Privacy Policy.

Crypto Tax Calculator is a desktop application for Windows, macOS and Linux that imports, reconciles and reports on cryptocurrency transactions. This policy applies to the website and the application, together referred to as the service. It explains the information involved in using an account, connecting sources, preparing reports, making a purchase and contacting support.

The policy does not replace the notices of your exchange, wallet provider, accountant or payment provider. Their records and services are governed by their own practices. Public blockchain information also exists independently of this service. If you manage records for someone else, make sure you are authorised to provide them and that the account holder understands how their information will be used.

Information you provide can include your email address, account details, public wallet addresses, read-only exchange API credentials, CSV files and support messages. Imported records can include transaction dates, assets, amounts, fees, source addresses and identifiers. Corrections, categories, notes and generated reports become part of the records used for your tax review.

Provide only information needed for the relevant task. We do not ask for private keys, seed phrases, withdrawal rights or trading permissions. Avoid placing passwords, full card numbers or unrelated personal documents in messages or uploads. If a CSV contains unnecessary columns or information about another person, review it before uploading and remove information not needed for reconciliation.

We use account and transaction information to provide the requested service: connect sources, reconcile activity, prepare calculations and reports, manage the account and respond to support requests. Purchase records are used to identify the plan and tax year, confirm payment status and provide billing documentation. Your transaction data is not sold or used to build advertising or data-broker profiles.

Where applicable law requires a legal ground, providing account services and reports relates to performance of the service you request, while required accounting records relate to legal obligations. Account security and resolving service issues may involve legitimate interests, subject to applicable protections. Processing that legally requires consent must be optional and covered by the relevant consent. The ground for a particular request depends on its purpose and the law that applies.

A public address or extended public key can reveal more than a single balance: transaction history may show holdings, counterparties and links between addresses. Associating that information with an account can make your financial activity easier to connect to you. Only add sources you own or are authorised to review, and consider how much history is necessary for the tax years involved.

Read-only exchange credentials let a connection retrieve the records allowed by the source platform. They must not include trading or withdrawal permissions. Revoking a key at the exchange stops that key from working; disconnecting a source does not erase previously imported records or transactions on that platform. Account deletion cannot remove records from a public blockchain.

Account and transaction information is handled using encryption in transit and at rest. Read-only access limits what a connection should be able to do, but does not make financial records non-sensitive. Keep sign-in details private, protect the devices on which you review records and check permissions whenever you create or replace an exchange API key.

No service can promise that information will never be exposed or lost. If you believe a credential or account has been compromised, revoke the affected exchange key and secure your sign-in details before sending a report. Use the Security page for practical guidance. We do not claim a certification, independent audit or specific security guarantee merely by describing these safeguards.

Running the service may involve providers for hosting, email and payment processing. Information relevant to those tasks can be handled by those providers; their role is different from publishing your records or selling them to advertisers. Information may also need to be disclosed when legally required. You can ask which providers are involved in handling your account and which locations apply.

A provider may process information outside your country. The destination, applicable law and relevant safeguards determine how cross-border processing is handled; this policy does not imply that all information remains in your country. When you choose to send a report to an accountant or another recipient, that recipient’s subsequent handling is subject to their own obligations and arrangements with you.

A purchase can create records of your selected plan, tax year, amount, payment status and billing information required for a receipt or accounting. Payment handling is also subject to the payment provider’s privacy notice. Do not send full card numbers, security codes or bank-access credentials through a contact form or support message.

Billing records may need to remain after account closure to meet accounting, tax or dispute-handling requirements. This is different from retaining your wallet history for continued use of the app. If you ask for deletion, we will distinguish information that can be removed from records that must lawfully be kept, rather than promise that every purchase record will disappear.

We keep account information and imported records while the account is active so your reconciliations and reports remain available. Account deletion is handled within 30 days, except where law requires the retention of limited records such as billing documentation. Disconnecting an exchange and closing the account are separate actions: a disconnection does not by itself request deletion of all account data.

Save the reports and supporting evidence you need before requesting closure. Copies downloaded to your device, sent to an accountant or stored with another recipient are not removed through account deletion. Exchange records and public blockchain transactions also remain at their source. Revoking an API key stops future access through that credential but does not reverse transactions or erase copies already retrieved.

Depending on the law that applies, you may request access to your information, correction of inaccurate data, deletion, a portable copy, restriction of processing or an objection to particular processing. You may withdraw consent where processing relies on consent. These rights can be subject to legal exceptions, especially for records required for accounting or resolving a dispute.

To make a request, use the Contact page and state the right you want to exercise and enough information to locate the account. We may need to verify your identity before disclosing or deleting records; never send a password, private key or seed phrase as proof. Privacy requests are handled within 30 days, subject to applicable legal requirements and exceptions. If you disagree with the response, you may complain to the relevant data-protection authority.

Website storage used to keep the site working is different from optional analytics or advertising tracking. This service does not use transaction records for cross-site advertising profiles. Where optional tracking requires consent under applicable law, it must remain optional. Browser settings can limit site storage, although blocking storage needed for a session may affect account access.

You choose which sources to connect and which details to include in support messages. Review an export before sharing it, and use a sharing method appropriate for financial records. The service is not intended for anyone under 18. If you believe information belonging to a child was provided, contact us so the account and relevant records can be reviewed and removed where appropriate.

The date at the top identifies the current policy. If we make material changes, we will communicate them by email at least 14 days before they take effect. Minor clarifications may be published with an updated date. A description of a future service or a general security practice is not a claim that a particular certification or guarantee exists.

For a privacy question, explain which information or action your concern relates to: an account, a connected source, an export, a purchase or a deletion request. Use the Contact page without including credentials or unnecessary transaction details. The Terms of Service explain account and purchase obligations; the Security page covers safe connection practices and reporting a potential exposure.