Privacy Policy

Last updated: September 20, 2026

This Privacy Policy describes how the Marblehead Rotary Club (the "Club", "we", "us") handles information in connection with the treasurer's dashboard application at marbleheadrotary.app (the "App").

1. Who the App is for

The App is a private tool used by authorized Club officers to view summaries of the Club's finances. It is not offered to the general public and does not create accounts for members of the public.

2. Information the App accesses

QuickBooks Online data

With the authorization of the Club Treasurer, the App connects to the Club's QuickBooks Online company through Intuit's application programming interface. It retrieves the Club's company name and summary financial reports, specifically the Profit and Loss report, which lists income and expense totals by account. The App only reads reports; it never creates, changes, or deletes anything in the Club's books. It does not retrieve customer, donor, vendor, employee, or payroll records.

Connection tokens

To keep the connection working, the App stores the OAuth access and refresh tokens that Intuit issues to it. They are kept in Cloudflare Workers KV storage, which encrypts data at rest, and are used solely to request reports from Intuit on the Club's behalf.

Sign-in

Access to the dashboard is protected by a password shared only with authorized officers. The App does not ask for or store names, email addresses, or other personal information in order to sign in. A session cookie keeps you signed in; it contains an expiry time and a signature, nothing personal.

Technical logs

Cloudflare, which hosts the App, may record technical request information such as IP address, browser type, and timestamps for security and operational purposes, subject to Cloudflare's own privacy policy. The Club may review error logs to keep the App working.

3. How information is used

Financial data retrieved from QuickBooks Online is used only to display charts and tables of the Club's income and expenses to authorized users, for the Club's internal management and reporting. Snapshots of the reports are cached so the dashboard loads quickly and can show prior Rotary years.

4. Sharing

We do not sell, rent, or trade any information. Information is shared only with the service providers needed to operate the App (Intuit, which supplies the data, and Cloudflare, which hosts the App), or when required by law.

5. Retention and disconnection

Cached report snapshots are retained so that historical Rotary years remain viewable. The Club Treasurer may disconnect the App from QuickBooks Online at any time, either from the dashboard or from QuickBooks Online itself (Apps, then My Apps). Disconnecting revokes the App's tokens and removes them from storage.

6. Cookies

The App sets a session cookie after sign-in, a short-lived cookie during the QuickBooks authorization handshake, and a preferences cookie that remembers the reporting period and chart options you last chose. It uses no advertising, tracking, or analytics cookies.

7. Security

All traffic is served over HTTPS. Credentials for Intuit's services are stored as encrypted secrets on Cloudflare, and the App requests only the QuickBooks accounting scope it needs. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Children

The App is not directed to children under 13 and does not knowingly collect information from them.

9. Changes to this policy

We may update this Privacy Policy from time to time by posting a revised version at this address with a new "last updated" date.

10. Contact

Questions about this Privacy Policy may be directed to the Club Treasurer.