Privacy Policy
Heartland Flips Sentinel · Effective 16 September 2026
1. Who operates this application
This application (“Sentinel”) is operated by Heartland Flips, LLC for its own internal business use. It is not offered to the public, not sold, and not made available to other organizations. Questions may be directed to matt@bartlettholdings.com.
2. Scope
This policy covers the Sentinel application hosted at
heartland-flips.orgendgame.com, including its connection to QuickBooks Online
and to Salesforce. It does not cover Intuit's or Salesforce's own handling of data, which is
governed by their respective privacy policies.
3. Whose data this application handles
Sentinel accesses the business records of Heartland Flips, LLC itself. It does not collect information from visitors, customers, or members of the public. There is no public sign-up, no marketing list, and no consumer-facing feature of any kind.
4. What data is accessed
| Source | Data | Direction |
|---|---|---|
| QuickBooks Online | Company information, financial reports (profit and loss, balance sheet), and accounting records for a single connected company | Read only |
| Intuit OpenID | Basic account identity for the connecting user | Read only |
| Salesforce | Aggregate lead counts | Read only |
Sentinel issues read requests only. It does not create, modify, or delete records in QuickBooks Online.
5. What is stored, and where
- OAuth tokens. The QuickBooks access token, refresh token, and company identifier are
stored on the application's own server in a file readable only by the application account
(
0600permissions). - Application credentials. The Intuit client ID and client secret are stored the same way. They are never displayed in the interface after being entered and are never written to application source files.
- Financial figures. Reports are requested from QuickBooks at the time they are viewed and rendered in the browser. Financial figures are not written to a database or retained on the server.
- Access logs. Sign-in attempts are logged with a timestamp, username, and source IP address, for security monitoring.
6. How data moves
All communication between the browser and Sentinel, and between Sentinel and Intuit, uses HTTPS with TLS. Access tokens are transmitted only to Intuit's documented API endpoints.
7. Who can access the data
Access requires a username and password. Passwords are stored salted and hashed (PBKDF2-HMAC-SHA256, 600,000 iterations) and never in plaintext. Sessions are protected by an HttpOnly, Secure, SameSite cookie and expire after 12 hours of inactivity. Repeated failed sign-in attempts are rate limited per source address and per account. At present the only authorized user is the owner of Heartland Flips, LLC.
8. Sharing with third parties
Data retrieved through this application is not sold, rented, shared, or disclosed to any third party. There are no advertising networks, analytics providers, tracking pixels, or data brokers involved. The only external services contacted are Intuit and Salesforce, and only to retrieve the organization's own records.
9. Retention and deletion
OAuth tokens are retained only while the QuickBooks connection is active. Using the Disconnect control revokes the token with Intuit and deletes the stored credentials from the server. Access may also be revoked at any time from the Intuit account's connected-apps settings. Access logs are retained only as long as the server's ordinary log rotation keeps them.
10. Security
Measures in place include TLS for all traffic, restrictive file permissions on stored secrets, hashed passwords, session expiry, brute-force rate limiting, CSRF protection on state changing forms, and single-use OAuth state parameters. No system is perfectly secure; this application is an internal business tool and is operated accordingly.
11. Children
This application is a business tool and is not directed to or usable by children.
12. Changes
If this policy changes, the revised version will be posted at this address with an updated effective date.
13. Contact
Heartland Flips, LLC — matt@bartlettholdings.com