Privacy Policy

1. Who we are

This Privacy Policy describes how Park Four, LLC (“we,” “us,” or “our”) collects, uses, and protects information when you use this instance of FOQB (the “Service”). If you have questions about this policy, contact us at paul@parkfour.com.

2. What we collect

• Account information: your email address and password (handled by our authentication provider; we never see or store your password in plain text).
• Financial data you provide: the accounts, transactions, invoices, bills, customers, vendors, and other bookkeeping records you enter directly.
• Bank data, if you choose to connect a bank account: account balances and transaction history, retrieved via Plaid on your explicit authorization. We never receive or store your bank login credentials — Plaid handles that connection directly and gives us only an access token and the data you’ve authorized us to see.
• Activity records: an audit log of changes made to accounting records and organization membership, so you and other members of your organization can see who did what and when.

3. How we use it

We use your information solely to provide and maintain the Service: to record and display your bookkeeping data, to sync bank transactions you’ve authorized, and to operate account and organization management. We do not sell your data, and we do not use it for advertising or share it with third parties for their own marketing purposes.

4. Third parties we work with

• Plaid, Inc. — if you connect a bank account, Plaid facilitates that connection and shares transaction data with us on your behalf, subject to Plaid’s own privacy policy.
• Supabase — provides the database and authentication infrastructure the Service runs on.
• Vercel — hosts the application itself.

5. How long we keep your data

Your data stays in your organization for as long as you or your organization’s members keep using the Service. You can download a full export of your organization’s data at any time from Settings. If an organization is deleted (by its own decision, or by a site administrator for cause), its records are permanently removed, except for a minimal record of the deletion itself — the organization’s name and the date it was deleted — kept so former members can be told what happened to their organization. Its bank connections are also removed at Plaid.

Bank transactions you’ve imported are part of your books, so they stay after you disconnect a bank; disconnecting stops any further access to that bank immediately. Deleted data can remain in our encrypted backups until they rotate out, which takes at most 8 weeks. Rate-limiting records, which include IP addresses, are deleted automatically within 24 hours.

6. Security

Bank access tokens are encrypted at rest. All traffic to the Service is encrypted in transit. Each organization’s data is isolated from every other organization’s at the database level, enforced independently of the application code. We can’t guarantee perfect security, but we take reasonable, industry-standard measures to protect your information.

7. Your rights

You can access and export your organization’s data at any time. You can ask us, at paul@parkfour.com, to delete your account or your organization’s data, subject to any records we’re required to retain by law. We complete deletion requests within 30 days. When you agree to our Terms of Service and this Privacy Policy, we record which version you agreed to and when, and ask you to agree again whenever either one changes.

8. Children’s privacy

The Service is not directed to, and we do not knowingly collect information from, anyone under 16 years old.

9. Changes to this policy

We may update this policy from time to time. We’ll update the “Last updated” date above when we do.

10. Contact us

Questions about this policy? Email paul@parkfour.com.