Tax60 Privacy Policy

Effective October 1, 2026. This Privacy Policy explains what PLUSH LLC, a Puerto Rico limited liability company doing business as Tax60 ("Tax60," "we," "us"), collects when you use the Tax60 iPhone app and the tax60.app website, including the Tax60 web app where you sign in to your account, and the Tax60 CPA portal at cpa.tax60.app (together, the "Service"), what we do with it, and the choices and rights you have. It also covers the professionals who use the CPA portal (Section 4.7), the business contacts we keep about accounting firms and tax professionals (Section 4.8), and the support notes and logs our staff keep in our staff console at admin.tax60.app (Sections 3.3 and 4.9). The web app, sharing your record with a professional you invite, and support access exist only in the versions of the Service that include them; where this Policy describes them, it applies to them in those versions. It is written to be read in full; the most important facts are in Section 1.

Questions or requests go to privacy@tax60.app.

---

1. The short version

• Your record is stored in your Tax60 account, and it is protected. Your record — location fixes, the jurisdiction of each day, the hours you work, trips, your confirmations and notes, attached documents, and medical-exception tags and their certifications — is stored in your Tax60 account on servers in the United States. It is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), and protected by access controls. Only you, the professionals you invite, and a small number of authorized Tax60 staff can access it. Staff do so only for support you ask for, security, and valid legal process. Section 3 describes how this works.
• Every entry is timestamped so that it cannot be quietly changed. Every entry is hashed and countersigned with a server timestamp when it arrives, and a copy of each commitment stays on your iPhone, so a later change by anyone, including Tax60, is detectable.
• We never sell, share, rent, or license personal information, and we never use it for advertising. There is no advertising SDK in the app. We do not send personal information to any third-party artificial-intelligence service, and we do not use the contents of your record for analytics, profiling, or product research.
• Analytics contain no coordinates, no jurisdiction names, no day counts, no hours, and no notes.
• Retention is your setting. Deletion has a seven-day grace period and completes within thirty days after it, subject only to legal holds.
• Adults only, U.S. and Puerto Rico only. Tax60 is not offered to anyone under 18 or to residents of the European Union, the European Economic Area, or the United Kingdom.

---

2. Who we are and what the Service does

Tax60 is a record-keeping tool for people who hold a Puerto Rico Act 60 tax decree. It records, on your iPhone, which jurisdiction you are in each calendar day (Puerto Rico, a U.S. state, another U.S. possession, or another country), the hours you clock in and out of work by jurisdiction, and the documents you attach as evidence. It computes the presence-test figures described in our published Methodology (https://tax60.app/legal/methodology) and produces exports and audit binders for you and the professionals you choose to share them with. Your record is kept in your Tax60 account so that you can restore it on a new iPhone and, in the versions of the Service that include them, see it on the web and share it with a professional you invite.

Tax60 is a record-keeper. It does not give tax, legal, or accounting advice. Our Terms of Service (https://tax60.app/legal/terms) govern your use of the Service; this Policy governs personal information.

---

3. How your record is stored and protected

This section is the foundation of everything else in this Policy.

