The credit card stuff is handled by stripe which I thought was a favorite around here. It uses their js API which strips out all cc info before passing it on to the website.

By the way, I love stripe! I've used authorize.net for a decade and it is amazing how slick they'be made charging a credit card.

People are upset that the information is being sent to your servers.

Stripe is unique in the fact that it sends it all through an ajax call directly to the stripe servers and returns a token for you to use for re-charging, bill cancelling, etc.

I just started using it for a few projects.

The cc info doesn't get sent to my (or herokus) servers. All I get is a stripe token that I send to stripe. They get the cc info.

Then you should make that explicit. It looks like I'm sending my credit card info to you, not stripe.