SlimBooks (“we,” “us”) is a bookkeeping app for freelancers and small businesses, operated by Indie CFO LLC, a Wyoming limited liability company. This policy explains what information we collect, how we use it, and the choices you have. We’ve tried to keep it in plain English. It applies to the SlimBooks app, our website at getslimbooks.com, and the emails we send.
What we collect
Account information. Your email address and sign-in identities, used to authenticate you. If you sign in with Google or Apple, we receive your email and basic profile information (such as your name and avatar) from that provider; Apple’s private relay addresses are supported. Authentication is handled by Supabase.
Transaction data. The bookkeeping records you create in SlimBooks. Transactions enter the app three ways: you type them in, you import a statement file from your bank, or you connect a bank account (see the next section). For each transaction we store the date, a cleaned-up description, the amount, and the category it ends up in. For transactions that arrive from a connected bank we also store the raw descriptor text your bank sent, the category Plaid assigned and how confident Plaid was about it, an identifier for the merchant, the payment channel (in person, online, and so on), and whether the transaction is still pending.
Bank account connections (Plaid). If you choose to link a bank account, we use Plaid to connect to your financial institution. Through Plaid we receive your institution’s name, the names, types, and last four digits of the accounts you choose to share, account balances, and transaction history. For each account you link we store its name, type, last four digits, and its current and available balances, which we refresh every time we sync. We never see or store your bank username or password — you enter those directly with your bank inside Plaid’s secure interface. Plaid provides us an access token, which we encrypt (AES-256-GCM) before storing. We keep only the fields listed above: we do not retain the full raw data payload Plaid sends us, and we strip street addresses and map coordinates from merchant location data. You can read how Plaid handles your data in Plaid’s End User Privacy Policy. Linking a bank is optional, requires your explicit consent in the app, and requires that you first set up two-factor authentication on your SlimBooks account. You can disconnect a bank at any time in the app under Account → Connected banks, which revokes our access at Plaid.
Bank connections end with your paid plan. Bank syncing is a paid feature, so when a paid subscription ends we automatically disconnect your banks. That happens if you cancel, if you downgrade to the free Manual plan, or if the subscription lapses because a payment failed. We call Plaid to revoke our access and we delete the stored connection. Transactions already imported stay in your books; new ones simply stop arriving. If you want syncing back later, you will need an eligible plan and you will need to link the bank through Plaid again.
Statement file imports. When you import a CSV, Excel, OFX, QFX, QBO, or QIF file, the file is read on your device and only the resulting transactions are saved. We do not upload or keep the file itself. We do record, for each import, the file type, the number of rows, the column headings the file used, and which columns you matched to date, description, and amount — so we can fix parsing bugs. We never record the file name.
Tax profile and questionnaire answers. To build your Schedule C report we store the answers you give about your business: whether you track assets, carry inventory, use a vehicle, or have a home office; when your business started; your entity type and accounting basis; and the figures you enter for a tax year, such as total and business miles, home and office square footage, and inventory amounts.
Categorization memory. When you confirm a category for a merchant, we remember that pairing for your account so the next transaction from the same merchant is suggested correctly. We also record whether you accepted or changed a suggestion, so we can measure how accurate suggestions are.
Payment information. Subscriptions are bought inside the app and processed by the Apple App Store or Google Play, and RevenueCat tells us whether that subscription is active; we never see your Apple or Google payment details. We store only the store’s identifiers for your subscription, along with your plan, its price, and your billing status. We no longer sell subscriptions on our website; if you went through our earlier website checkout, which was processed by Stripe, we keep Stripe’s identifiers for that customer and subscription on the same terms, and your card number never touched SlimBooks systems.
Consent records. When you agree to this policy and our Terms at signup, accept an updated version, or authorize a bank connection, we record that consent with a timestamp and the version you accepted, so both of us can show what was agreed and when.
App settings. Your in-app preferences, such as theme and which of our optional emails you want.
Push notification tokens. If you allow notifications, your device gives us a push token — an anonymous address for your specific installation of the app — which we store so we can tell you when a bank needs reconnecting or an import has finished. It is deleted when you sign out, when your account is deleted, and the next time you open the app after turning notifications off.
Email records. We keep a note of which account and educational emails we have sent you, so we never send the same one twice, and we receive bounce and complaint reports from our email provider. We do not track whether you open or read an email.