3.1 How it works

1. Your iPhone is the engine. Location capture, jurisdiction classification, day derivation, presence-test math, and binder generation all run on your device. There is no server-side copy of the rules engine.
2. Your record is stored in your account. As entries are made, your iPhone sends each one to your Tax60 account over an encrypted connection (TLS 1.2 or higher): location fixes (coordinates rounded to four decimal places), day records, work sessions, trips, the bulk uploads you make (the period, where you started, your travel days and each place's work and vacation weekdays with the average hours), your confirmations and notes, your profile and settings, the details of your documents and the documents themselves, and the change log. They are stored with our database, storage and authentication provider on Amazon Web Services in the us-east-2 region (Ohio, United States), encrypted at rest (AES-256). Your iPhone keeps its own copy, protected by iOS Data Protection, so the app works offline and sends what it recorded when it reconnects.
3. Access controls. Our database enforces row-level security on every table and storage location: a signed-in account can read only its own entries and its own files. Stored entries are insert-only: a correction is a new version of the entry, and the original stays in your record's history.
4. Who can access your record.
   • You, on your iPhone and, when you sign in, in the web app at tax60.app.
   • A professional you invite, read-only, for the tax years and the period you choose, until you end their access or it expires (Section 4.6).
   • A small number of authorized Tax60 staff, and only (a) to give you support you ask for, which for your record itself means only while you have support access open (Section 3.3), (b) to keep the Service secure and working, for example to investigate a security incident or a failure, or (c) to respond to valid legal process under our Legal Process Policy (https://tax60.app/legal/legal-process). Staff access to production systems is limited to named administrators. Staff support you through an audited staff console at admin.tax60.app, which shows the account information in Section 4.2 and never the contents of your record, except under support access you opened.
5. Every entry is committed when it arrives. When an entry reaches our servers, the server computes the SHA-256 hash of its exact contents and creates a commitment: a server-signed (Ed25519) record chaining that hash to your previous commitment with the server's receipt time. The commitment is returned to your iPhone, which verifies it and keeps it, and the calendar PDF you download prints the chain's anchor (the hash of your latest commitment the server has signed, and the identifier of the key that signed it) on every page. Because the commitments leave our servers, a later change to an entry by anyone, including Tax60, is detectable. The Methodology (https://tax60.app/legal/methodology) explains what a commitment proves and what it does not.
6. The web app. When you sign in at tax60.app you use the same email address and password as on your iPhone, or Sign in with Apple. The pages that show your record are rendered for your signed-in session by our website hosting provider, over TLS; the web app keeps no copy of your record of its own.
7. Records made before this version. Until version 2.0 of this Policy, the app encrypted each record on your iPhone with a key held only by you before uploading it, and our servers stored the encrypted copies. If your account holds records made that way, they come under this version only after you agree to it in the app. Until you agree, your iPhone keeps recording but sends nothing new to your account, and the encrypted copies stay as they are. When you agree, your iPhone converts them itself, and each keeps its original server timestamp and commitment.

3.2 What this means in practice

• Losing your iPhone does not lose your record. Log in on a new iPhone and your record downloads from your account, each entry checked against the commitment made when it first arrived.
• Because we hold your record in a form we can read, legal process served on Tax60 can reach its contents, and so could someone who broke through our security. Our Legal Process Policy explains how we respond to legal process: notice to you before we comply, no voluntary disclosure to any tax authority, and a challenge to overbroad requests. Section 15 describes how we protect your record and what we do if a breach occurs.
• Apple's App Store privacy label for Tax60 lists Precise Location, Health, Photos or Videos and your other records as data linked to you, because they are stored in your account. None of it is used for tracking.

3.3 Support access you open

When you want our support team to look at your record, you open support access yourself, in the versions of the Service that offer it. Support access lasts seven days unless you choose a shorter or longer period, never more than 30 days; only one can be open at a time, and you can close it at any time, which ends it at once.

• What staff can see. While support access is open, an administrator can read your record one tax year at a time, in the same form a professional you invite sees it: your days and their jurisdictions, hours, trips, confirmations and notes, and the list of your documents. Never your raw location fixes, never the medical-exception details or what you wrote about a day with a medical exception, and never your documents' files.
• Every read is logged, and you can see the log. Each read is recorded with the administrator's name, the tax year and the time in a support access log in your account, and in our staff access log (Section 4.2).
• Nothing without it. When support access is closed or its time is up, staff have no access to the contents of your record through the staff console. It is not needed for, and does not limit, the security work and legal process that Section 3.1, item 4, describes.

Support access and its log are kept for the life of your account and deleted with it.

---

4. Information we collect and hold

4.1 Your record

Everything in this table is stored in your Tax60 account as Section 3 describes. Who can see it is stated in Section 3.1, item 4.

4.2 Account and service information

Legal holds. While an account is under a legal hold (Section 7), its invitations and access logs, the delivery records of its invitation emails, the staff access and email logs about it, the support notes about it and the notices queued about it are kept until the hold is released, even where this table gives a shorter period.

4.3 Information you give us when you create an account, and information from Apple

Creating a Tax60 account is the first thing the app asks for, before it asks for location. You give us your name, your email address, an optional phone number, and a password; the app tells you on that screen that these details and your record are stored in your Tax60 account. We confirm the email address by sending a six-digit code to it, and the same kind of code is how you reset a forgotten password. Your name and phone number are also written into your profile, where the app reads them.

