Privacy

1. Who is responsible for this data

The controller is [TO BE COMPLETED: operator’s registered legal name], at [TO BE COMPLETED: postal address]. Privacy contact: [TO BE COMPLETED: contact email address]. Data protection officer: [TO BE COMPLETED: data protection officer — appointed or not; if not, say so in as many words].

2. What is stored

Everything below, and nothing else:

• Your email address, and — if you sign in with Google or X — the account identifier that provider returns. There is no password, because there is no password login: sign-in is a one-time link sent to your address, or one of those two providers.
• Your projects — a name, a URL, a tagline, a status.
• Your ledger lines — for each entry, whether it is money in or out, the amount, the currency, the month, a label, a category, whether it recurs and the month it stops recurring. Imported lines also carry the identifier the provider gave them, so the same payment is not counted twice.
• Contractors and payables — if you use them: a name, what they do for you, an email address, a phone number, an amount, a due date, a paid date. If you record another person here, you are the controller of their data and MakerProfit stores it on your instruction.
• Provider connections — the restricted API key you paste for Stripe or Lemon Squeezy, encrypted with AES-256-GCM under a key held by the server and never present in the browser, plus the last few characters so you can tell which key it is, the account identifier, and when it last synced.
• What a connected account counted, month by month — for each connection, a per-month roll-up: how many distinct people paid, how many payments were taken, how many subscriptions were still running at the end of the month, what those subscriptions are worth per month, and how many ended. Figures only, never identities — the importer is the one place that sees the individual payments and subscriptions, it counts them, and it keeps no name, no email and no payment reference from them.
• Your subscription state — which tier you bought, the status, the end of the period you have paid for, whether you asked to stop, when a card first failed, and the Stripe customer and subscription identifiers. No card number, ever: card details are typed on Stripe’s own page and never reach this application.
• Your badge settings — the text, the links and the styling you choose for the public panel, if you publish one, including the photo you put on it. That photo is not a file held on some other host: it is encoded into the badge record itself — up to 200,000 characters of it — and stored in the same row as the colours. Anything you put in a published badge is public by design; that is what it is for.

There is no advertising network here, no third-party tracker, no session recording, and no profile built about you.

3. Why, and on what legal basis

• To run the service you asked for — storing your projects and lines, computing the figures, importing from a provider you connected. Basis: performance of the contract.
• To sign you in and keep the account secure — the magic link, the session cookie, the rate limit on link requests. Basis: performance of the contract and legitimate interest in not being abused.
• To take payment and meet accounting obligations — the subscription record and Stripe’s own invoice. Basis: contract, and legal obligation for invoices.
• To see that the site works — aggregate page and performance measurements, with no cookie and no cross-site identifier. Basis: legitimate interest. [TO BE COMPLETED: legal basis for the analytics — to confirm]

Your data is never sold, never rented, never shared with an advertiser, and never used to train a model.

4. Who else processes it

Three subprocessors, each doing one job it cannot be done without:

• Appwrite — authentication and the database. It holds your email address, your projects, your lines, your people and your encrypted provider keys, and it is what puts the sign-in link in your inbox — the only email this service sends at all. Hosting region: [TO BE COMPLETED: Appwrite hosting region — to confirm].
• Stripe — payments. It holds your billing details and card data, which never pass through this application, and returns a customer identifier and a subscription status. Stripe is also, and separately, a source you may connect to import your own revenue; in that direction the key is read-only.
• Vercel — hosting, plus its own privacy-preserving analytics and performance measurement. It processes request data such as IP address and user agent in the ordinary course of serving the site.

If you connect Lemon Squeezy as a revenue source, it is a source the service reads from on your instruction rather than a processor acting for it. Where any of these transfer data outside the EEA, they do so under the European Commission’s standard contractual clauses. [TO BE COMPLETED: transfers outside the EU — check the clauses each provider actually offers]

5. How long it is kept

Your account data is kept for as long as the account exists. Nothing is aged out or rolled off: a line you typed four years ago is still there, which is the point of a ledger.

There is no automatic end to that, and it is worth saying plainly: the application contains no code that deletes an account or the data behind it. No screen offers it, no scheduled job performs it. An account nobody asks about stays as it is. Deletion happens because somebody asks for it and a person carries it out by hand — see the next section. [TO BE COMPLETED: a real retention limit, a deletion procedure and how backups are purged — none of the three exists in the product today]

Invoices and payment records held by Stripe are kept for as long as accounting law requires, which is longer, and independently of this application. [TO BE COMPLETED: applicable accounting retention period]

6. Getting it out, and getting rid of it

Export. Every account, including a free one, can export the whole ledger as a machine-readable file from inside the app. It is not gated behind a subscription and it is not a support request.

Deletion. There is no delete-account button, and no automated deletion behind one. Ask at [TO BE COMPLETED: contact email address] and the operator removes the account, the projects, the lines, the people, the payables, the connections and the badge by hand, and destroys the encrypted provider keys with them. Export first if you want a copy — nothing is sent to you afterwards. [TO BE COMPLETED: the delay this is carried out within, and who carries it out — to be decided, then stated here] Cancelling a subscription is not the same thing: cancelling drops you to the free tier and keeps your data intact, on purpose, because most people who cancel come back.

Disconnecting a provider. Disconnecting deletes the stored encrypted key immediately. Lines already imported stay, because they are your ledger — delete them individually if you want them gone.

7. Your rights

If the GDPR applies to you, you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where processing rests on consent. Write to [TO BE COMPLETED: contact email address] and it will be handled within one month.

You can also complain to a supervisory authority in the country you live or work in. [TO BE COMPLETED: competent supervisory authority]

8. Cookies

Two cookies, both strictly necessary, and neither of them watches you. One is the session — the token that keeps you signed in after you follow the magic link. The other lives about half an hour and ties a sign-in link to the browser that asked for it, so that a link cannot be used to drop you into somebody else’s account.

Your light-or-dark choice is not a cookie: it is kept in the browser’s own local storage and never sent anywhere. Two further cookies exist only in the development profile a developer runs on their own machine, and are never set by this site.

There is no consent banner because there is nothing to consent to — no advertising cookie, no analytics cookie, no third-party cookie is set here. [TO BE COMPLETED: re-check this before adding any third-party tool]

9. Security, honestly stated

Every row is filtered by owner on read and carries owner-only permissions, provider keys are encrypted at rest with AES-256-GCM, and card data never touches this application. That is a real posture, not a certification: there is no ISO 27001 audit behind it, no SOC 2 report, and no penetration test to point at. If you would need one of those, you should know that before you sign up rather than after.

If you find a security problem, report it to [TO BE COMPLETED: contact email address] before disclosing it publicly.

10. Changes

If this notice changes materially — a new subprocessor, a new category of data — it is announced in the app before it takes effect, and the date at the top of this page moves. Not by email: the only mail this service sends is your sign-in link, and there is no list behind it to write to. [TO BE COMPLETED: whether a notice email will be sent, and through which provider] See also the terms and the refunds page.