Security and Privacy

Uploaded files are temporary

When you upload a broker export (IBKR Flex Query XML, Questrade Activity XLSX, Wealthsimple activity CSV, CIBC Investor's Edge Transaction History CSV, TD Direct Investing activity CSV, Qtrade account history XLSX, National Bank Direct Brokerage activity history CSV, an ActiveACB Raw Trades export, or any other broker's CSV or XLSX via the column mapper), the request is validated and written to an isolated temporary processing directory on the application server. That directory is removed when processing finishes, including when parsing or calculation fails. Uploaded files are not written to the account database, with the one exception described next.

Three things can outlast the calculation, each in its own private table that only ActiveACB support can read. First, a layout profile of every upload: the column names and a format code per column, never a row value, so failed uploads can be diagnosed. Second, a full copy of each file you add on the upload page, kept automatically so our parsers can be tested against real exports and support for more brokers can be added, and deleted no later than 7 days after the upload. Interactive Brokers files and Accountant uploads are never kept this way, and you can turn it off on your profile page (see the privacy policy). Third, copies you choose to make: a redacted sample of the first rows when you tick that option, deleted after 180 days, and the whole file when you press the button to send a failed upload to support, deleted after 30 days. Neither of those is offered on the Accountant license. Everything else about the original file is gone when the calculation finishes.

Calculation results are stored in your account

After a calculation completes, its structured output - including capital gains summaries, dispositions, and warnings - is saved to your account. PDF and spreadsheet reports are regenerated from that output when requested. Your 25 most recent calculations are retained. You can delete an individual calculation from its history page or delete your account from the profile page.

Calculation data is stored in Supabase. Direct browser access is denied by database permissions and row-level security. The backend independently scopes every history, export, and deletion query to the authenticated user ID.

Encryption in transit and at rest

All connections to ActiveACB are served over HTTPS with TLS 1.2 or higher. There are no unencrypted HTTP endpoints. Data stored in Supabase is encrypted at rest using AES-256. Your session tokens are short-lived JWTs issued and verified by Supabase Auth.

No third-party analytics or advertising

ActiveACB does not load Google Analytics, Meta Pixel, advertising scripts, or session-recording tools. The application uses the Supabase client library for authentication and Thumbmark to create a one-way device identifier used only to limit free-trial abuse. The identifier and its purpose are disclosed in the Privacy Policy. Where we tag our own campaign links to see which of them bring people here, including before sign-in, that measurement happens on our own servers with no third party involved and no advertising network receiving anything.

Payments are processed by Stripe. When you purchase season access, your payment details go directly to Stripe. They never pass through our servers.

Logs and alerts

Operational request logs record the path, response code, account email and IP address of each request, and expire after a few days on our hosting provider. When a log line is about an uploaded file, it records the file's size and type, never its name. Some operational alerts go to a private Discord channel that only ActiveACB staff can read. An alert can include your account ID, a calculation ID, the tax year and dollar amounts from a check that failed, never your email address or the contents of your files. The Privacy Policy has the details.

Account and data deletion

You can delete your account at any time from your profile page. Deleting the account erases your calculation history and every stored report, and cannot be undone. A one-way hash of your email is kept afterward so repeat free sign-ups can be recognized, which means that address cannot be used on the free tier again unless you buy season access. The deletion workflow removes active calculation and analytics records before removing the authentication account. If a required data purge fails, deletion stops and reports an error so it can be retried instead of leaving orphaned records.

You can also delete individual calculations from your history without closing your account. Each calculation has a Delete button on its detail page that prompts for confirmation before removing the record.

PIPEDA compliance

ActiveACB operates under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law. The principles that govern how we collect, use, and protect personal information are:

• Accountability. We are responsible for personal information in our custody.
• Limiting collection. We collect the account email, temporary broker upload, stored calculation output, hashed abuse-prevention identifiers, and first-party product analytics events (purged after 180 days) described in the Privacy Policy. We do not collect names or addresses for application accounts, and payment card details go directly to Stripe.
• Limiting use, disclosure, and retention. Your email is used only for account access and transactional emails. Calculation data is retained only as long as your account is active.
• Safeguards. Described above: TLS in transit, AES-256 at rest, row-level security, file retention limited to 7 days, and none for Interactive Brokers files.
• Openness. This page and the Privacy Policy describe our practices in full.
• Individual access. You can view, download, and delete your data at any time from within the application.

Incident response

In the event of a breach that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as required by PIPEDA. The notification will explain the significance of the breach and the steps available to reduce or mitigate harm.

Contact

For security concerns, vulnerability reports, or privacy-related requests, contact support@activeacb.ca. We will respond within two business days.