When you use Sign in with Apple instead, Apple gives us a stable user identifier, your email or a private-relay address, and (if you allow it) your name. When you subscribe through the App Store, Apple gives us signed transaction information (product, dates, status, transaction identifiers) and App Store Server Notifications about renewals, refunds and billing problems. Apple does not give us your payment card or Apple ID password, and we never ask for them.

If you hide your email, Apple issues a relay address on privaterelay.appleid.com or private.icloud.com. We register our sending domain with Apple's relay service so that our receipts and notices reach you; Apple forwards them, and we never learn your real address unless you add it in the app yourself. If you later add an email address, we store it as your account email and stop using the relay address for new messages.

4.4 Information from our website

The tax60.app website has a free presence-test calculator. The calculator runs entirely in your browser and does not send your inputs to us. Our website hosting provider records standard request logs (IP address, pages, timestamps) for up to 30 days.

The site also has a launch list. If you enter your email address there, we send that address one email containing a confirmation link and store nothing. Your address becomes a contact with our email provider only when you open that link, and only then; the link expires after 48 hours, and if you never open it your address is not kept anywhere. The release email carries a one-click unsubscribe link, and hello@tax60.app removes you on request. The launch list is separate from any Tax60 account, is never merged with account data, and is used for that one announcement and nothing else. To stop abuse of the form we count requests per network address in server memory for up to a day and record no other information about you.

When you sign in to the web app, we authenticate you with the same email address and password as the app, or with Sign in with Apple, and the web app sets a cookie that keeps you signed in. That cookie is strictly necessary and is used for nothing else. We use no advertising cookies, pixels, or tracking of any kind on tax60.app.

4.5 Information we do not collect

We do not collect your Social Security number, taxpayer identification number, decree number or decree details, home or street address (the app neither asks for one nor looks one up from your location), contacts, calendar, photos other than the ones you attach, health records from HealthKit, browsing history, advertising identifier, or any information from data brokers. We do not use cookies for advertising or cross-site tracking, and the app uses no advertising or attribution SDK.

4.6 Sharing your record with a professional you invite

When you invite a CPA or other tax professional, you give us their email address, their name if you choose to enter it, and the name you want the invitation to show for you. We use them only to email the invitation, to match it to the professional's account at cpa.tax60.app, and to show you its status. The invitation email tells the professional your name and the email address you sign in with, the tax years you chose and when the invitation expires; it contains nothing from your record. When the professional accepts, we email you their name, firm and credential, so that you can end their access at once if you do not know them.

Once the professional has signed in with a password and an authenticator code and accepted, they can read — not change — your record for the tax years and the period you chose: your days and their jurisdictions, hours, trips, confirmations and notes, and documents. For the three-year presence test they also see how many days of each of the two years before each year you share counted for Puerto Rico and for the United States: the counts only, never those years' days. They never see your raw location fixes. They see medical-exception details only if you include them for that professional, which is a separate consent under our Consumer Health Data Privacy Notice; otherwise a day with a medical exception shows that one applies and how it counts, but not its details, not the day type, notes or activities you wrote for that day, and not the documents dated that day. Each time they open a tax year of your record, a document or a CSV bundle, it is added to an access log you can see. You can end their access at any time, and it ends at their next request. Copies a professional downloads or prints are in that professional's own custody.

4.7 Professionals who use the CPA portal

This subsection is for CPAs, enrolled agents, attorneys and other professionals who create an account at cpa.tax60.app. The portal is free, and it is read-only. The Professional Access Terms (https://tax60.app/legal/professional-terms) govern its use.

• What we collect. Your name, email address, firm (if you give one) and credential; your password, stored only as a one-way hash by our sign-in provider; your authenticator enrolment, whose secret our sign-in provider keeps only to check your codes; sign-in records (times, network address and browser, kept by our sign-in provider); the version and time of the Professional Access Terms and of this Policy that you accepted; whether your account is suspended, and why; and which of our users invited you, with each invitation's tax years, dates and access log (Section 4.6).
• How we use it. To run the portal: to sign you in with a password and an authenticator code, to show your clients who can view their record and each time you opened it, to email your client your name, firm and credential when you accept, and to email you about your account. We also use it for support, for the security of the Service and to comply with law. If you create a portal account, our staff may add you to our business contacts (Section 4.8).
• Retention and deletion. Your account information is kept while your account exists. The access log of each client's record belongs to that client's record and stays with the client's account after your access ends or your account is deleted, without its link to your account. Close Professional Access ends every client's access and removes your professional details while keeping your sign-in; Delete Account ends every client's access and deletes your account after a seven-day grace period, as Section 7 describes.
• Your rights. Section 12 applies to you in full. Write to privacy@tax60.app from the email address of your portal account.

