Privacy Policy

Effective October 16, 2026

This policy explains what information Slipstream Software (“we,” “us”) collects when you use SlipstreamTime, how we use it, and the choices you have. SlipstreamTime is used by businesses to track time and bill their clients, so most of the information in it is entered by our customers about their own work and clients. Our Terms of Service also apply.

Information we collect

• Account information — your organization’s name, and each user’s name, email address, role, and password (stored only as a one-way hash, never in readable form). Every sign-in also requires a one-time code we email to you; we keep only a scrambled form of each code, and it expires after 10 minutes. If you add business details in Settings, such as your business name, address, phone, email, and logo, we store those to show on your invoices.
• Customer data — what you and your users enter to run your business: clients and their contact and billing details, projects, time entries, expenses, vendors, services and pricing, and invoices.
• Connected-service data — if an administrator connects QuickBooks Online, the information described in the QuickBooks section below.
• Technical information — our servers record standard request logs, including IP address, browser type, the page requested, and time, which we use for security and troubleshooting. These logs are rotated automatically and kept only for a short period.

We do not use advertising, analytics, or tracking services, and we do not load scripts from third parties.

How we use information

We use information only to:

• provide, maintain, and secure the Service, including signing you in and preventing abuse;
• carry out the actions you ask for, such as generating and sending invoices or syncing with connected services;
• respond to your support requests and send you service-related messages, such as security or policy notices; and
• meet legal obligations.

We do not sell personal information, share it for advertising, or use your customer data to train AI models.

QuickBooks Online data

Connecting QuickBooks Online is optional and is done by an administrator, who chooses which QuickBooks company to connect on Intuit’s own consent screen. When connected:

• We access only the QuickBooks data needed for the features you use: looking up and creating customers so you can match them to your SlipstreamTime clients, creating invoices you choose to push or send, and reading invoice and payment status so invoices paid in QuickBooks are marked paid in SlipstreamTime.
• We store your QuickBooks company ID, the IDs of linked customers and invoices, and the access tokens Intuit issues. Tokens are encrypted at rest (AES-256-GCM) and are never shown in the app or shared with anyone.
• We use QuickBooks data only to provide those features to you. We do not sell it, share it with other customers or third parties, or use it for any other purpose.
• You can disconnect at any time from Settings. Disconnecting deletes the stored tokens and asks Intuit to revoke them, after which we can no longer access your QuickBooks company. You can also revoke access from within QuickBooks.

Service providers we share information with

We share information only with providers that help us run the Service, only as needed for that purpose:

• Hetzner Online — hosts our servers and database, in a data center in Ashburn, Virginia, USA.
• Intuit — only if you connect QuickBooks Online, as described above.
• Porkbun — our email provider, which delivers sign-in codes, email-verification and password-reset links (to the user’s own address) and, if you send invoices by email, those invoice emails.
• Stripe — processes SlipstreamTime subscription payments. You enter card details on Stripe’s own pages; they go directly to Stripe and never reach our servers. We receive only the subscription’s status, billing dates, and the name and email on the billing account.

We may also disclose information if required by law, to protect the rights, safety, or security of our users or the Service, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

Cookies

We use only these cookies, all necessary for the Service:

• se_session — keeps you signed in. It is secure and inaccessible to page scripts.
• se_mfa — for up to 10 minutes after you enter your password, remembers that you’re waiting to enter your emailed sign-in code. Secure and inaccessible to page scripts.
• se_reset — for up to 15 minutes after you open a password-reset link, lets you choose your new password. Secure and inaccessible to page scripts.
• se_theme — remembers whether you chose the light or dark theme.

We use no advertising or tracking cookies.

Data retention

We keep your account and customer data for as long as your account is active. When an account is closed, we delete its data from the live system. We keep access-restricted daily database backups for 14 days, so deleted data disappears from backups within that window. Request logs are kept only briefly and rotated automatically.

Security

All traffic to the Service is encrypted with HTTPS. Passwords are hashed, connected-service tokens are encrypted at rest, the database is not reachable from the internet, and access to our servers is limited and key-based. Each organization’s data is kept separate from every other organization’s. No system is perfectly secure, but we work to protect your information and will notify affected customers of a breach as the law requires.

Your choices and rights

Users can view and update their account information in the Service. Administrators can export and correct their organization’s data, and disconnect connected services at any time. To request a copy, correction, or deletion of personal information, or to close an account, email support@slipstreamtime.com. If your information was entered by a business that uses SlipstreamTime (for example, you are one of their clients), please contact that business first; we will help them respond.

Children

The Service is for businesses and is not directed to children. We do not knowingly collect information from anyone under 16.

Changes to this policy

We may update this policy. If a change is material, we will notify account administrators by email or in the Service before it takes effect, and we will always show the effective date at the top of this page.

Contact

Slipstream Software · support@slipstreamtime.com