Public beta — calculations may contain errors; always verify with a tax professional. Terms

    Privacy Policy

    Last updated: October 29, 2026

    1. Overview

    This Privacy Policy explains what data Taxxy ("we", "the Service") collects, why, and how it is handled while the Service is in free public beta. Contact for all privacy matters: contact@taxxy.eu.

    2. Data We Collect

    • Account data — email address, name, country of tax residence (used to select your tax jurisdiction), managed through our authentication provider.
    • Transaction data — trades, transfers, and balances you import via CSV files, exchange APIs, or public blockchain addresses.
    • Wallet addresses — public blockchain addresses you choose to track.
    • Exchange API credentials — if you connect an exchange, your API keys are stored encrypted (AES-256-GCM). We recommend creating read-only keys.
    • Technical data — request logs (IP address, timestamps, endpoints) kept for security and debugging.

    3. How We Use Your Data

    • To import, normalize, and display your transactions.
    • To calculate capital gains, income, and tax estimates for your jurisdiction.
    • To generate tax reports and forms you request.
    • To operate, secure, and improve the Service.

    We do not sell your data, use it for advertising, or share it with third parties except the processors listed below and AI assistants you choose to connect.

    4. Processors and Sub-processors

    Your data is processed by the following infrastructure providers:

    • Supabase — authentication and user profiles.
    • MongoDB Atlas — transaction and report storage.
    • Railway — backend application hosting.
    • Vercel — frontend hosting.
    • AI providers (via OpenRouter) — only if AI-assisted transaction categorization is triggered, the minimal transaction fields needed for classification are sent; never your credentials or identity.
    • Market data providers (exchanges, CoinGecko, blockchain explorers) — receive asset symbols, dates, and public addresses needed to fetch prices and transactions; never your identity.

    5. Data Retention and Deletion

    Your data is retained while your account is active. You can delete imported transactions and wallets in the app at any time. To delete your account and all associated data, use the "Delete Account" option in Settings — deletion is immediate and self-serve, and does not require contacting support. Note that during the beta, backups may persist for up to a further 30 days after deletion before being purged, so it can take up to 30 days for every copy of your data to be gone. If you are unable to access Settings, contact contact@taxxy.eu and we will delete your account manually.

    6. Your Rights

    Depending on your jurisdiction (e.g., under the EU GDPR), you may have rights to access, correct, export, restrict, or erase your personal data, and to object to processing. To exercise any of these rights, contact contact@taxxy.eu.

    7. Security

    • All traffic is encrypted in transit (TLS/HTTPS).
    • Exchange API credentials are encrypted at rest with AES-256-GCM.
    • Access to production systems is restricted to the operator.

    No system is perfectly secure; this is beta software. Avoid granting withdrawal-enabled API keys and report suspected issues to contact@taxxy.eu.

    8. Connected AI assistants

    If you connect an AI assistant to Taxy and approve access, it can prepare wallet and CSV imports, and import CSV files into your account after it shows you a preview and you confirm in the chat. With Pro, it can also read your transactions, positions, tax lots and tax summary, run the tax calculation and create report download links. It cannot edit or delete stored transactions.

    Report download links are signed and expire after 15 minutes. Anyone with the link can download the report without signing in.

    CSV files and parsed preview data may be kept privately for up to 24 hours before you confirm. Previewing does not add transactions to your ledger.

    Reported amounts come from Taxy; check them in Taxy before relying on them.

    Information returned to the assistant goes to its provider, which handles it under its own terms and privacy policy. Your chat with that provider is subject to those terms too.

    To disconnect, remove the Taxy connector in your assistant's settings. If you connected using an API key, revoke that key on the Taxy API Keys page. See the AI assistants setup guide.

    9. Changes

    We may update this policy as the Service evolves; material changes will be announced in the application. See also our Terms of Service and Cookie Policy.