Last updated: October 11, 2026

Allospend uses Stripe Connect (Accounts v2) and Stripe Identity to onboard organizers and to help them collect group payments. When a backer pays through Allospend, the payment is processed by Stripe and routed to the organizer's connected Stripe account as a destination charge. Organizer funds are not intended to settle into an Allospend master balance.

Allospend collects a platform fee at payment time through Stripe's standard platform-fee mechanism. The fee is computed from the organizer-elected policy mode (two are live today — "group-covers" and "I-cover-fees" — and a third, "Premium waiver," is documented in legal/fee-schedule.md §13.2 and will be enabled when Premium ships) and a cents-exact quote snapshot (the exact fee and the backer's total, locked in before the payment is requested). Stripe may also charge processing, payout, dispute, refund, or account fees according to Stripe's terms and the organizer's connected-account configuration.

Organizers must complete the required payout setup before collecting payments. This setup includes Stripe Connect onboarding (Accounts v2), Stripe Identity session completion (the on-device Identity verification with liveness checks), tax/business information, and a payout-bank signal. Allospend may pause payment-link creation, payouts, or withdrawals when Stripe reports missing requirements, account restrictions, deauthorization, suspected fraud, or compliance risk.

The signed payment confirmation from Stripe is the durable record of payment success. Allospend's reconciliation job periodically reconciles the locked-in quote snapshot against Stripe's authoritative state to repair missed or delayed confirmations. Backer-facing quote amounts always agree with the cents persisted on the quote snapshot; any provider-amount drift against the snapshot is detected at confirmation time and logged with a coded severity and a unique reference number.

Apple Pay split payments use a claim-token + device-binding lifecycle. The public claim URL (e.g. https://app.allospend.app/pay/<groupId>) carries a server-issued, short-lived claim token; the fingerprint of the claiming device is recorded against the token at claim time and re-verified on every subsequent request, so a copied URL alone does not grant access. The claim token and device fingerprint are validated server-side on every read of the per-backer link, and the fee allocation snapshot is bound to the claim — not to the public group identifier — to prevent cross-slot payment replay.

Refunds, disputes, reversals, and failed payouts may reduce the organizer's Stripe balance or create a negative balance that Stripe or Allospend may recover according to applicable terms. Allospend may require evidence or additional information from the organizer to respond to disputes. Apple Pay charges processed under the destination-charge model follow Stripe Connect's refund and dispute procedures: the platform fee is retained on a confirmed dispute (per Stripe Connect terms); partial refunds pro-rate the platform fee proportionally to the refunded amount.

This disclosure is a product and compliance summary, not legal, tax, or financial advice. Stripe's own terms, account agreements, and disclosures also apply.

Note (2026-08-27): The customer-facing term "backer" has been replaced with "backer" in this document, consistent with the "backer" rename mapping. IRS-statutory language in legal/financial/tax-information-disclosure.md is preserved verbatim per regulator requirements.

Addendum A — Trial Bill-Split Mode (2026-09-08, §6.1)

Added to record the Trial Bill-Split Mode rollout.

Plain-English Summary

Allospend operates in two payment rails during the organizer-facing trial mode:

1. Apple Pay — processed by Allospend through our Stripe Connect integration. Funds are routed to the organizer's verified bank account. Allospend is the merchant of record; the backer's card never touches the organizer's bank directly.
2. Cash App, Venmo, and PayPal deeplinks — opened by the backer as a third-party deeplink to the organizer's existing handle. Allospend does not process these transactions. The backer pays the organizer directly through that third-party service using their own account. Allospend does not escrow funds, does not verify the transfer succeeded, and does not provide buyer protection for these transfers.

Why Two Rails

The trial mode exists so an organizer can collect their first few splits before completing Stripe Connect (the verification that lets Allospend route Apple Pay on their behalf). For backer convenience, the trial sheet surfaces the organizer's stored Cash App, Venmo, and PayPal handles so the backer can pay through whichever rail they already have. After the organizer completes Connect (typically within their first 7 days or after 2 free splits, whichever comes first), Apple Pay is the only available rail — Cash App, Venmo, and PayPal are removed from the picker.

