Privacy Policy

Last updated: July 2026

1. What We Collect

We collect your email address when you create an account. During calculations, we temporarily receive the file you upload (an IBKR Flex Query XML, Questrade Activity Report XLSX, or Wealthsimple activity CSV) in order to process your tax data. This file is written to a temporary directory on the server for the duration of processing and deleted immediately once a response is returned.

To prevent abuse of the free trial, we collect a hashed device identifier from your browser and a hashed combination of your IP address and browser identification string. These values are one-way hashes and cannot be reversed to identify you personally.

We also record a small set of product-analytics events tied to your account: which step of the calculation and checkout process you reach (for example, started a calculation, hit the paywall, completed a calculation, started checkout, or completed payment), along with the broker type and tax year involved. We use this only to understand how the product is used and to improve it. These events never include your uploaded file, file name, calculation figures, IP address, or device information.

2. What We Don’t Collect

We do not store your uploaded files. We do store calculation results, tax summaries, broker type, and aggregate figures in your account to provide calculation history and export features. We do not use third-party analytics, advertising networks, or tracking pixels. We do not sell your data to any third party under any circumstances.

3. Cookies and Local Storage

The application does not set its own access-control cookie. If you create an account and log in, session state is stored in your browser’s localStorage by the Supabase authentication library.

4. Third Parties

This service uses Supabase for user authentication. If you create an account, your email address is stored by Supabase and subject to their Privacy Policy. We do not share your personal data with any third party for marketing or analytics purposes.

Payments are processed by Stripe, Inc. When you subscribe, your payment details are transmitted directly to Stripe; they never pass through our servers. Stripe may store your email address to manage your subscription and send receipts. See Stripe’s Privacy Policy.

Transactional emails (account confirmation, password resets) are sent through Resend. Your email address is shared with Resend solely for email delivery. See Resend’s Privacy Policy.

5. Data Retention

Uploaded files are written to an isolated temporary directory during processing and removed when the calculation finishes or fails. They are never stored in the account database. Calculation result JSON, summary metadata, filename, broker type, and aggregate tax figures are stored with your account so you can view calculation history and regenerate reports. To limit retention, only your 25 most recent calculations are kept.

Product-analytics events (described in section 1) are retained for 180 days and then automatically deleted. They are also deleted, along with the rest of your data, when you delete your account.

6. Your Rights

You can delete your account and associated active application data from the profile page at any time. You may also contact us to request assistance with deletion or a copy of personal data we hold about you.

7. Contact

For privacy-related requests or questions, contact us at [email protected].

8. Children’s Privacy

This service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy at any time. We will indicate the date of the most recent revision at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Applicable Law

This Privacy Policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. If you are located in the European Economic Area, we process your data on the basis of contractual necessity and legitimate interest.