Legal · Subprocessors version history
Tax60 Subprocessors
Version 1.0 · Effective September 1, 2026 · Last updated September 1, 2026
This version is no longer in effect. The current version is 2.0.
Read version 2.0, effective October 1, 2026.
Effective September 1, 2026. This list is part of the Tax60 Privacy Policy (https://tax60.app/legal/privacy). It names every service provider that receives personal information on behalf of PLUSH LLC, doing business as Tax60, what each receives, and where it operates. No provider on this list receives a decryption key or any readable location, jurisdiction, hours, document, or decree data. We update this page at least 30 days before adding a provider, except for an emergency replacement needed to keep the Service running, which we post as soon as practicable.
| Provider | Function | What it receives | Location |
|---|---|---|---|
| Apple Inc. | Sign in with Apple; App Store billing; Apple Push Notification service; TestFlight; iCloud Keychain and iCloud Drive (on your own Apple account, under Apple's terms) | Apple user identifier, relay or real email, purchase transactions, push tokens and content-free push payloads; your key-encryption key and monthly exports live in your own iCloud account, which Apple end-to-end encrypts and which we cannot access | United States |
| Supabase, Inc. | Database, object storage, authentication, server functions | Account email and Apple identifier, device records, subscription state, ciphertext blobs and their metadata, commitments, legal-hold flags, server request logs | AWS us-east-2 (Ohio), United States |
| Amazon Web Services, Inc. | Underlying cloud infrastructure for the database and storage provider | Same as above, as the infrastructure host | us-east-2 (Ohio), United States |
| Vercel Inc. | Hosting for tax60.app and the web viewer; server-side functions for web checkout and push delivery | Request logs (IP address, pages, timestamps); web viewer sessions (ciphertext only; decryption happens in your browser) | United States |
| Resend, Inc. | Transactional email (sign-in codes, receipts, security and legal notices); the tax60.app launch list (Privacy Policy Section 4.4) | Recipient email or Apple relay address and the message content of those notices; for the launch list, the email address of anyone who confirms a launch-list request, stored as a contact until the release email is sent, plus delivery metadata | United States |
| Stripe, Inc. | Payment processing for purchases made on tax60.app | Name, email, payment card details (held by Stripe, never by Tax60), billing address, transaction records | United States |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Stack traces, device model, iOS version, app version, memory and performance metrics; no user identifier, no coordinates | United States |
| TelemetryDeck GmbH | Aggregate product analytics | Event names (for example "day confirmed"), app version, iOS version, device model, and a random per-install identifier not linked to your account; no coordinates, jurisdictions, counts, hours or decree data | Germany (aggregate, non-identifying event data only) |
| Backblaze, Inc. | Nightly encrypted off-site backup of the ciphertext blob store (B2 Cloud Storage), so that the record survives the loss of the primary provider | Ciphertext and blob metadata only; no key | United States |
Questions: privacy@tax60.app.