A plain-language account of what the app accesses, what it stores, what it cannot do, and which service providers are involved.
The current integration creates Stripe Financial Connections sessions with the transactions permission only. Stripe shows the requested access during its connection flow and the user chooses whether to authorize it.
PowerPayoff retrieves pending and posted transactions. Stripe also supplies basic account metadata such as institution, account nickname, account type, connection status, and the last four digits of the account number.
The connection happens in Stripe's Financial Connections flow. Stripe, your financial institution, or their connectivity providers may handle the credentials needed to link the account; PowerPayoff does not receive or store those bank credentials.
The integration does not request Stripe's payment_method permission and contains no flow to initiate ACH payments, transfers, or payouts from a connected financial account.
The current connection does not request Stripe's balances or ownership permissions. PowerPayoff instead asks users to confirm current balances and enter card terms such as APR, credit limit, and statement dates.
The account-management screen provides a disconnect action. It calls Stripe's disconnect API and deletes PowerPayoff's local connected-account record and its related local financial records.
Stripe documents Financial Connections permissions and the data available for each permission in its Financial Connections fundamentals.
The app keeps the data needed to operate account access, financial tracking, alerts, and subscriptions. This includes:
PowerPayoff supports email/password and Google sign-in through Supabase Auth. Database policies use the authenticated user ID to limit browser access to that user's rows. Row-level security is a layer of authorization, not a claim that unauthorized access is impossible.
Financial-connection and billing operations validate the user's access token on the server. Provider secret keys are accessed only by server-side functions and are not included in the browser bundle; the browser receives only publishable keys. Stripe billing webhooks are checked using Stripe's signature.
Production browser and provider connections use HTTPS/TLS. Application data is stored in managed Supabase Postgres; Supabase states that project disks are encrypted at rest with AES-256. These are provider controls, not end-to-end encryption that prevents PowerPayoff from processing data to provide the service.
Weekly email snapshots start disabled. Enabling requires a confirmed account email and an eligible subscription. Users can turn reminders off in Settings or through the tokenized link in each reminder; account and billing emails remain separate.
For provider details, see Supabase's RLS documentation, Supabase's password-storage documentation, and Stripe's security documentation.
Runs the account-linking flow and supplies the transaction data and basic account metadata that a user authorizes. Stripe documentation
Hosts subscription Checkout and the customer billing portal, processes payment-card data, and sends signed subscription webhooks. Stripe security
After Affiliate tracking consent and only when referral context exists, Rekomi receives click, referral, campaign, network and device-risk signals—including IPQualityScore technology invoked through Rekomi—to resolve the referring partner and assess attribution fraud. Separately, Rekomi's connection to PowerPayoff's Stripe account receives sale, renewal, refund and cancellation events used for commission accounting. The browser handoff sends only the Rekomi Referral Partner UUID into Stripe metadata; it does not expose connected-bank data or full payment-card details to the browser loader. Rekomi security
Hosts and delivers the frontend, terminates TLS, and provides Cloudflare's network-level protections. Cloudflare documentation
SMS enrollment and delivery are currently unavailable. PowerPayoff retains disabled integration code and may retain prior phone and consent records. Any future SMS offering would require a new product, consent, security, and delivery review before Twilio could process new messages. Twilio privacy notice
Provides authentication, managed Postgres storage, APIs, and server-side Edge Functions. Supabase security
Delivers transactional account and subscription emails plus user-enabled weekly snapshots. It receives the recipient, subject, message content, and delivery metadata. Weekly snapshots may contain aggregate estimates but omit account identifiers and transaction details. Resend privacy policy
Authenticates users who choose Google sign-in and returns the basic profile information authorized during that flow. Google also serves a display font used on the marketing site. Google privacy policy
A provider's certifications and controls apply to that provider's services. They do not mean PowerPayoff itself holds the same certification, and no internet service can guarantee absolute security.
Last reviewed against the application implementation: September 7, 2026.