← Back to TaxSnooze

1. Introduction

TaxSnooze ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your personal information when you use our website, applications, and services (collectively, the "Services").

By using our Services, you consent to the practices described in this policy. If you do not agree, please do not use our Services.

2. Information We Collect

2.1 Information You Provide

Data Type	Purpose	Retention
Name, Email Address	Account creation, communication	Until account deletion
Social Security Number (SSN)	IRS e-filing (Form 4868, 7004, 8809)	Encrypted; only last 4 digits stored after submission
Employer Identification Number (EIN)	Business extension filing	Only last 4 digits stored after submission
Tax Return Data (income, deductions, filing status)	Extension filing, estimated tax calculations	Until account deletion or 7 years (tax records)
Mailing Address	IRS correspondence, reasonable cause letters	Until account deletion
Payment Information	Subscription and service fees	Processed by Stripe; we never store full card numbers

2.2 Information Collected Automatically

• IP address and approximate geolocation
• Browser type, operating system, and device information
• Pages visited, time on site, and referral URLs
• Cookies and similar tracking technologies (see Section 7)

3. How We Use Your Information

• To file IRS tax extensions on your behalf via MeF (Modernized e-File)
• To calculate estimated tax liability, penalties, and interest
• To generate reasonable cause letters and penalty abatement documents
• To process payments and manage subscriptions
• To send transactional emails (confirmations, receipts, status updates)
• To provide customer support and respond to inquiries
• To detect and prevent fraud, unauthorized access, and abuse
• To comply with legal obligations and IRS requirements

4. SSN and Sensitive Data Handling

• Encryption at rest: AES-256-GCM with unique initialization vectors per record
• Encryption in transit: TLS 1.2+ for all connections
• Access control: SSN data is accessible only to authenticated, authorized users
• Masking: All displays show SSN as ***-**-XXXX (last 4 only)
• No logging: SSNs are excluded from application logs and error reports
• Deletion: Full SSNs are purged from memory after IRS transmission completes

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

Recipient	Purpose	Data Shared
IRS (via MeF)	Tax extension filing	Full filing data as required by IRS
State Tax Authorities	State extension filing (where applicable)	State-required filing data
Stripe, Inc.	Payment processing	Payment details (we never see full card numbers)
Email Service Provider	Transactional emails	Email address, name, submission confirmations
Law Enforcement	Legal compliance	As required by valid legal process

We do not share SSNs or EINs with any third party except the IRS and applicable state authorities for filing purposes.

6. Data Retention

• Account data: Retained until you delete your account
• Tax filing records: Retained for up to 7 years per IRS record-keeping guidelines
• SSNs (full): Not stored; only last 4 digits retained after submission
• Payment records: Retained per financial compliance requirements (typically 7 years)
• Application logs: Retained for 90 days, then automatically purged
• Cookies: Session cookies expire at browser close; persistent cookies up to 1 year

7. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and security (session tokens, CSRF protection)
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Help us understand usage patterns (anonymized)

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Opt-out: Opt out of marketing communications at any time
• Restrict processing: Request that we limit how we use your data

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.

9. Security Measures

• AES-256-GCM encryption for sensitive data (SSNs, EINs)
• TLS 1.2+ encryption for all data in transit
• Bcrypt password hashing (12 rounds)
• JWT-based authentication with configurable expiry
• Rate limiting on authentication endpoints
• CSRF protection and security headers (Helmet.js)
• Input validation and sanitization on all endpoints
• Audit logging of all sensitive operations
• Regular security assessments and dependency updates

10. Data Breach Notification

In the event of a data breach involving personal information, we will:

• Notify affected users within 72 hours of discovery
• Notify relevant regulatory authorities as required by law
• Provide details of the breach, data affected, and remediation steps
• Offer identity protection services if SSNs are compromised

For our full breach response procedures, see our Data Breach Response Plan.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will promptly delete it.

12. Third-Party Links

Our Services may contain links to third-party websites (e.g., IRS.gov, state tax authority sites). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. Continued use of our Services after changes constitutes acceptance of the updated policy.

14. Contact Us