Privacy Policy

Last updated: August 2026

1. What We Collect

We collect your email address when you create an account. During calculations, we temporarily receive the file you upload (an IBKR Flex Query XML, Questrade Activity Report XLSX, Wealthsimple activity CSV, an ActiveACB Raw Trades export, or another broker's CSV or XLSX file) in order to process your tax data. This file is written to a temporary directory on the server for the duration of processing and deleted immediately once a response is returned.

To prevent abuse of the free trial, we collect a hashed device identifier from your browser and a hashed combination of your IP address and browser identification string. These values are one-way hashes. We store them instead of the underlying device and network details, and we use them only to recognize repeat free trials.

We also record a small set of product-analytics events. Some are tied to your account when you calculate, hit the paywall, complete a calculation, start checkout, or complete payment. They include the broker type and tax year involved. If you reached us through one of our own campaign links, including referral links, we also record that tagged landing before sign-in and carry the same campaign label into later calculation and checkout events. We use this only to understand how the product is used and which of our own efforts bring people here. These events never include your uploaded file, file name, calculation figures, IP address, or device information. The measurement happens entirely on our own servers and is never shared with an advertising network.

If a friend creates an account or makes a purchase through your referral or affiliate link, we record that the link belonged to your account so the referral credit can be applied.

If you are approved for the affiliate program, we store your payout email address so we can send your commission by e-transfer.

2. What We Don’t Collect

We do not store your uploaded files. We do store calculation results, tax summaries, broker type, and aggregate figures in your account to provide calculation history and export features. We do not use third-party analytics, advertising networks, or tracking pixels. We do not sell your data to any third party under any circumstances.

3. Cookies and Local Storage

The application does not set its own access-control cookie. If you create an account and log in, session state is stored in your browser’s localStorage by the Supabase authentication library. If you arrive through one of our campaign links, including referral links, your browser also keeps the first and the most recent of those links in localStorage so we can tell which one led to a calculation or a purchase. Clearing your site data removes it.

4. Third Parties

This service uses Supabase for user authentication. If you create an account, your email address is stored by Supabase and subject to their Privacy Policy. We do not share your personal data with any third party for marketing or analytics purposes.

Payments are processed by Stripe, Inc. When you purchase season access, your payment details are transmitted directly to Stripe; they never pass through our servers. Stripe may store your email address to process your payment and send receipts. See Stripe’s Privacy Policy.

Transactional and account emails (account confirmation, password resets, season activation, referral reward notices, and a once-a-season reminder) are sent through Resend. Your email address is shared with Resend solely for email delivery. Every email we send includes an unsubscribe link; you can also change this on your profile page. The optional T5008 season reminder goes out only if you tick the box on your results page. That choice is stored in your account settings, and you can turn it off on your profile page or with the unsubscribe link in the email. See Resend’s Privacy Policy.

The application itself runs on Railway, our hosting provider: calculations execute on Railway infrastructure, and the temporary processing directory described in section 1 lives on it for the seconds a calculation takes. See Railway’s Privacy Policy. Traffic to the site is routed through Cloudflare, which provides DNS, content delivery, and security filtering and therefore handles connection metadata for every request. See Cloudflare’s Privacy Policy. Neither provider receives your data for any purpose other than operating the service.

Where your data is processed and stored. Application processing runs in Railway’s US West region (California, USA), and the database is a Supabase project hosted on AWS us-west-2 (Oregon, USA). Your personal information is therefore processed and stored in the United States, where it is subject to United States law and may be accessible to United States authorities under lawful access requests. We rely on the contractual and security safeguards described in this policy when transferring data to these providers.

5. Data Retention

Uploaded files are written to an isolated temporary directory during processing and removed when the calculation finishes or fails. They are never stored in the account database. Calculation result JSON, summary metadata, filename, broker type, and aggregate tax figures are stored with your account so you can view calculation history and regenerate reports. To limit retention, Standard and Pro accounts keep only your 25 most recent calculations; Accountant licenses retain full history.

Product-analytics events (described in section 1) are retained for 180 days and then automatically deleted. Events tied to your account are also deleted, along with the rest of your data, when you delete your account.

Operational request logs, used for security monitoring and troubleshooting, record request paths, response codes, and the account email associated with authenticated requests. They never contain uploaded file contents or calculation figures, and they expire automatically after a period measured in days on our hosting provider.

6. Client Records (Accountant License)

If you hold an Accountant license, you may create client records to organize calculations. A client record contains only what you choose to enter: a display name, an optional reference, and optional notes. We recommend using initials or file numbers rather than full names where practical. Client records are visible only to your account, are never used for marketing or analytics, and are deleted when you delete them or when you delete your account. Uploaded broker files are processed in memory and on temporary storage during a calculation only - they are never retained after the calculation completes, for any tier.

7. Your Rights

You can delete your account and its stored data from the profile page at any time. Deletion erases your calculation history, every stored report, and any client records you created. It cannot be reversed, so download anything you need to keep before you delete.

To stop repeated sign-ups that abuse the free tier, we keep a one-way hash of your email address after deletion, not the address itself, so we can recognize the address if it is used again. That address can no longer be used on the free tier. Buying season access restores it, though it does not restore any history that was deleted.

You may also contact us to request assistance with deletion or a copy of the personal data we hold about you.

8. Contact

For privacy-related requests or questions, contact us at support@activeacb.ca.

9. Children’s Privacy

This service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy at any time. We will indicate the date of the most recent revision at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Applicable Law

This Privacy Policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. If you are located in the European Economic Area, we process your data on the basis of contractual necessity and legitimate interest.