Diagnostic logs. When something goes wrong — a failed bank sync, a billing error, an app crash — we record a log entry so we can find and fix it. These entries include what happened, when, and which account it happened to. We don’t log your bookkeeping data as a matter of design, and bank access tokens are stripped out of logs before they are written. Billing events from Stripe and RevenueCat are also recorded by ID and arrival time in a ledger, so we can ignore an event that arrives twice. That ledger holds no account ID, and each entry is deleted after 30 days.
Product analytics and crash diagnostics. The mobile app uses PostHog to understand which features get used, and Sentry to find out when the app crashes. Both are deliberately narrow. PostHog only receives a fixed, pre-approved list of properties for each event — things like whether a report was generated, or how many banks are connected — and anything not on that list is stripped out before the event is sent. Each event also carries basic technical details (the app version, phone model, operating system version, screen size, language and time zone), and PostHog records when the app is opened, updated or moved to the background. PostHog is told not to look up your location. It never receives transaction descriptions or amounts, merchant names, account numbers or balances, the name of your bank, or your name or email address. You are identified to PostHog only by your internal SlimBooks account ID. We do not use session replay, and we do not send PostHog error reports. Sentry is used only for crash and error diagnostics; we send it the same internal account ID so we can tell whether a crash hit one person or everyone, and we strip out the network and console breadcrumbs that would otherwise carry transaction rows or sign-in tokens.
Face ID and fingerprint unlock. If you turn on biometric unlock, the check is performed entirely by your phone’s operating system. SlimBooks only learns whether the check passed. We never receive, store, or have access to your face, fingerprint, or any other biometric data.
Our public web pages. The home page, the tax-help page and these policy pages send PostHog a page view, and record whether a download button or an App Store or Google Play link was clicked, and whether someone joined the tax-feature waitlist (never the email address given), so we can tell whether the site is doing its job. That is the entire list. Each of these also carries the kind of device (phone, tablet or computer) and, if another site linked here, that site’s domain; nothing else about your browser or device is sent. Page addresses are sent without anything after the “?”, and PostHog is told not to look up a location. These events carry no account identifier, and nothing is stored in your browser between page loads — so they cannot be tied to you, or to each other, or to your SlimBooks account. The signed-in parts of the site — signing in, your account, billing and subscription pages — send nothing at all.
Tax-help waitlist. If you join the waitlist for our tax-help service, we store the email address you give us and where you signed up from.
Not-a-fit waitlist. If our setup questions show that SlimBooks can’t serve your business yet (a corporation or partnership, or accrual-basis books) and you choose to join the list in the email we send you about it, we store your email address and which of those two answers ruled SlimBooks out, so we can email you once if that changes. It is a separate list from the tax-help waitlist.
We do not use advertising trackers, we do not use tracking cookies, and we do not sell your data or share it for advertising. Because we do not track you across other sites or services, browser “Do Not Track” and Global Privacy Control signals do not change anything about how we treat you — you already get that treatment. Beyond what’s described above, we don’t collect information we don’t need to run the service.
How we use your information
To authenticate your account, store and categorize your transactions, sync transactions from banks you’ve connected, generate your tax reports, process your subscription, send you service messages about your account, your billing, and your bank connections, email you once if SlimBooks comes to support a kind of business it turned away (only if you joined that list), send you a short educational note the first time you record something with tax consequences (a handful per account at most; turn them off any time in the app under Account → Preferences → Email, or with the link at the bottom of each one), send you occasional offers about SlimBooks products and services (turn them off any time in the same place, or with the link at the bottom of each one), provide support, fix bugs and crashes, and keep the service secure.
Automatic categorization. SlimBooks suggests a category for each transaction using software that runs inside the app: fixed rules, your own past choices, a curated list of common merchants, shared signals about how other users have categorized the same merchant, and a small statistical model. Suggestions can be wrong, and nothing is applied until you confirm it. We do not send your transactions to any outside artificial-intelligence service to do this.
To keep those suggestions accurate, we also use transaction records to improve the categorization engine. The categories you confirm or correct feed a combined dataset drawn from across accounts, which we use to tune the engine and to build the shared merchant signals. Your account identifier is removed from that dataset, and the shared merchant signals are built only when several different users agree, so no single person’s choices can be read back out of them. The dataset does still include the descriptions and bank descriptor text from transactions, so we treat it as personal information and keep it under the same access controls as everything else. We use it only to make categorization better inside SlimBooks. We do not sell it, hand it to advertisers, or publish it.
