Privacy Policy

Effective September 25, 2026

Payout Reconciliation turns Stripe payouts into balanced journal entries for bookkeepers and accountants. To do that, it needs limited access to Stripe data. This page explains, in plain language, exactly what we collect, why, and what we will never do with it.

Two roles, and whose data is whose

Most people using Payout Reconciliation are bookkeepers working on someone else's books, so two different parties appear in this policy:

• The bookkeeper — our customer. They hold the Payout Reconciliation login and read the journal entries the app produces.
• The account owner — the business whose Stripe account is connected. The payout data belongs to them. In the case of a business doing its own books, these are the same person.

Only the account owner can grant access. A bookkeeper cannot connect an account by naming it, typing its account ID, or asking us. Access begins when the account owner signs into their own Stripe Dashboard and authorizes this app there, and it ends when they uninstall it there. We act on the account owner's Stripe data as a processor, on the instructions of the bookkeeper they authorized.

The short version

• We access Stripe data read-only. We cannot create charges, move money, issue refunds, or change anything in a connected Stripe account.
• We never see your Stripe password, your Stripe login, or your secret API keys, and we never receive card numbers.
• We do store one Stripe credential: an OAuth refresh token per connected account, encrypted at rest. It is what lets the app read payouts without asking you to reauthorize hourly, and it is destroyed when access ends.
• We don't sell your data, share it with advertisers, or use tracking cookies. There are no analytics scripts on this site.
• The account owner can withdraw access at any time by uninstalling the app in their Stripe Dashboard, which destroys the stored credential.

How access is granted

Connecting an account uses Stripe OAuth authorization. A bookkeeper generates an invitation link in Payout Reconciliation and sends it to their client. The client opens it, signs into their own Stripe account, and is shown Stripe's own authorization screen listing exactly which read permissions this app is asking for. If they approve, Stripe redirects back to us with a one-time authorization code, which we exchange for tokens. If they don't, no connection is created and we receive nothing.

A business connecting its own account follows the same authorization screen, without the invitation step.

Because the invitation only proves which bookkeeper started the process — not which client answered — a connection made through an invitation is held in a provisional state until the bookkeeper confirms that the account that arrived is the client they meant. Until that confirmation, the only data read is the account's three most recent completed payouts, described below. If they reject it, we close the connection and destroy the stored credential immediately.

What we collect

Account information. Your name, email address, and a hashed version of your password (we store only the hash, never the password itself).

The Stripe connection credential. When an account owner authorizes the app, Stripe issues us an OAuth refresh token for that account. We store it encrypted at rest with AES-256-GCM, cryptographically bound to the single connection record it belongs to, so a copy of it is useless anywhere else. It is used only to obtain short-lived read access tokens from Stripe, and it is erased whenever the connection is closed. We also store the Stripe account ID, the times the account authorized and any access ended, and — for invitations — the label the bookkeeper gave the client and, optionally, the account ID they expected.

Payouts shown for confirmation. To let a bookkeeper verify that the account that authorized really is their client, we read the connected account's three most recent completed payouts from Stripe: the amount, currency and arrival date of each. The bookkeeper checks them against the client's bank statement. They are displayed for the confirmation decision, before it is made, and are not stored by us. We do not read the account's name, email or other profile details, and we do not access your bank account details at all — not the account number, and not the last four digits.

Payout and transaction data. When a journal is generated for a payout, we fetch that payout's balance transactions from Stripe (transaction IDs, amounts, fees, types, and dates) and save the resulting journal entries — account names with debit and credit amounts — so the app can remember which payouts have already been booked. We do not request, receive, or store card numbers or the account owner's customers' personal details.

Account names for import files. If a bookkeeper fills in a client's accounts, we store, for that connection, the names and codes of the accounts in the client's books that the app's own accounts correspond to, so QuickBooks Online and Xero files can be written in them. We connect to neither product: the bookkeeper downloads the file and imports it themselves.

A session cookie. One essential cookie keeps you logged in. It is not used for tracking and we set no others.

What we can and cannot do with that access

The app's permissions are declared in its published Stripe App manifest and shown to the account owner on the authorization screen. They are read-only: reading payouts, reading the balance transactions that make up each payout, and reading the charge and refund details behind those transactions. Stripe enforces this on its side — an attempt by this app to write to a connected account would be refused by Stripe, not merely declined by us.

How we use it

For one purpose: converting Stripe payouts into journal entries and keeping track of which ones have been booked. We do not sell your data, rent it, use it for advertising, or train anything on it.

Withdrawing access and deleting data

The account owner controls this, and it is immediate. In their Stripe Dashboard, under Settings → Apps (or Apps → Installed apps), they uninstall Payout Reconciliation. Stripe notifies our webhook, and on that notification we close the connection and erase the stored refresh token in the same database operation — closing the connection and destroying the credential are one indivisible step, so no closed connection can be left holding a live credential. From that moment we hold no credential for the account and cannot read anything from it; regaining access would require a fresh authorization that only the account owner can perform.

A bookkeeper can also disconnect from inside Payout Reconciliation. This likewise erases the stored refresh token and ends our ability to read the account. Note the limit honestly: it does not uninstall the app on Stripe's side, so the account owner may still see the app listed in their dashboard until they remove it there. Uninstalling in the Stripe Dashboard is the authoritative way to withdraw the grant.

Who else touches the data

• Stripe — the source of the payout data, under the account owner's authorization via Stripe Apps, and the party that issues and honors the credential described above.
• Render — our hosting provider; the application and its database run there. Data is encrypted in transit (HTTPS).
• Resend — our transactional email provider. It handles the address and message contents of operational emails such as password resets. No payout or journal data is sent by email.
• Google Fonts — this site loads its typeface from Google, which means your browser sends Google a standard font request (including your IP address). No other data is shared.

That's the whole list. No analytics, advertising, or data-broker services.

Security

All traffic is encrypted with HTTPS. Stripe OAuth refresh tokens are encrypted at rest with AES-256-GCM and bound to their own connection record, so a token lifted from one record cannot be used to read another account. Access tokens minted from them are short-lived and held only in memory. Passwords are hashed with bcrypt. Session cookies are HTTP-only. Every request to Stripe is scoped to a single connected account and is read-only. Invitation links are stored only as hashes, expire after 72 hours, and are single-use.

Data retention and deletion

We keep your data while your account is active. To delete your account and everything we hold — including saved journal entries — email us at the address below and we'll confirm deletion within 30 days.

Two things to be precise about after access ends. First, the credential is destroyed at once, as described above — that part is never retained. Second, we do keep the connection record itself, marked closed, along with any journal entries already generated and any account names entered for it: a bookkeeping product has to be able to answer "who had access to this account, and when," and the bookkeeper's completed work has to survive a client's uninstall. Those records hold account identifiers, timestamps, journal amounts, and account names — never a credential. An account owner or bookkeeper can ask us to erase them too, by email.

Your rights

You can ask us at any time for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email us and we'll handle it — no forms, no runaround. If you are an account owner whose Stripe account a bookkeeper connected, you have these rights over your account's data as well, and you may contact us directly rather than through your bookkeeper.

Changes to this policy

Payout Reconciliation is in early access, so this policy may evolve. If we make a material change, we'll update the date at the top and notify you by email before the change takes effect.

Contact

Questions, requests, or concerns: flores.gl907@gmail.com.