Counting Carrots Privacy Policy
Effective November 11, 2026
What's new. The app no longer makes encrypted files of your books for your accountant, so section 2 no longer describes them. Since November 10, 2026, the log file the app keeps on your computer (section 2) records the full location of each company file and backup, which can include your computer's user name.
This policy explains what information One Part Rain, LLC, a Georgia limited liability company ("Counting Carrots", "we", "us"), collects when you buy a Counting Carrots license, visit countingcarrots.com, use the app, or write to us, and what we do with it. Our terms of use cover the rest of our agreement with you.
1. Your books and payroll stay on your computer
Counting Carrots is an app you run on your own computer. Your company file, with your books (bank transactions and receipts included), payroll, company, and employee information, stays on your computer (or wherever you save it). There's no Counting Carrots account and no Counting Carrots server that keeps it, and the app never sends it to us. We can't see it.
The information in your company file about your employees and contractors belongs to your business, and your business is responsible for it: for having the right to collect and keep it, for keeping it secure, and for what it does with it, including whom it sends it to with the app. The app is a tool your business uses; we don't hold or process that information for you.
2. What the app does with your information
Everything below happens on your computer, or between your computer and services you choose. Apart from SimpleFIN Bridge (below), none of it goes through us.
Email the app sends for you
When you email pay stubs, W-2s, 1099s, consent requests, B notices, or blank forms from the app, they're sent through the email provider you set up in the app, with your own email account and app password, just as if you'd sent them yourself. These messages contain names and pay, and W-2s and 1099s contain full Social Security numbers or taxpayer identification numbers. We never see them. Your email provider, and each recipient's, handles them under its own terms. Choosing to send tax forms by email is your business's decision and responsibility, and the law requires the recipient's consent first; the app helps you ask for and record it.
Sharing with other computers
If you turn on sharing, the app serves your company file to other computers on your network, over an encrypted connection with its own certificate, to people who sign in with the name and password you give them. Your information goes directly from your computer to theirs, not through us. Whoever you invite can see and change what their permission allows. Your business is responsible for whom it invites and for the security of its network.
Connecting your bank
You can keep your books by importing files you download from your bank, or by typing transactions in; neither involves anyone else. If you choose to connect a bank instead, you do it through SimpleFIN Bridge, a paid service operated by One Part Rain, LLC doing business as SimpleFIN. SimpleFIN Bridge has its own terms and privacy policy, which cover the bank sign-in and transactions it receives: you sign in to your bank at SimpleFIN Bridge, which gives SimpleFIN (and the services it uses to reach banks) your bank sign-in and those accounts' transactions. The Counting Carrots app then gets those accounts' balances and transactions from SimpleFIN Bridge directly, on your computer. The Counting Carrots website and license system never receive them. The connection is kept encrypted in your company file, with the same key as Social Security numbers. It isn't written to the log file, isn't included when you export all your data, and isn't sent to the other computers you share the file with. To stop SimpleFIN reading your bank, remove the bank at SimpleFIN Bridge as well as disconnecting it in the app.
Reading scans and photos
When you add a scan or photo of a Form W-4, W-9, or I-9, the app reads it with a text-recognition engine built into the app, on your computer. Nothing is uploaded to us or to anyone else to read it.
Passwords and keys
Social Security numbers are stored encrypted in your company file. Each company file's encryption key, and the password for your email account, are kept in your computer's secure store: the Keychain on a Mac, Credential Manager on Windows, or the Secret Service (such as GNOME Keyring or KWallet) on Linux. On a Linux computer without one, they're kept in a file only your user account can read, and the app tells you so. To open your company file on another computer, you need its recovery code, which the app shows you. Keep it safe: we don't have it and can't recover it for you.
Backups
The app backs up your company file to a folder you choose. If that folder is on a cloud drive (such as iCloud Drive, Dropbox, OneDrive, or Google Drive), the backups are kept by that provider under its own terms.
Checking for updates
Each time it starts, the app asks our website whether a newer version is available. That request says which version of the app you have, and shows our web host your IP address. If you choose to download an update, the download you're sent to shows which operating system it's for. The request contains nothing from your company file.
Feedback and crash reports
When you send feedback from the app (Help → Feedback…), or a report from the page shown when a page crashes, what you write, the email address you give so we can reply, the app's version and operating system, and anything you choose to include (the window's screenshot with names and numbers blocked out, pictures you add, or the log file) go to our website, which emails them to us through Postmark. Nothing else from your company file goes with them, and nothing is sent until you press Send. The app remembers the email address you gave, on your computer, for next time.