Who we share it with
We do not sell, rent, or trade your personal information — to anyone, ever.
We share data only with the service providers that operate SlimBooks on our behalf, each limited to what their role requires and bound by contract to use it only for that:
- Plaid — connects to your bank when you choose to link an account
- Stripe — processed payments for our earlier website checkout; we no longer sell through it, but it holds the records of those checkouts and hosts the billing portal for them
- RevenueCat — tracks in-app subscriptions bought through the App Store or Google Play; receives your internal account ID and the store’s subscription status
- Apple and Google — process in-app purchases as merchant of record, and deliver push notifications to your device
- Supabase — hosts our database and handles authentication
- Vercel — hosts our website and API
- Resend — sends our email: your welcome message, account and billing notices, and the tax tips, product updates and promotions you can turn off any time
- beehiiv — hosts The Bootstrapper CFO Newsletter and sends its issues. It receives your email address only while you are subscribed, and only if you are. Turning the newsletter off — in the app, on the preferences page, or from any issue — unsubscribes you there too, and deleting your account removes you from it entirely
- Expo — relays push notifications to Apple’s and Google’s notification services
- Sentry — collects crash and error diagnostics from the app
- PostHog — product analytics, limited to the events described above
None of these providers is an artificial-intelligence or machine-learning service, and none receives your data to train models of its own.
One thing worth calling out about push notifications: when we tell you that a bank needs reconnecting, or that an import is ready to review, the notification text names the institution — for example, “Your Chase transactions are ready to review.” To reach your phone, that text passes through Expo’s push service and then through Apple’s or Google’s notification service, and it can appear on your lock screen. If you’d rather it didn’t, turn off notifications for SlimBooks in your device settings.
We may also disclose information if required by law, or to protect the rights, safety, or security of SlimBooks and its users. If SlimBooks is ever part of a merger, acquisition, or sale of assets, your information may transfer with the business; we’ll tell you before it becomes subject to a different privacy policy.
Financial privacy notice
Because SlimBooks handles your financial account information, U.S. federal law (the Gramm-Leach-Bliley Act) asks us to tell you the following, and to tell you again whenever it changes:
- What we collect: the nonpublic personal information described under “What we collect” — your account details, the accounts and transactions you connect or import, and your billing status.
- Who we share it with: only the service providers listed above, and only so they can operate SlimBooks for you, plus disclosures the law requires. We do not share it with anyone for their own marketing, and we do not share it with affiliates (we have none).
- Your choices: because we share only in the ways the law already permits without an opt-out, there is nothing here you need to opt out of. You can end all sharing by disconnecting a bank or deleting your account.
- How we protect it: the safeguards described under “How we protect it” below, run under a written information security program with a named person responsible for it.
Where your data goes and why we may use it
SlimBooks is a U.S. business built for U.S. taxpayers, and our providers are based in the United States. They may process and store information in the United States or in other countries, so your information may leave the country you live in and be handled somewhere with different data protection laws. Each of these providers publishes its own data processing terms and transfer safeguards; where the UK or EEA rules apply, we rely on the standard contractual clauses and UK addendum they offer.
If you are in the UK, the EEA, or Switzerland. Our legal bases for processing are: performance of a contract for everything needed to run your account and your subscription; legitimate interests for keeping the service secure, fixing bugs, and improving categorization, balanced against your rights and limited as described above; consent for the optional tax-tips emails and push notifications, which you can withdraw at any time; and legitimate interests for the consent records we keep after an account closes. We have not appointed a representative in the UK or EU; contact us directly at gustavo@getslimbooks.com, and you may also complain to your local data protection authority.
How we protect it
All data is encrypted in transit (TLS 1.2 or better) and at rest. Bank access tokens receive an additional layer of application-level encryption (AES-256-GCM) before storage. Our database enforces row-level security, meaning your account can only ever access your own records. Access to our production systems requires multi-factor authentication.
Who at SlimBooks can see your records. Row-level security governs what one user account can reach. It is not a promise that nobody here can see your data, and we would rather say so than let you assume otherwise. SlimBooks is run by one person, and our server holds a privileged key that row-level security does not restrict. That access is what lets us investigate a failed bank sync or a billing problem you write to us about, and what lets us check how well automatic categorization is performing — a review that reads transaction descriptions, bank descriptor text, amounts, and the categories people chose. Those review screens and the file they export do not carry your account identifier, your name, or your email. We do not read accounts for any other reason, we do not sell what we see, and everything in “How we use your information” above still applies to it.
