Fly Cast Cash Flow Calendar
Privacy policy
Who operates this app
Fly Cast Digital operates the Fly Cast Cash Flow Calendar solely for its owner’s internal business use. It is not offered as a service to clients or other businesses. For privacy questions or deletion requests, contact todd@flycastdigital.com.
Information used and purpose
The private app reads authorized QuickBooks Online accounting information to display cash-flow estimates, recurring Sales Receipt schedules and Sales Receipts recorded in QuickBooks. It uses amounts, currencies, accounting dates, recurrence rules, limited internal record references and bounded client display names needed for the owner’s payment view. Ledger balances are not verified bank-available balances. A Sales Receipt is an accounting record, not independent verification that a payment processor successfully charged a client.
Payment details and immediate filtering
The app does not initiate charges or create, modify, send, refund or delete QuickBooks accounting records. Intuit may return full accounting objects that briefly enter server memory. The server immediately applies entity-specific field allowlists. Card numbers, bank account numbers, routing numbers, security codes, card expiry details, payment tokens, payment-instrument profiles, addresses and unnecessary contact details are excluded before downstream processing, storage, logs, browser responses or exports. Client display names are bounded and used only in responses; they are not saved as customer profiles or logged. This filtering does not mean sensitive provider fields can never enter server memory.
Credentials and private access
OAuth tokens are encrypted in the local vault. Intuit’s Accounting permission is inherently capable of reads and writes at Intuit, while this app restricts accounting requests to approved GET reads. Token exchange, refresh and revocation are separate OAuth connection operations. Financial screens and local APIs require private Tailscale connectivity and an owner-issued client certificate through Caddy HTTPS. Configuration, encryption keys and device credentials stay outside release packages.
Where information goes
The financial app runs on the owner’s private Mac mini in the United States. Projected accounting information is processed in memory for calendar responses. The local database stores encrypted OAuth tokens and local settings. Intuit receives authorized OAuth requests and accounting reads; the owner’s browser receives filtered calendar data through the private gateway. Tailscale provides private connectivity. Replit is used for development, testing and packaging; real-company accounting data and credentials are not sent to Replit. No advertising, sale of client data, generative-AI processing of accounting data, or public financial-data sharing is part of this app’s workflow.
Retention, backups and deletion
Encrypted connection credentials and settings are retained locally until the owner removes them. Turning synchronization off stops future reads and blocks results at the app’s disable checks; it does not revoke or delete tokens. Disconnect attempts revocation with Intuit. If revocation fails, encrypted credentials are retained so the owner can retry. Owner-controlled backups may retain earlier encrypted credentials, settings and database state until those backups are deleted. There is no automatic backup-expiration schedule. Deletion requests are handled by the operator, including checking relevant local copies and backups, subject to applicable retention requirements. Access can also be revoked through Intuit.
This public policy website
This website serves policy documents only. It has no QuickBooks integration, account sign-in, financial database, forms, analytics scripts or advertising trackers. The hosting and DNS providers necessarily process connection information such as IP addresses, request time, requested URLs and browser/network headers to deliver and secure the pages. Financial-app credentials and accounting data are not included in this website’s source or content. Do not put sensitive information in a website URL.
Security and privacy requests
The operator uses access restrictions, encrypted token storage and immediate field filtering, but cannot promise absolute security. Host compromise, memory inspection, operating-system swap and crash dumps remain risks. The owner controls app connection, synchronization, device certificates and backups. Contact todd@flycastdigital.com for access, correction or deletion requests or concerns. Applicable privacy rights, exceptions and notification obligations depend on the circumstances.
Changes
Changes to this policy will be posted here with an updated effective date. Any expansion beyond sole-owner internal use requires a review of these practices and the app’s security controls.