Security and privacy
What we hold, and what we never touch
Your clients trust you with their details, and you are trusting us with them in turn. This page says exactly what that means, in terms you can check.
We never see a card number
Card details are entered directly with Stripe and exchanged for a token. They do not pass through our server and are never stored by us. The same is true of the bank details a business enters for payouts: that form is hosted by Stripe, on Stripe’s pages.
Deposits are held, not forwarded
A deposit sits with us until the appointment is marked complete, then is released to the business. That is what makes a refund a refund rather than a request to send money back, and it is why a cancelled booking does not need to claw anything out of anybody’s account.
Every request is authenticated and attested
Requests carry a signed identity token, and the database additionally requires App Check attestation, so a request from something other than our app is rejected before it reaches your data. Database rules enforce who may read and write each record rather than trusting the app to ask nicely.
Error reports are stripped before they leave
Crash and error reports are scrubbed for authorisation headers, session tokens, secrets and anything card-shaped before being sent. Monitoring should tell us what broke, not who it broke for.
Rate limits on anything that costs money or sends mail
Payment, email and login endpoints are individually rate limited, so a leaked link or a scripted client cannot be turned into a bill or a mailbox full of messages.
You can take your data, and you can leave
Export your data or delete your account from inside the app, without emailing anybody to ask. Deleting removes your profile and detaches your payment records; completed bookings are retained where a business needs them for its own accounts, and we say so rather than implying everything vanishes.
Who else processes your data
Every third party that touches personal data on our behalf, what they do, and what they can see. If this list changes, this page changes with it.
| Service | What it does | What it can see | Where |
|---|---|---|---|
| Stripe | Deposits, card payments, and payouts to businesses | Customer name and email, booking amounts, and for businesses the payout and identity details they enter on Stripe’s own pages | United States, with EU and Canadian processing under Stripe’s own terms |
| Google Cloud / Firebase | Accounts and sign-in, the database, file storage, and app attestation | Account details, business profiles, services, bookings, reviews, and uploaded images | Regional Google Cloud data centers |
| Cloudflare Stream | Hosting and delivering the video clips in The Chair | Uploaded clips and their playback metrics. No account data | Global edge network |
| Resend | Booking confirmations, reminders, and account emails | Email address and the contents of the message, such as appointment details | United States |
| Sentry | Error monitoring, so faults are found before they are reported | Technical error data only. Authorisation headers, tokens, secrets and card-shaped fields are stripped before anything is sent | United States |
| Railway | Hosting the application server | Data in transit through the server, and application logs | United States |
| Apple and Google | Subscription billing for the Grow and Pro plans | The purchase record. Payment details stay with the app store and are never sent to us | Global |
Reporting something
If you think you have found a security problem, email security@burgundyblend.com. Tell us what you found and how to reproduce it. We will confirm we received it, and we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before publishing.