Privacy Policy

Effective 2026-11-03

Taxee (taxee.tooly.fyi) is operated by itpro360 LLC ("we"). This policy explains what Taxee collects, why, and what you can do about it. It describes this app only.

What we collect and why

• Account details. If you sign in with Tooly SSO, Taxee receives from Tooly your subject identifier (sub), email address, name, profile photo URL, whether your email is verified, and your Tooly security groups. Taxee uses them to identify you and to decide whether you may use Taxee or administer it. Taxee never sees your Tooly password or authenticator codes. Tooly SSO is also operated by itpro360 LLC; see Tooly's Privacy Policy.
• If you create a local account, Taxee stores your email, name, a hashed password (bcrypt), your authenticator secret, hashed one-time recovery codes, and the time you agreed to these terms.
• Your records. The businesses you create; expenses (date, amount, vendor, category, payment method, notes, tags); receipt photos and files; mileage trips (date, miles or odometer readings, places, purpose, vehicle, notes, tags); and tax documents you upload (form type, payer, amount, notes, tags and the files themselves, which may contain sensitive information such as taxpayer identification numbers). We keep these to provide the service: storing, filtering and exporting your records.
• Sign-in history. For each sign-in to Taxee: time, method, IP address and device (browser user agent). Shown to you on your Account page; kept 30 days.
• Activity and security log. Sign-ins, failed sign-ins, lockouts, account changes, administrator actions, data exports, account deletions and server errors, each with time, account, IP address and device. Used to keep the service secure and investigate problems; kept 12 months. A separate record of deleted accounts (who, when, IP, device) is kept for the same period.
• Usage analytics. Daily counts of page views and visitors, pages visited, referring website (domain only), browser, operating system, device type, country (from Cloudflare) and counts of actions (such as receipts added). Visitors are counted with a hash of the IP address and browser that uses a secret that changes every day; raw IP addresses are not stored for analytics. Kept about 120 days. No third-party analytics.

Cookies and browser storage

Taxee uses one strictly necessary session cookie to keep you signed in, and stores your theme choice (light, dark or auto) in your browser's local storage. There are no advertising or tracking cookies, so there is no cookie banner.

Who can see your information

• You. Your records are visible only in your account.
• Administrators of Taxee can see account details, the activity log and analytics, and can block or delete accounts. The administrator console shows only how many expenses each account has; it does not display your expenses, trips, documents or files.
• People you send exports to. When you download an export package and give it to your accountant, what happens next is up to you and them.
• Service providers acting for us: Cloudflare (network and security proxy, which processes your IP address and requests) and email delivery, if email is enabled (password reset emails and administrator security alerts). Email goes through itpro360's own mail relay or directly to a provider, and is delivered by SMTP2GO or Amazon Web Services (Amazon SES); either may send a given message. Taxee keeps a log that an email was sent (type, recipient and service), never its content.
• Authorities, if we are legally required to disclose information.

We do not sell your information. Your browser may load your Tooly profile photo from Tooly SSO.

How long we keep it

Your records and uploaded files stay until you delete them or your account. Deleted receipt and document files are kept 14 days in a trash folder, then removed. Daily backups of the database are kept 14 days. Sign-in history 30 days, analytics about 120 days, activity logs 12 months.

Your rights

On your Account page you can download all your data (including your files), review your sign-in history, and delete your Taxee account and everything in it. You can correct your records at any time. For anything else, use the contact details provided by itpro360 LLC (the contact email has not been set yet).

Security

Connections are encrypted (HTTPS through Cloudflare). Sign-in requires two-step verification. Passwords and recovery codes are stored only as hashes. Uploaded files are served only to their owner. No system is perfectly secure, and we can't promise that it is.

Where data is stored

On a server operated by itpro360 LLC in the United States.

Children

Taxee is not meant for anyone under 16.

Changes

We'll update this page and its effective date when practices change.

Contact

To reach us about privacy, use the contact details provided by itpro360 LLC (the contact email has not been set yet).