The log file
The app keeps a log on your computer of what it did, to help work out a problem: things like starting up, opening files, pages opened, backups, emails sent, updates, and errors. It records where things are on your computer: where the app and its settings are, and the full location of each company file you open and each backup. A location often includes the user name you sign in to your computer with, which may be your name. Otherwise it doesn't record names, Social Security numbers, or pay amounts: when you save a change it notes which fields changed, not what you typed, and anything shaped like a Social Security number or an amount in an error message is hidden. You can see it with Help → Show Log File. It stays on your computer unless you send it to someone.
3. What we collect
- When you buy a license: the name you want on the license, your email address, and the record of your purchase (what you bought, when, and the price). Stripe runs our checkout and is the seller of record: it collects your payment details, billing address, and whatever it needs to work out sales tax, under its own privacy policy. We never see your card number.
- When you ask us to email your license again: the email address you enter.
- When you write to us, by email or from the app: your email address and whatever you include in your message. If you send us your log file, a company file, a backup, or a screenshot, we receive whatever is in it, which for a company file means your books, your payroll, and your employees' personal information. Send only what we ask for, and only what you have the right to share.
- When you visit the website, or the app checks it: like every website, ours receives your IP address, the address of the page you asked for, the time, and what your browser or the app reports about itself (for the app, its version number and, when it sends you to an update, which operating system it's for). The app asks the website whether a newer version is available each time it starts; that request contains nothing from your company file.
- When you sign up for the newsletter: your email address, which our website passes to beehiiv. You can unsubscribe from any email we send.
- Downloads: the app's downloads are kept on GitHub, so when you download Counting Carrots or an update, GitHub receives your IP address under its own privacy statement.
The website uses no cookies, no advertising, and no analytics or tracking services, and it doesn't follow you to other sites, so it treats everyone the same whether or not their browser sends a "Do Not Track" signal.
4. How we use it
We use your name and email address to make your license, email it to you, email it again when you ask, and help you when you contact us. We use a log file or company file you send us only to answer your question. We use the purchase record for the same reasons and to handle refunds and keep the business's records. We use website and server logs to run the site, find and fix problems, and keep it secure. We don't sell or rent your information, we don't share it for advertising, and we send you marketing email only if you sign up for the newsletter.
5. Who else handles it
We share information only with the companies that help us run Counting Carrots, and only for that:
- Stripe runs checkout, takes payment, collects sales tax, sends receipts, and handles refunds. It keeps the purchase records we make your license from.
- Postmark sends the emails with your license in them, and delivers to us the feedback and crash reports you send from the app.
- beehiiv keeps the email addresses of people who sign up for our newsletter, and sends the newsletter.
- Fly.io hosts the website and keeps its server logs.
- GitHub hosts the app's downloads.
- Our email provider receives the messages you send us.
We may also share information when the law requires it, to protect our rights or others' safety, or with whoever takes over Counting Carrots if the business is sold.
6. How long we keep it
We keep your name, email address, and purchase record for as long as Stripe keeps its record of your purchase, with no set end date, because that record is how we make your license and send it to you again if you lose it. Server logs are kept by Fly.io under its usual retention, for a limited time, and then deleted. Emails you send us are kept as long as they're useful to help you. A log file, company file, or backup you send us is deleted once your question is settled.
7. Your choices
You can ask us what information we have about you, ask us to correct it, or ask us to delete it, by writing to support@countingcarrots.com. We'll do what the law requires and what we reasonably can. Some records, such as purchase and tax records, Stripe or we may have to keep; and once your purchase record is deleted, we can't send you your license again. Depending on where you live, you may have other rights under your local privacy law, and you can use them the same way.
8. Security
The website uses HTTPS, and we give access to what we keep only to those who need it to run Counting Carrots. The security of your computer, your network, your email account, and your company file and its backups is up to you. No system is perfectly secure, so we can't promise that nothing will ever go wrong.
9. Children
Counting Carrots is for businesses. It isn't meant for children, and we don't knowingly collect information from anyone under 13.
10. Changes
When we change this policy, we'll post the new version here with a new effective date. If a change is significant, we'll also say so on the website or in the app.
11. Contact
Questions or requests about your information: support@countingcarrots.com.