4.8 Business contacts

We keep a small list of the accounting firms and tax professionals we work with or would like to: firm name, website, city and region, and size; for each person, their name, work email address, work phone number, title and credential; where the contact came from (our own research in public professional directories and firm websites, a referral, an event, a message they sent us, or a portal account); the stage of our conversation; and the notes, tasks, follow-up dates and emails our staff keep about them. Notes about firms never record a client's tax facts, and we never record which of our users are a firm's clients.

We use this list only for one-to-one business outreach and to support professionals who use the portal. We do not send bulk marketing to it, sell it, share it, or combine it with any user's record or with the launch list. Every outreach email says how to stop further email: reply "unsubscribe", or write to hello@tax60.app. We then mark the contact as not to be emailed and keep only what we need to honor that. Business contacts are kept while the business relationship is active, plus two years after the last activity, and you may ask us at any time to see, correct or delete what we hold about you (Section 12).

4.9 Support notes about your account

When you contact us, or your account needs attention, our staff may keep short support notes, labels (for example "billing-issue") and follow-up tasks about your account in our audited staff console, so that whoever helps you next has the context. Staff never record tax facts, locations or travel in them. The console also shows staff a timeline of the account: these notes, labels and tasks, the emails staff sent, changes to the account's settings made by staff, the states and dates of the invitations the account created, the support access it opened, and its subscription changes.

Support notes, labels and tasks are used only for support. They are stored with our database provider (Section 9), each one records which staff member wrote it and when, and every change is in the staff access log. They can be produced only as our Legal Process Policy describes. They are included, in full, when we answer your request to access your data (Section 12). They are deleted with your account, unless a legal hold applies (Section 4.2). A note staff delete is erased 30 days later.

---

5. How we use information

We use the information in Section 4 only to:

1. Provide the Service you asked for: authenticate you, store your record and return it to your devices and to the web app, generate commitments, deliver content-free push reminders, keep your subscription active, and operate the exports and the sharing you start.
2. Keep the Service reliable and secure: detect abuse, enforce owner-only access to your record, investigate crashes, and respond to security incidents.
3. Help you when you ask: if you contact support about a problem with your record, a staff member may look at the parts of it needed to resolve the problem, with your permission, which you give by opening support access (Section 3.3); and keep the support notes of Section 4.9.
4. Communicate with you about your account: the code that confirms your email address or resets your password, receipts, renewal and trial-ending notices, security notices, changes to these documents, and legal notices. If you gave us a phone number and we cannot reach you by email about your account, we may call or text you about that account matter; we never use the number for marketing, for sign-in codes, or for anything else.
5. Send product news, only if you opt in, and you can opt out with one tap in any such email; and, if you confirmed a launch-list request on tax60.app, tell you once that Tax60 has been released.
6. Comply with law, respond to valid legal process as described in our Legal Process Policy, enforce our Terms, and protect rights and safety.

We do not use personal information to build profiles, to make automated decisions with legal or similarly significant effects, or for any purpose incompatible with the one you gave it to us for. We do not use the contents of your record for analytics, advertising, or product research, and we do not train any machine-learning or AI model on user data.

Analytics and crash reporting. The app records a small set of product events (for example, "onboarding completed," "day confirmed," "Always permission downgraded," "export generated") and crash reports. These are tagged with app version, iOS version, device model, and a random per-install identifier that is not linked to your account. They contain no coordinates, no jurisdiction names, no day counts, no hours, no notes, and no document contents. Crash reports are scrubbed of location breadcrumbs before they leave your device. Our current providers are listed at https://tax60.app/legal/subprocessors.