What This Means for Backers

• Apple Pay path: Standard Stripe checkout. The backer's card statement will show "Allospend" with the group name. Funds are protected by Stripe's dispute resolution.
• Cash App / Venmo / PayPal deeplink path: The backer is redirected to the third-party app and pays the organizer's handle directly. The backer is paying the organizer, not Allospend. Allospend does not record the transfer; the backer is responsible for confirming the organizer received the funds. Cash App, Venmo, and PayPal each have their own buyer-protection terms; we encourage backers to read them.
• Tip jar / personal collections: When an organizer creates a one-member group (only the organizer in the slot list), the deeplink path renders to the organizer's handle. The organizer receives the funds directly. No split credit applies in this case (a pure-collector group does not qualify for the $5 split-credit bonus).
• Refund and dispute resolution for Cash App / Venmo / PayPal flows is handled by the third-party service, not by Allospend.

What This Means for Organizers

• During trial (before Connect), Apple Pay is locked with a 🔒 badge in your picker. Cash App, Venmo, and PayPal are unlocked. Backers see the same locked badge and can pick whichever rail they prefer.
• After Connect, Apple Pay unlocks and becomes the default. The deeplink alternatives are removed from the picker.
• Tax reporting: Allospend issues a 1099-K (or equivalent) for funds processed through Stripe. Funds received through Cash App / Venmo / PayPal are reported by those services per their own tax terms; Allospend does not issue a tax form for them.
• Service fee: Allospend's service fee applies only to Apple Pay transactions (processed by Stripe). Cash App / Venmo / PayPal transfers have no Allospend service fee; the third-party service's own fees may apply.
• Split credit subsidy: The $5 split bonus credited after your second split applies to Apple Pay transactions only and expires 30 days after grant.

Change Log

§4 — Organizer Connect Management

After an organizer completes Stripe Connect onboarding (see §1 and Addendum A), the organizer can manage their Connect account from inside the Allospend iOS app. This section discloses the post-onboarding management surface.

§4.1 — Destination Card and Update Flow

The organizer's verified bank account or card — the destination Stripe pays their Connect balance out to — is surfaced on the Connect management dashboard (OrganizerPayoutView in the iOS app) as a destination card. The card shows:

• The default destination (bank or card), its last four digits, and its verification status.
• Any secondary destinations the organizer has added (Stripe Connect supports multiple external accounts; the iOS surface lists them all).
• The current country (User.connectAccount.country) and default currency (User.connectAccount.defaultCurrency).
• Any requirements.currently_due items Stripe is asking the organizer to provide (e.g. an updated tax ID). These surface as a banner with a one-tap "Update now" CTA.

Tapping the destination card's Update bank or info CTA opens the iOS Update sheet (UpdateInfoSheet). The sheet lets the organizer pick between three purposes:

• Update your legal name, address, or tax ID (mapped to the update_info wire value).
• Change the bank or card Stripe pays out to (mapped to the change_destination wire value).
• Provide additional information Stripe is asking for (mapped to the resolve_requirement wire value).

Selecting a purpose and tapping Continue in Stripe triggers POST /api/v1/connect-payouts/me/account-link. Allospend calls Stripe's accountLinks.create API server-side; the response includes a one-time URL. The iOS app opens the URL in SFSafariViewController (the system Safari view controller inside the app), so the organizer stays inside Allospend from the user's perspective but the actual form is hosted by Stripe.

Important: Allospend does not see, store, or process the bank account number, card number, routing number, or any other payment-credential data entered in the Stripe-hosted form. The form is owned and operated by Stripe; Stripe's data-protection and PCI-DSS scope applies to it. Allospend receives only the verification status (verified / pending / restricted / disabled) and the last4 of the destination when Stripe redirects the organizer back to Allospend.

The return link dismisses the hosted flow and refreshes the Payouts or wallet screen from which the organizer opened it. The refreshUrl reopens the Stripe-hosted form if it expires or errors mid-session. The iOS app listens for allospend://connect/return and dismisses the sheet + refetches the destination bundle.

