# Privacy Policy — TaxHarbor _Last updated: August 6, 2026_ **To publish this at a public URL (required by the App Store and Google Play before submission):** push this repo to GitHub, then enable GitHub Pages for it (Settings → Pages → Deploy from branch → `main` → `/root`). This file will then be reachable at `https://.github.io/freelance-tax-tracker/PRIVACY.md` (or rename it `index.md` / convert to `index.html` for a cleaner URL). Use that URL in App Store Connect and Google Play Console. See also `TERMS.md`, this app's Terms of Service, which this policy is incorporated into by reference. ## Summary TaxHarbor is built so that, as of this version, **all of your data stays on your device.** There is no account, no server, and no analytics, advertising, or crash-reporting SDK collecting information about you or your usage. This is unusual for a mobile app, so the rest of this policy explains it in detail rather than asking you to take our word for it. ## What data the app stores, and where The app stores the following locally on your device only, using standard on-device storage (AsyncStorage) and, for receipt photos, your device's own file system: - Transactions you enter (description, amount, date, category, and, if you choose to add one, a receipt photo or a client name for an income entry — see "A note on client names" below) - Mileage log entries you create, including distance measured via the optional GPS trip tracker (see "Location" below) - Your settings (filing status, tax year, state, distance unit, QBI toggle, and, if you choose to enter them, last year's tax figures used for the safe-harbor estimate and an estimate of your W-2 withholding) - Your custom categories - Whether onboarding is complete, and your trial/subscription status flag None of this data is transmitted to us, to Anthropic, or to any third party by this app. We do not operate a backend server for this app and cannot see, access, or recover your data — there is no "our servers" for it to be on. ## Third-party SDKs and services This app does not integrate any third-party analytics SDK, advertising SDK, crash-reporting service, or tracking pixel. It uses only standard Expo/React Native modules that run entirely on your device (local storage, file system, photo picker, document picker, location, and local notifications — see "Photos," "Location," and "Notifications" below). If a future version adds a payment processor for real subscriptions (see "In-app purchases" below) or any other third-party service, this policy will be updated first, and that service's own privacy practices will be disclosed here. ## Photos If you attach a receipt photo to an expense, the app requests access to your photo library only at that moment, and only to let you pick a photo. The photo (or a reference to it) is stored locally alongside that transaction. It is never uploaded anywhere by this app, and we never scan, analyze, or otherwise access your broader photo library beyond the single photo you select. ## Location The app includes an optional GPS trip tracker for measuring mileage. It only accesses your location if you affirmatively tap "Track this trip with GPS" when adding a mileage entry, and only for as long as that screen is tracking a trip — there is no background or passive location access, and the App Store/Play Store permission prompt and description say the same thing. While tracking, the app records a series of GPS points on your device only, uses them to calculate a distance in miles (via the standard haversine formula), and fills that distance into the mileage entry you are creating. The raw GPS points themselves are discarded once you stop or cancel the trip — only the resulting distance number is kept, as part of that mileage entry. Location data is never transmitted anywhere by this app, never stored in any form other than the derived distance, and never used for any purpose other than that one calculation (no location history, no background tracking, no location-based analytics). ## A note on client names If you optionally enter a client name on an income entry, that name is personal data about a third party (your client), not about you, and it is stored locally under the same rules as the rest of your data — on your device only, never transmitted by this app. Because you are the one choosing to record another person's or business's name, you are responsible for doing so consistently with any confidentiality or data- protection obligations you may owe that client; this app has no way to know what those obligations are and does not manage them for you. ## Notifications If you enable deadline reminders, the app schedules **local** notifications on your device using your device's own notification system. This does not involve any external notification service, push server, or third party. ## Exporting your own data The CSV export and JSON backup features let you save your own data to a file and share it (for example, by email or to cloud storage) entirely through your device's own share sheet. That sharing action is something you initiate and control — the app itself does not send this data anywhere on its own. Once a file leaves the app via your share sheet (for example, if you save it to a cloud drive), its handling is governed by that destination service's own privacy policy, not this one. ## Links that leave the app Two buttons in Settings hand off to software outside this app rather than doing anything within it: "Manage subscription" opens your device's native Apple ID / Google Play subscription-management screen (via a standard system link), and "Contact support" opens your own email app with our address pre-filled. Neither button transmits any of your app data as part of opening that link — they simply navigate you to another app. Once you're in that other app (your email client, or the App Store/Play Store subscription screen), its own privacy practices apply, not this policy. ## Data retention Because all data is stored locally, it is retained for as long as you keep the app installed and don't delete it, with no separate retention period imposed by us. It is permanently deleted when you use "Clear all data" (see below) or uninstall the app. ## Security Your data is protected by your device's own operating-system-level app sandboxing and storage protections (the same mechanism that protects other apps' local data on your device). This app does not apply additional encryption to locally stored data beyond what your OS provides by default. If your device is lost, stolen, or compromised, data stored by this app could be at the same risk as data from any other locally-installed app on that device — we recommend using your device's own passcode/biometric lock as your primary protection. ## Bank connection consent and data retention (Pro tier, not yet available) TaxHarbor Pro (automatic bank/card import via Plaid) is not available yet — see the "Monetization" section of the project README for status. This section documents the consent and retention design it will use once it ships, so the rules exist and are reviewable before any real user's bank data is ever touched, not written after the fact. **Consent.