Notifications. The evening summary ("Today: Puerto Rico · 6 h 12 m worked") is not a push at all: your iPhone schedules it at the time you set and writes it from the record stored on your iPhone, and nothing about it is sent to create it. The few pushes we do send (a catch-up reminder, a tracking-health alert) are content-free: each carries only a type and an identifier, and any detail you see is composed on your iPhone by the app's notification extension from the record stored there. Apple's push service never sees your location or hours.

---

6. Retention

How long your raw location fixes are kept is a setting you choose. Every account starts on Full evidence; to change the tier, write to privacy@tax60.app from your account email:

Day records are never automatically deleted under any tier, because they are the record. You may ask us to delete a date range of your record by writing to privacy@tax60.app from your account email; we delete it from our servers, and the fact that a range was deleted (dates only, not contents) is permanently noted in your record's change log so that the record's integrity statement stays truthful.

Account-level information is retained as stated in Section 4.2. Our encrypted backups expire on a rolling schedule of no more than 30 days, so information deleted from our servers leaves our backups within 30 days. When you cancel a subscription, nothing is deleted: tracking continues on your iPhone, export stays free, and your record stays in your account, where new entries are not uploaded until you resubscribe.

---

7. Deletion

You may delete your account at any time by emailing privacy@tax60.app from your account email address.

1. We first ask you to download your data (Profile › Data & reporting › Download your data in the app) and, if you want it, to ask for your complete record (Section 12.1, item 2), because deletion is irreversible and we cannot recover a deleted record for you.
2. Deletion starts a seven-day grace period during which you can cancel it by signing in.
3. After the grace period we permanently delete your record (every version of every entry), your documents, commitments, device records, push tokens, invitations and their access logs, support access and its log, the support notes, labels and tasks about you, the emails our staff sent you and the notices queued for you, and profile within 30 days, and delete your authentication account. Our deletion job verifies that zero rows remain for your account. Copies in our encrypted backups expire within 30 days after that (Section 6).
4. What survives deletion, and why: billing records that tax and accounting law require us to keep (seven years); entries in our internal register of legal process, if any process concerning your account was received; support correspondence for three years; the entries of our staff access log about your account, stripped of anything that identifies you, until their two years are up; and aggregate analytics that were never linked to you. If you used the CPA portal as a professional, the access logs in your clients' accounts stay with those accounts, without their link to yours.
5. Legal holds. If you have placed an audit hold on your account (for an open examination or litigation), or we have placed one because we received legal process concerning your account, deletion is deferred, not refused: we tell you the hold exists, and deletion proceeds automatically when the hold is released. See the Legal Process Policy for how holds work.

Deleting the app from your iPhone does not delete your account or your record; ask us as described above.

---

8. No sale, no sharing, no advertising, no third-party AI

• We have never sold or shared personal information for money or any other consideration and we never will. This includes precise location, which is the most valuable thing a data broker could ask us for and which we will never provide.
• We do not disclose personal information to third parties for their own marketing, and we do not engage in "sharing" for cross-context behavioral advertising as California law defines it.
• We do not send personal information to any third-party artificial-intelligence or large-language-model service. If we ever offer a feature that would send any of your data to such a service, it will be off by default and require your explicit, separate consent at the moment you turn it on, as Apple's App Review Guideline 5.1.2(i) requires.
• Because we do not sell or share personal information, there is nothing to opt out of; we nonetheless honor Global Privacy Control signals on tax60.app as a valid opt-out request.

---

9. Service providers who process data for us

We use a small number of service providers ("processors") who act only on our instructions and who are contractually prohibited from using your information for anything else. They receive only what is necessary for their function, and they store what they hold encrypted at rest. The current list, with each provider's role, location, and what it receives, is maintained at https://tax60.app/legal/subprocessors and is part of this Policy. As of the effective date, the categories are:

• Apple (Sign in with Apple, App Store billing, Apple Push Notification service, and iCloud Drive on your own Apple account, where you may choose to save your exports).
• Database, object storage and authentication hosting on infrastructure located in the United States (AWS us-east-2, Ohio). This provider stores your record, your documents, the commitments and the information in Section 4.2.
• Website hosting for tax60.app, the web app, the CPA portal at cpa.tax60.app and our staff console at admin.tax60.app. This provider processes the parts of your record that a page shows, to render it for the signed-in session that opened it: your own web app sessions, the professionals you invite, and our staff while you have support access open.
• Transactional email delivery for confirmation codes, receipts, invitations and notices, for the one-to-one emails our staff send from the staff console, to you and to business contacts, and for the launch-list confirmation and release announcement described in Section 4.4.
• Web payments processing for purchases made on tax60.app; the processor, not Tax60, holds your card details.
• Crash reporting and product analytics as described in Section 5.

