What this site collects.

As little as it technically can. This is an information site — no accounts, no forms, no newsletter, no cookies. And the app itself collects nothing at all: your numbers never leave your Mac.

Last updated: 28 July 2026

1. Who is responsible

ShoeboxTaxes is personal software written by one person in New Zealand. There is no company, no staff, and nobody processing your data on our behalf for our own purposes.

There is deliberately no street address here: email is the contact route, and it is read and answered. A postal address will be provided on legitimate request.

2. Hosting and server logs

This site is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Serving a page unavoidably involves processing technical connection data:

• your IP address,
• the date and time of the request,
• the address requested and the HTTP status code,
• browser type, browser version and operating system,
• the amount of data transferred.

This is necessary to deliver the site at all, and it keeps the site secure and available. We do not analyse, combine or store these logs; Cloudflare retains them briefly as part of running the service.

3. Analytics

We use Cloudflare Web Analytics to see whether anyone is finding the site. It was chosen specifically because it works without identifying anyone:

• it sets no cookies,
• it stores nothing on your device and reads nothing from it,
• it does no fingerprinting,
• it builds no identifiers and no user profiles,
• it does not follow you between pages or across days.

What we see is aggregate: which pages were viewed, roughly which country they were viewed from, what referred them, and what kind of device was used. None of it can be traced back to a person.

4. International transfers

Cloudflare is a US company running a global network, so serving this site may involve processing outside your country. Cloudflare provides appropriate safeguards for those transfers — the European Commission's Standard Contractual Clauses, alongside its certification under the EU-US Data Privacy Framework. Details are at cloudflare.com/trust-hub/gdpr.

5. The demo shoebox download

A sample shoebox is available at /demo-dl. It is served by the same infrastructure as the rest of the site, so section 2 applies. No registration is involved, and the sample contains only invented companies, names and amounts — no real data.

6. The app itself

The site and the app are different things, and the difference matters: the ShoeboxTaxes app processes nothing for us.

• Your records, documents and settings live only in a shoebox file on your own Mac.
• Document parsing, OCR and every calculation run on-device.
• The app has no server component, no accounts, and sends no telemetry, analytics or usage data anywhere.
• It makes an outbound request only when you explicitly ask it to — currently, importing a published exchange-rate document from a URL you enter yourself. That request goes to the source you named, not to us.
• If you keep your shoebox in iCloud Drive, syncing happens through your own Apple account, under Apple's privacy policy.

We have no access to your tax data, and no technical means of getting it.

7. Your rights

Under the New Zealand Privacy Act 2020 you may ask what personal information we hold about you and ask for it to be corrected. A plain email to [email protected] is enough. If you are not satisfied, you can complain to the Office of the Privacy Commissioner.

If you are in the EU or the UK, the GDPR also applies to this site, and gives you rights of access, rectification, erasure, restriction, portability and objection, plus the right to complain to your local supervisory authority. The German-language Datenschutzerklärung sets out the same processing with the relevant article references.

One honest caveat: server logs and analytics figures cannot be linked to a person by us. Where we genuinely cannot identify you from the data, we cannot act on an access or deletion request — there is nothing we can point to as yours.

8. No cookies, no tracking

This site sets no cookies and embeds no third-party fonts, maps, videos, social widgets or ad networks. Everything is served from our own domain, with the single exception of the analytics script described in section 3.

9. Changes

This policy will change if the processing does — for instance if the app ever gains services of its own. The version published here, with the date above, is the current one.