Some specifics worth naming, because they’re the ones that matter for financial data:
- Two-factor authentication is required before you can link a bank. Connecting a bank account is the highest-stakes thing you can do in SlimBooks, so we require you to set up a second factor and pass it first. If you sign in with Apple, Apple’s own two-factor requirement covers this.
- Our website and API are served over HTTPS only, and we send HTTP Strict Transport Security so browsers refuse to fall back to an unencrypted connection.
- We enforce a Content Security Policy that restricts where the site may load code from and blocks it from being embedded in another site, which limits the damage any injected script could do.
- Our database connection verifies the server’s certificate, so the connection carrying your data can’t be silently intercepted.
- We check every incoming webhook before we act on it. Stripe, Plaid, Resend, and beehiiv sign theirs, and we refuse any whose signature doesn’t match or is more than 5 minutes old. We check RevenueCat’s with a shared secret instead of a signature. Each one must carry that secret in its Authorization header, and only RevenueCat and we know it. If a Stripe or RevenueCat event we have already handled arrives again, we ignore it, as long as our record of handled events can be reached.
- Sensitive account and billing endpoints — account deletion, two-factor reset, account lookup, and the billing portal — are rate limited.
- The most sensitive tables are reachable only by our server. The keys that ship inside the mobile app and the website can neither read nor write them.
- Bank access tokens are scrubbed out of error reports and logs, so they can’t leak through a stack trace.
- Deleting your account, or resetting two-factor authentication, requires you to have signed in recently, so a stolen session token alone cannot do either.
No system is perfectly secure and we won’t pretend otherwise. If you find a vulnerability, please email us at gustavo@getslimbooks.com and we’ll work with you on it. Our disclosure details are also published at /.well-known/security.txt.
How long we keep it
We keep your bookkeeping data — transactions, categories, linked account records, tax profile answers, categorization memory, and settings — for as long as your account is active, because that data is the product. The rest has its own clock:
- Diagnostic logs are purged on a rolling schedule, currently about 90 days.
- Billing event ledgers record the ID of each Stripe and RevenueCat event we handle and the time it arrived, so we can ignore an event that arrives twice. They hold no account ID, and each entry is deleted after 30 days.
- Crash reports are kept by Sentry for 30 days, and product analytics events by PostHog for 1 year, after which they drop out of our PostHog account (PostHog may take a while longer to erase them from its own systems). Neither one stores your IP address — we’ve turned that off in both. Sentry also scrubs passwords and card-like values on their side as well as ours.
- Import diagnostics (file type, row counts, column headings) are kept while your account exists.
- Email records (which emails we sent you) are kept while your account exists.
- Your subscription record is kept while your account exists and is deleted with it. Apple and Google (and Stripe, for any earlier website checkout) separately retain records of your payments on their own schedules, and deleting your SlimBooks account does not erase their copies.
- Consent records are kept while your account exists, and for three years after it closes, so we can show what you agreed to and when. After deletion they no longer carry your email or name, only your former account identifier.
- Push notification tokens are deleted when you sign out or delete your account, and the next time you open the app after turning notifications off. We also drop them automatically once a device stops accepting notifications.
- Tax-help waitlist entries are kept until the service launches or you ask us to remove you.
- Not-a-fit waitlist entries are kept until SlimBooks supports your kind of business and we have sent you that one email, after which the list is deleted, or until you ask us to remove you. Deleting your account does not remove you from it, because the point of the list is to reach you after you have left.
We do not keep personal information longer than we need it for the purposes above, and anything we no longer need is deleted within two years of last use at the latest.
How to delete it
You’re in control:
- Individual transactions can be deleted in the app at any time.
- Bank connections can be disconnected in the app under Account → Connected banks, which revokes our access at Plaid and deletes the stored connection. Previously imported transactions stay unless you delete them.
- Your entire account can be deleted in the app under Account → Preferences, or from the account page on our website.
What account deletion actually does depends on your subscription, so here is what happens in each case:
- No active subscription. Deletion runs immediately.
- App Store or Google Play subscription that will renew. We cannot cancel a store subscription for you, so the app and the account page on our website both ask you to cancel it in your store settings first. After you cancel it, the next case applies.