We will update the subprocessor list at least 30 days before a new provider begins receiving personal information, except where an emergency replacement is needed to keep the Service running, in which case we update the list as soon as practicable.

---

10. Other disclosures

We disclose personal information outside Sections 8 and 9 only:

• To you, and to the professionals you invite, as Section 4.6 describes.
• Under valid legal process, strictly as set out in our Legal Process Policy: only on a valid, specific subpoena, summons, warrant or court order; never voluntarily to any tax authority; with notice to you before compliance unless a court or statute prohibits it; and, for the contents of your record, only under the process that Policy requires for record contents.
• To protect life and safety, where we believe in good faith that disclosure of account information (never the contents of your record) is necessary to prevent imminent danger of death or serious physical injury, as permitted by 18 U.S.C. § 2702(c)(4); we have never made such a disclosure and would report it in our transparency report.
• In a change of control. If Tax60 is acquired or merges, your information transfers with the Service under this Policy, and we will notify you at least 30 days before any transfer that would change how your information is handled, with time to export and delete first.

---

11. Your consent for sensitive data, and how to withdraw it

Precise location, information about medical treatment, and the contents of documents you attach are "sensitive" under the state privacy laws that apply to Tax60. We collect them only with your opt-in consent, only as strictly necessary to provide the Service you have requested, and never for any other purpose.

• Location. The app asks for location permission once, after a screen that explains exactly what is collected and that recording continues with the app closed; iOS later asks you, in its own words, whether to keep allowing background use. The text you consented to and the time are stored in your profile. You may withdraw consent at any time in iPhone Settings › Privacy & Security › Location Services › Tax60; the app continues to work in manual mode (you enter each day's jurisdiction yourself), and nothing about your subscription changes.
• Medical-exception tags. The first time you tag a day as qualifying medical treatment, the app shows the Consumer Health Data Privacy Notice and asks for your consent before saving the tag. Including medical-exception details in what a professional you invite can see takes a separate consent for that professional. You may withdraw by removing the tag, deleting attached certifications, leaving medical details out of a professional's access, or deleting the account.
• Documents. You choose every document you attach, and you may delete any of them.
• Marketing email and the launch list. Off by default. Product news is opt-in in the app, and every such email carries a one-click unsubscribe link. The tax60.app launch list is double opt-in: your address is stored only after you open the confirmation link we email you, and the release email carries the same one-click unsubscribe link (Section 4.4).

---

12. Your privacy rights

Tax60 gives every user, wherever in the United States or Puerto Rico you live, the rights below. We extend them regardless of whether a particular state statute applies to a company of our size, and we apply the strictest applicable timeline to every request.

12.1 The rights

1. Know and access. Confirm whether we process personal information about you and receive a copy of it, including the categories of personal information, sources, purposes, and the categories (and, for residents of states whose laws provide it, the names) of third parties to whom personal information was disclosed. The list of third parties is the subprocessor list, plus the professionals you invited yourself; we disclose to no others.
2. Portability. Receive your information in a portable, machine-readable form. In the app you can download your record at any time, for any month, year or range of dates: a spreadsheet (CSV) of every day and activity and a calendar PDF with one month per page, in one zip, free, forever, including after your subscription lapses and during any legal hold. On request (Section 12.2) we send you your complete record (every version of every record, your documents, the raw location fixes and the commitment chain) in a machine-readable format, free of charge, together with a copy of everything else we hold about you.
3. Correct. Correct inaccurate personal information. Your record is correctable by you inside the app (every correction is logged, and the original is preserved); account information can be corrected in Profile › Account or by request.
4. Delete. Delete personal information, as described in Section 7.
5. Opt out of sale, sharing, targeted advertising and profiling. We do none of these, so the opt-out is permanently in effect for every user.
6. Limit use of sensitive personal information. We already use sensitive information only for purposes that California law treats as necessary to provide the requested service (Cal. Code Regs. tit. 11, § 7027(m)); you may nonetheless ask us to confirm this in writing.
7. Withdraw consent to sensitive-data processing at any time (Section 11).
8. Non-discrimination. We will not deny the Service, charge a different price, or provide a different level of quality because you exercised a right.
9. Appeal. If we decline a request, you may appeal (Section 12.3).

