Privacy Policy

Your documents are yours. We use them only to run the vault you asked for. We don't sell your information, we don't share it with advertisers, we don't use your tax documents for marketing, analytics products, or AI training, and the free tools (checklist and downloads sorting) run in your browser without an account.

Account data: your email address and authentication records. Documents you store: the tax documents you upload (which may contain names, addresses, Social Security numbers, and financial information), plus metadata like filenames, tax year, and integrity fingerprints. Billing data: handled by Stripe; we receive your plan status and a customer reference, never your card number. Technical logs: standard server logs for security and reliability. The free checklist and sorting features store their state in your own browser (localStorage) and send us nothing.

We use your information solely to provide, secure, and support the service, and as required by law. Federal law (26 U.S.C. §7216 and Treas. Reg. §301.7216) restricts how tax return information may be used or disclosed by services connected with tax preparation. Our policy is simpler than the law requires: we do not use or disclose your tax documents for any purpose other than providing this service — no marketing, no data products, no AI training — and we will ask for your explicit, legally compliant written consent before ever offering any feature that would use them differently.

Only service providers necessary to operate CaughtUp — currently Supabase (encrypted database and file storage), Vercel (hosting), and Stripe (payments) — each bound to use your data only to provide their service to us. We disclose information beyond that only if required by law (for example, a valid legal process), and we do not share your information with non-affiliated third parties for their own use. Because we share only under these service-provider and legal exceptions, no opt-out is required under the federal financial privacy rules (16 C.F.R. Part 313).

Encryption in transit and at rest; mandatory multi-factor authentication enforced at the database layer for all document access; per-user isolation (row-level security); tamper-evident audit logging; content fingerprinting (SHA-256) for integrity; and access limited to what's needed to run the service. Details on the Security page.

If a breach affects your unencrypted information, we will notify you and regulators as required — including notice to affected users without unreasonable delay under applicable state law, and notification to the FTC within 30 days where its Safeguards Rule reporting threshold (500+ consumers) is met.

You can export your documents at any time, delete individual documents or your whole account (deletion is permanent and prompt), and request a copy or correction of the account information we hold by emailing support@caughtup.tax. We will notify you of material changes to this policy by email or in-app notice, with a new effective date. We do not respond differently to browser Do-Not-Track signals because we do not track you across other sites; no third parties collect personal information about your activity over time across different sites through our service.

CaughtUp is for adults 18+. It is not directed to children under 13 and we do not knowingly collect their information.