§4.2 — Incoming-Transaction History

The Connect management surface also surfaces the incoming-transaction history — every backer payment that has landed in the organizer's Connect balance, with the linked group name, backer handle, status (available or pending), and gross / fee / net cents amounts. The history is read-only: organizers cannot move money, cancel, or refund from this surface. The history is sourced from Stripe's balanceTransactions.list API and joined server-side to Allospend's WalletTransaction ledger so each row carries the group + backer context.

Stripe rows that have no matching WalletTransaction (e.g. an entry from before Allospend's ledger was introduced, or a one-off adjustment) are surfaced with a reconciliationFlag: "no_wallet_txn" and a "Pending reconciliation" badge in the iOS UI. The badge is intentionally honest: it means Allospend has not yet linked that Stripe row to its local ledger. Until the bounded reconciliation worker described in docs/CODE_RECONCILIATION.md is qualified and enabled, the badge does not carry a 24-hour repair promise; organizers can contact support if it persists.

§4.3 — funds_received Push and Email Notifications

Your funds-received notices tell you when payments reach your Connect balance. Push and email each have a separate Settings → Notifications switch. Both start OFF and require a recorded choice. Turning on push does not turn on email or marketing.

• Payments are grouped into five-minute UTC windows. A worker checks closed windows once a minute. An eligible notice can take about six minutes to start sending when there is no backlog; capacity limits or provider delays can add time. This is not a promise of when a message will reach your inbox or device.
• Push shows the payment total and count. It opens Incoming Payments, where you can see the payment details. The email also shows Allospend fees and explains that the payment total is not your available balance. Neither message includes full bank or card details or promises an arrival date at your bank.
• Push is suppressed from 9 PM to 8 AM in your saved timezone. A missing or invalid timezone also suppresses push. Email uses its own consent and verified address. A suppressed notice is not sent later when your settings change.
• Each channel allows at most ten notice batches per UTC day. Prepared or uncertain sends count toward that limit, including when provider receipt cannot be confirmed. Retried work keeps its original request and provider key; replayed payment events cannot create another recorded payment identity while the retained event exists.
• You can turn either channel off in Settings → Notifications. The email unsubscribe link stops only funds-received email; push and marketing choices stay the same. Opening the link shows a confirmation page without changing your choice. Confirming it or using your mailbox’s one-click unsubscribe withdraws the email choice without signing in. The link expires after 31 days; app settings remain available afterward.

Operational notification events and batches expire after eight days, reconciliation records after 30 days, and withdrawal capabilities after 31 days. Expiry cleanup can lag; authorization checks enforce capability expiry immediately. Account deletion removes the associated records through the rights-request process. Financial records and existing consent-history retention follow their separate schedules. Turning management or delivery off preserves valid issued unsubscribe links and the keys needed to honor them.

§4.4 — What's Out of Scope (V1)

The following capabilities are deliberately not shipped in V1 and are tracked as V1.1 follow-on gaps. They are disclosed here so organizers have a complete picture of what's coming.

• In-app instant payout trigger. Per the master plan (§1.2(f) of plans/ORGANIZER_CONNECT_MANAGEMENT_SURFACE_V1_PLAN_2026_09_30.md), the in-app "payout now" button is deferred. Stripe pays out under the account's configured schedule; Allospend does not promise organizer access to Stripe Dashboard because that dashboard is disabled for this configuration. A small "On-demand payouts ship later" line on the destination card sets expectations.
• Multi-currency destinations. The V1 surface is USD-only per the Path B / Design A USD-first plan. Multi-currency destinations land in V1.1 when Allospend supports non-USD groups.
• Web consumer surface. The Connect management dashboard is iOS-only for V1. There is no marketing-website or admin-dashboard counterpart.
• Organizer self-export of the incoming-transaction history. V1 organizer export is admin-only via the existing WalletTransaction admin CSV. Organizer-facing CSV / PDF export ships in V1.1.

§4.5 — Cross-References

• See legal/financial/aml-kyc-program.md for the Account Link issuance as the canonical remediation path for organizer-driven KYC updates.
• See legal/privacy-policy.md §5 for the data-collection list of the incoming-transaction history + push-token delivery.
• See legal/data-protection/data-processing-addendum-template.md §2 for Stripe's role as a sub-processor for the Account Link flow.
• See legal/financial/tax-information-disclosure.md for how the incoming-transaction history supports organizer tax reporting.