12.2 How to exercise a right

• In the app: Profile › Data & reporting (Download your data) and Profile › Account (name, email, phone, and signing out). A copy of your complete record, a retention tier, an audit hold, a date-range deletion and account deletion are requested by email, below. Signing out stops recording on that iPhone and either keeps your record on it, so that logging back in with the same account picks up where you left off, or — if you choose Sign out and remove record from this iPhone — erases the record from the iPhone. Removing the record from an iPhone is not deleting your account: your record stays in your account until you delete the account (Section 7), and logging in again on any iPhone downloads it and checks every entry against its commitment. Entries that had not reached our servers when you removed the record are not in your account.
• By email: privacy@tax60.app, from your account email address. If you write from another address, we will verify you by sending a confirmation to your account email or by asking you to confirm from inside the app. We match requests to the account using only the email address and Apple identifier; we will never ask for your password, and no legitimate Tax60 message ever will.
• By mail: PLUSH LLC, Attn: Privacy, 348 Calle Mendez Vigo 1001, Dorado, PR 00646, United States.
• Through an authorized agent: the agent must provide your signed written permission, and we will still verify your identity directly with you and confirm that you authorized the request. Requests under a power of attorney valid under Puerto Rico or state law are accepted without a separate permission.

We respond within 45 days of receiving a verifiable request. If we need more time (at most 45 additional days), we tell you why before the first 45 days end. A copy of your complete record is always free. We do not charge for other requests unless they are manifestly unfounded, excessive, or repetitive (more than twice in a twelve-month period), in which case we may charge a reasonable fee or decline, and we will explain our decision.

12.3 Appeals

If we decline all or part of a request, you may appeal by replying to our decision or emailing privacy@tax60.app with "Appeal" in the subject line. A different person than the one who decided your request reviews the appeal, and we answer in writing within 45 days, explaining the reasons for the decision. If we deny the appeal, our answer includes how to contact your state attorney general or privacy regulator to submit a complaint. Residents of Puerto Rico may contact the Puerto Rico Department of Consumer Affairs (DACO).

12.4 California

This subsection is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act. In the preceding twelve months we collected the following categories of personal information (Cal. Civ. Code § 1798.140(v)), from the sources and for the business purposes in Sections 4 and 5:

At your direction, we also disclose the parts of your record you choose to the professionals you invite (Section 4.6). We do not sell or share personal information, including that of consumers under 16 (we have no such consumers). We do not offer financial incentives in exchange for personal information. Retention for each category is stated in Sections 4 and 6. California's "Shine the Light" law (Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct-marketing purposes.

12.5 Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states

Residents of these states have the rights in Section 12.1 under their state's law, exercised as in Section 12.2, with the appeal process in Section 12.3. Specifically:

• We obtain opt-in consent before processing sensitive data (precise geolocation and health-related tags) and process it only when strictly necessary to provide the Service you requested, which is the standard Maryland's Online Data Privacy Act imposes; we never sell sensitive data, consent notwithstanding.
• We conduct no targeted advertising, no sale, and no profiling in furtherance of decisions that produce legal or similarly significant effects.
• We recognize universal opt-out mechanisms (such as Global Privacy Control) on tax60.app.
• We maintain a written data protection assessment covering our processing of sensitive data, including its storage in your account, and we make it available to state regulators on request as the law provides.
• Residents of Oregon, Minnesota and Delaware may request the list of specific third parties to which we have disclosed personal information; that list is the subprocessor list, plus the professionals you invited yourself.

12.6 Nevada

We do not sell covered information as Nevada Revised Statutes Chapter 603A defines the term. Nevada's consumer health data law (SB 370) is addressed in our Consumer Health Data Privacy Notice.

12.7 Washington

Washington's My Health My Data Act is addressed in our Consumer Health Data Privacy Notice (https://tax60.app/legal/health-data), which is part of this Policy.