** Connecting a bank will always be a separate, affirmative step from subscribing to Pro — subscribing does not by itself connect anything. Before any bank/card connection is initiated, the app shows a dedicated consent screen explaining what will happen (see "Bank connection consent" in the app's Pro upgrade screen) and requires an explicit checkbox confirmation. You can decline and still use Pro's other features once they exist; declining only means transactions stay manual, the same as Basic. **What we store, and where.** If you connect a bank: the resulting Plaid `access_token` (the credential that lets us pull your transactions) is stored **server-side only, encrypted at rest, and never on your device**. Your actual transaction data (amounts, dates, merchant names) is **not** kept on our server at all — each time it's pulled from Plaid, it is forwarded straight to your device and stored there under the same on-device-only rules as manually entered transactions (see "What data the app stores" above). This means a breach of our server could expose that a bank is connected and that we can read its transactions, but not a copy of your transaction history itself, because we don't keep one. **Retention and deletion of the access token.** The access token is retained only for as long as the connection is active, and is deleted in any of the following cases: (1) you tap "Disconnect bank" in Settings — deleted immediately, along with revoking the connection through Plaid's own `/item/remove`; (2) you cancel or downgrade from Pro to Basic — deleted within 24 hours; (3) you request account/data deletion (see "Deleting your data" below) — deleted immediately; (4) the connection goes unused for 12 consecutive months (for example, the app isn't opened) — automatically revoked and deleted without further action from you. No backup or archive copy of a deleted access token is kept. ## In-app purchases (if enabled in a future version) If this app adds real subscriptions in the future (see the "Monetization" section of the project README), purchase processing would be handled by Apple's App Store or Google Play billing systems, which have their own privacy policies governing payment information. This app does not, and will not, collect or store your payment card details directly. ## Deleting your data You can delete all of your data at any time using **Settings → Clear all data** inside the app. This immediately and permanently erases every transaction stored on your device. Because nothing is stored anywhere else, this is the complete mechanism for exercising a right to delete — there is no separate server-side copy to also request deletion of. Uninstalling the app has the same effect. ## Your California privacy rights (CCPA/CPRA) We do not sell or share (as those terms are defined under California law) your personal information, and we have not done so in the preceding 12 months, because we do not collect, transmit, or receive any personal information from this app in the first place — everything stays on your device. Because we hold no personal information about you, your rights to know, delete, correct, or opt out under the CCPA/CPRA are inherently satisfied: there is nothing in our possession to know about, delete, correct, or opt you out of. If you have questions, see "Contact" below. ## International users This app does not knowingly collect personal data, so it does not act as a "data controller" or "data processor" under the GDPR or UK GDPR in any meaningful sense — there is no data transmitted for us to process. See "Who this app is for / geographic scope" below regarding the app's US-specific tax content. ## No government affiliation TaxHarbor is not affiliated with, endorsed by, or sponsored by the IRS, the Social Security Administration, or any other government agency. Tax figures referenced by the app are sourced from those agencies' public websites for informational purposes only (see the README "Tax data sources" table) — this is not an official government tool. ## Who this app is for / geographic scope TaxHarbor's tax content models **U.S. federal tax rules only** and is intended for individuals filing U.S. tax returns. The optional miles/kilometers distance-unit setting is a data-entry convenience only and does not mean the app supports non-U.S. tax rules. If you use the app while located outside the United States, no data leaves your device regardless — but the tax content itself does not apply to you, and this policy is written with U.S. users in mind. ## Children's privacy Per TERMS.md, this app requires users to be at least 18 years old. It is a financial planning tool intended for adults managing self-employment income and is not directed at children. We do not knowingly collect information from anyone under 13 (the COPPA threshold) or under 18 (this app's own minimum age) — and in any case, the app collects nothing that leaves your device, so there is no data of a minor's for us to hold. If you believe a child has used this app, you can remove all locally stored data at any time via "Clear all data" in Settings. ## Changes to this policy If the app's data practices change (for example, if analytics, a backend sync feature, or in-app purchases are added), this policy will be updated before that version is released, and the "Last updated" date above will change accordingly. Material changes will also be reflected in the app's store listing update notes. ## Contact Questions about this policy can be directed to the developer at `guyrofe@gmail.com`, or at the contact information listed on this app's App Store / Google Play listing.