- Active subscription that won’t renew, or one from our earlier website checkout. The app deletes your account right away, and you give up the time left on the subscription. The account page on our website lets you do that too, or schedule deletion for the end of the billing period instead. If you schedule it, your account and all its data stay until the subscription ends, and we delete them then. Turning renewal back on before then, in your store settings or in the billing portal for an earlier website subscription, calls off the scheduled deletion.
Whenever deletion does run, the first thing we do is revoke our access at Plaid, so your bank connections are severed before anything else is touched. If that step fails we stop and do not report the deletion as complete, rather than leave a live bank connection behind. After that we permanently remove your transactions, linked accounts, tax profile and questionnaire answers, categorization memory, import diagnostics, email records, settings, push tokens, your subscription record, your in-app subscription record at RevenueCat, your app usage history at PostHog, and your login itself.
A few things survive deletion, and you should know about them. Diagnostic logs are detached from your account rather than erased, so error trends survive you leaving. A few entries can still name your account or email address, such as a record of a deletion step that failed, and those are purged with the rest of the logs within about 90 days. Apple and Google (and Stripe, for any earlier website checkout) keep their records of your payments on their own schedules, and deleting your account does not erase them. Billing event records from Stripe and RevenueCat hold no account ID, and each one is deleted after 30 days. Consent records stay for three years, without your email or name. The shared merchant signals built from many users’ choices are not changed, because they cannot be traced back to you. And deleted data lingers briefly in our encrypted database backups, which are taken daily and kept for 7 days, so it ages out within a week.
Your rights
Most of these you can exercise yourself, right now, without asking us:
- Access and portability. View everything we hold about your bookkeeping in the app, and export your transactions and reports as files you keep.
- Correction. Edit any transaction, category, or setting that’s wrong.
- Deletion. Delete individual records, disconnect banks, or delete your entire account, as described above.
Depending on where you live you may have further rights under local privacy law — to know what we hold and why, to get a copy in a portable format, to have it corrected or erased, to object to or restrict certain processing, and to complain to your data protection authority. To exercise any of them, or just to ask, email us at gustavo@getslimbooks.com. We’ll acknowledge you promptly and respond within 45 days; if a request is genuinely complicated we may need longer, and we’ll tell you why before that window is up. We may need to verify that you are who you say you are before we act on a request about a financial account, and you can use an authorized agent if the law where you live allows it. We’ll never treat you worse — degraded service, a higher price, fewer features — for exercising a privacy right.
If you live in California. Under the CCPA and CPRA: we do not sell personal information, and we do not share it for cross-context behavioral advertising — not now and not in the preceding twelve months. We don’t knowingly sell or share the personal information of anyone under 16. We collect the categories described in “What we collect” above, for the purposes described in “How we use your information,” and we disclose them only to the service providers listed above. Your financial account information — linked accounts, balances, and transactions — is sensitive personal information under those laws. We use it to provide and improve SlimBooks and for nothing else, so there is no additional use for you to limit, and you can still exercise your rights to know, delete, and correct it. Much of this information is also covered by the federal financial privacy law described above, which the CCPA defers to.
If there’s a breach. If we discover a security incident that has compromised your personal information, we’ll notify you and the relevant regulators without undue delay, and within whatever deadline applicable law sets. We’ll tell you what happened, what information was involved, what we’ve done about it, and what we recommend you do.
Children
SlimBooks is for adults running a business. You must be at least 18 to use it, and it is not directed to children. We do not knowingly collect personal information from anyone under 18, and never from anyone under 13. If we learn that a user is under 18, we stop collecting their information, delete the account and its data, and close the account. We don’t ask for your date of birth, so we rely on you and on what we learn; if you believe a minor has given us personal information, email us at gustavo@getslimbooks.com and we’ll remove it.
Changes to this policy
When we make a material change to this policy — collecting a new category of data, sharing with a new kind of recipient, or using what we already have for a new purpose — we’ll update the date and version at the top, archive the previous version, and update the policy version we record alongside your consent. We’ll also email you and ask you to accept the updated policy the next time you sign in, before the change applies to you. Small corrections and clarifications that don’t change what we collect, who receives it, or how we use it are made in place, without a new date or version.
Previous versions of this policy: /legal-archive
Contact
Questions about privacy & security issues:
Indie CFO LLC
30 N Gould St, Suite #22872
Sheridan, WY 82801 US