---

13. Children

Tax60 is for adults. We do not offer the Service to, and do not knowingly collect personal information from, anyone under 18. If we learn that an account belongs to someone under 18, we delete the account and its data. If you believe a minor has an account, email privacy@tax60.app.

---

14. Where the Service is offered, and where data lives

Tax60 is offered only to residents of the United States and Puerto Rico through the U.S. App Store storefront and tax60.app. It is not offered to residents of the European Union, the European Economic Area, or the United Kingdom, and we do not market to them; if you reside there, do not use the Service. Traveling abroad with the app is fine: the app keeps working, and your record reaches your account over an encrypted connection from wherever you are.

Our servers are located in the United States (AWS us-east-2, Ohio), with our website and web app served from U.S. infrastructure. Apple services operate under Apple's own privacy terms and infrastructure.

---

15. Security

• Encryption: TLS 1.2 or higher for every connection, with App Transport Security enforced in the app; your record, your documents and our backups are encrypted at rest (AES-256) by our hosting providers; on your iPhone, the record is protected by iOS Data Protection.
• Integrity: the server computes each entry's SHA-256 hash itself and signs a commitment for it with Ed25519; your iPhone verifies and keeps every commitment, and every page of the calendar PDF you download prints the chain anchor. The private signing key is held in Supabase Vault, encrypted at rest with a provider-managed key kept outside the database, never in the app or in our repository, and readable only by our server-side signing function; the history of public keys is published at https://tax60.app/legal/keys so that any commitment can be verified independently.
• Account credentials: your password is stored only as a one-way bcrypt hash by our sign-in provider; it is never written to a log, never sent to us in readable form, and cannot be reversed. The app requires at least 12 characters with an uppercase letter, a lowercase letter and a number. Confirmation and password-reset codes are six digits, expire in ten minutes, can be requested at most once a minute, and are rate-limited per network address. Changing or resetting your password never changes your record.
• Access control: row-level security on every database table and storage location, so that a signed-in account can reach only its own entries and files; stored entries and commitments are insert-only, so history is never overwritten; service credentials exist only in server-side functions and are never shipped in the app or held by the website; staff access to production systems is limited to named administrators, and staff look at a user's record only as Section 3.1 allows.
• Verification: automated tests prove owner isolation on every table and storage location, that stored history and protected columns reject changes, and that a deleted account leaves zero rows.
• Device: the record, the documents and the commitments stored on your iPhone are protected by iOS Data Protection, and attached documents are excluded from device backups.
• Backups: backups of the database and storage are encrypted and expire within 30 days.

No system is perfectly secure. If a breach affects your personal information, including your record, we will notify you without unreasonable delay and within the time required by law, by email and in the app, and we will tell you what was affected and what we are doing about it. We will notify the Puerto Rico Department of Consumer Affairs (DACO) as Puerto Rico Act 111-2005 requires, and any other regulator whose law applies.

---

16. Changes to this Policy

We will notify you of material changes at least 30 days before they take effect, by email to your account address and by a notice in the app, and we will keep a dated archive of prior versions at https://tax60.app/legal/privacy/versions. Version 2.0 changed how your record is stored (Section 3); records made while version 1.0 was in force come under it only after their owner agrees in the app (Section 3.1, item 7), and that agreement is the explicit, opt-in consent that version 1.0 required for such a change. No change will permit sale, sharing, advertising use, or third-party-AI processing of your data without a new, explicit, opt-in consent. Continued use after the effective date of a change means you accept it; if you do not, export and delete your account before that date.

---

17. Contact

PLUSH LLC, doing business as Tax60 348 Calle Mendez Vigo 1001, Dorado, PR 00646, United States

• Privacy requests and questions: privacy@tax60.app
• Legal notices and legal process: legal@tax60.app
• Support: support@tax60.app

Related documents: Terms of Service (https://tax60.app/legal/terms) · Consumer Health Data Privacy Notice (https://tax60.app/legal/health-data) · Legal Process Policy (https://tax60.app/legal/legal-process) · Methodology (https://tax60.app/legal/methodology) · Subprocessors (https://tax60.app/legal/subprocessors) · Transparency Report (https://tax60.app/transparency)