What this site collects.

As little as it technically can. This is an information site. No accounts, no newsletter, no cookies — just a contact form, which reaches me by email. The apps process your data for you, not for me: tax work stays on your Mac, and ShoeboxTaxes Capture moves receipt images only through the private database in your own iCloud account.

1. Who is responsible

ShoeboxTaxes is written by one person in New Zealand. There is no company and no staff.

Service providers processing personal data on my behalf:

• Cloudflare, Inc.
• Hayo Janßen IT-Systeme & Service
• Apple Pty Limited

There is deliberately no street address here: email is the contact route, and it is read and answered. A postal address will be provided on legitimate request.

2. Hosting and server logs

This site is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Serving a page unavoidably involves processing technical connection data:

• your IP address,
• the date and time of the request,
• the address requested and the HTTP status code,
• browser type, browser version and operating system,
• the amount of data transferred.

This is necessary to deliver the site at all, and it keeps the site secure and available. I do not analyse, combine or store these logs; Cloudflare retains them briefly as part of running the service.

3. Analytics

I use Cloudflare Web Analytics to see whether anyone is finding the site. It was chosen specifically because it works without identifying anyone:

• it sets no cookies,
• it stores nothing on your device and reads nothing from it,
• it does no fingerprinting,
• it builds no identifiers and no user profiles,
• it does not follow you between pages or across days.

What I see is aggregate: which pages were viewed, roughly which country they were viewed from, what referred them, and what kind of device was used. None of it can be traced back to a person.

4. The contact form

The Support section carries a form. All of this section is about that form: if you never use it, none of it happens.

What it processes, and nothing besides:

• Your email address — required. It becomes the Reply-To of the message that reaches me, which is the whole of how I answer you.
• Your message — required, up to 5,000 characters. What goes in it is your choice; nothing obliges you to put anything in there you would rather not.
• Your name — optional, and the field says so. Leave it empty and the message still arrives.
• Which of the two sites you wrote from, and whether you picked the support or the beta topic, so the two can be told apart.
• A short-lived signed number, fetched when you first click into a field. It is a timestamp and a signature over it — no identifier of any kind — and it exists only so a submission completed inhumanly fast can be turned away. It lives in the page's memory for as long as the tab is open and is never written to your device.

What for. Reading your message and answering it. Nothing else: no mailing list, no profile, no follow-up you did not ask for.

On what basis. Where you are writing about the app, this is processing at your own request, in the run-up to or under an agreement — GDPR Art. 6(1)(b). Otherwise it rests on my legitimate interest in answering people who write to me, Art. 6(1)(f), and so do the spam defences that go with the form. Under the New Zealand Privacy Act the information is collected from you, by you, for that purpose and no other, which is what IPP 1 to 3 ask.

Two fields are required, and here is what follows from that. Without an email address there is nowhere to send an answer; without a message there is nothing to answer. The form will not submit without either, and that is the only consequence — nothing else on this site or in the app depends on them. Leaving the name blank costs you nothing at all.

Where it goes. The form posts to a Cloudflare Worker with no database. From there, my email providers deliver the message to the mailbox I read in New Zealand. Cloudflare keeps a brief request log of the endpoint itself, as in section 2. Section 5 covers the transfers.

How long it is kept. Your message sits in my mailbox as ordinary correspondence, for as long as whatever it is about is live and for as long after that as it is worth being able to look back on — to recognise a bug that has resurfaced, say. There is no fixed period, the only copy is that one, and if you ask me to delete it, I will.

5. International transfers

Cloudflare is a US company running a global network, so serving this site may involve processing outside your country. Cloudflare provides appropriate safeguards for those transfers, namely the European Commission's Standard Contractual Clauses, alongside its certification under the EU-US Data Privacy Framework. Details are at cloudflare.com/trust-hub/gdpr.

6. The demo shoebox download

A sample shoebox is available at /demo-dl. It is served by the same infrastructure as the rest of the site, so section 2 applies. No registration is involved, and the sample contains only invented companies, names and amounts, no real data.

7. The apps themselves

The site and the apps are different things, and the difference matters: neither ShoeboxTaxes for Mac nor ShoeboxTaxes Capture processes data for me.

• Your bookkeeping records, imported documents and settings live in a shoebox file on your own Mac.
• Document parsing, OCR, categorisation and every calculation run on the Mac.
• The Mac app has no developer-operated server or account and sends no telemetry, analytics or usage data anywhere.
• It makes an outbound request only when you explicitly ask it to, currently, importing a published exchange-rate document from a URL you enter yourself. That request goes to the source you named, not to me.
• If you keep your shoebox in iCloud Drive, syncing happens through your own Apple account, under Apple's privacy policy.
• ShoeboxTaxes Capture keeps a receipt image on your iPhone or iPad and, once you assign a Shoebox, sends it through the private CloudKit database in your Apple account to your Mac. The original stays on the iPhone or iPad until the Mac confirms a successful import.
• To offer those destinations, the Mac app publishes limited information about the Shoeboxes you allow to that same private database. It does not publish bookkeeping records, documents, local paths, bookmarks, tax data or personal identifiers.
• Capture has no separate ShoeboxTaxes account or developer-operated server and performs no OCR, tax calculation, categorisation or bookkeeping. It sends no telemetry, analytics or usage data.

I have no access to your tax data, your receipt images or that private CloudKit database, and no technical means of getting them.

8. Your rights

Under the New Zealand Privacy Act 2020 you may ask what personal information I hold about you and ask for it to be corrected. A plain email to shoeboxtaxes [at] macsebi [dot] com is enough. If you are not satisfied, you can complain to the Office of the Privacy Commissioner.

If you are in the EU or the UK, the GDPR also applies to this site, and gives you rights of access, rectification, erasure, restriction, portability and objection, plus the right to complain to your local supervisory authority. The German-language Datenschutzerklärung sets out the same processing with the relevant article references.

One honest caveat: server logs and analytics figures cannot be linked to a person by me. Where I genuinely cannot identify you from the data, I cannot act on an access or deletion request — for those, there is nothing I can point to as yours. A message you send through the contact form is the exception: it arrives as an ordinary email, so I can tell you what is there, and delete it if you ask.

9. No cookies, no tracking

This site sets no cookies and embeds no third-party fonts, maps, videos, social widgets or ad networks. Everything is served from my own domain, with the single exception of the analytics script described in section 3.

10. Changes

This policy will change if the processing does, for instance if the app ever gains services of its own. The version published here, with the date above, is the current one.