbia and Canada's PIPEDA give you the right to ask what personal information we hold about you, to have it corrected, and to withdraw your consent.
Some of it is yours to act on directly: sign in at bobbytables.app/account to see your license and your machines, and to deactivate any machine you no longer use.
For the rest, write to licenses@bobbytables.app. We answer within 30 days. Deleting the record behind an active license ends the license, so we will tell you that before we do it.
If our answer does not satisfy you, you can complain to the Office of the Information and Privacy Commissioner for British Columbia.
Security
Everything travels over TLS. License keys are stored encrypted with AES-256-GCM under a service secret and are looked up by hash, so a copy of the database yields no working keys. The receipt the app holds is signed, which is how it can check a license offline without asking us anything.
No system is perfect. If you find a problem, write to licenses@bobbytables.app and we will act on it.
Children
Bobby Tables is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 13.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change materially affects people holding a license, we will say so by email to the address on the license.