iTrack4Tax Privacy Policy

This Privacy Policy explains how Bufo Labs LLC ("we," "us," "our") collects, uses, shares, and protects information when you use the iTrack4Tax app for iPhone, iPad, and Mac (the "App") and its related services. If you have questions, contact us at infodev@bufosoftware.com.

Summary

• iTrack4Tax stores your business records (expenses, trips, receipts, entities, and distributions) in your account on our secure cloud service so they're backed up and can be shared with people you invite.
• With your permission, the App uses your device's location, including in the background, to detect business trips automatically.
• Receipt text is read on your device using Apple's built-in text recognition.
• We don't sell your information, show ads, use third-party analytics, or track you across other companies' apps or websites.
• You can delete your account and its data at any time.

Information we collect

Account information

You sign in with an email address and password. Passwords are handled by our authentication provider and stored only in hashed form. Our authentication provider sends you emails to verify your address when you sign up and to reset your password if you ask.

If you turn on Face ID or Touch ID, the App uses it only to unlock your saved sign-in, which is kept in your device's Keychain. Apple handles Face ID and Touch ID on your device. The App never receives your face or fingerprint data, and we don't either.

Business records you enter or import

To provide the App's features, we store the information you add, including:

• Entities and workspaces: business names, entity type, return type, tax-year settings, and, if you choose to enter it, the entity's tax identification number (such as an EIN). Tax IDs are optional. They're protected by our hosting provider's encryption at rest, and only members of that entity can view them.
• Properties: names and addresses of rental properties you add.
• Expenses: vendor, amount, date, category, notes, reimbursement status and settlement date, and the payment method you select. Payment methods are labels you define (for example, "Business Visa") plus the last four digits of a card. The App doesn't collect full card numbers, bank account numbers, or bank logins.
• Mileage trips: trip date and time, start and end coordinates, the street addresses for those points (when available, and editable by you), distance, classification (business, medical, or charity), the business purpose you enter, and any entity, property, or calendar event you link.
• LLC members and distributions: member names, ownership percentages, roles, and distribution amounts, dates, and types.
• Imported files: the contents of CSV or Excel files you choose to import. The App reads only the files you select.

Some of these records may include information about other people, such as your business partners or LLC members. Please only add information you have the right to share.

Receipt images

When you photograph or choose a receipt image, the App reads the text in it on your device using Apple's Vision framework to fill in vendor, amount, date, and card last four. The image is then uploaded to private cloud storage linked to your account so it stays with the expense and can be included in your reports and audit bundle.

Location

If you turn on automatic trip detection and allow location access, the App uses your device's precise location, including when the App is closed or running in the background, to detect when trips start and end. While a trip is in progress, location readings are kept temporarily on your device to measure distance and are discarded when the trip ends. We save only the trip's start and end points, not the route you drove. Location is used only to create trip records. You can use the App without location access and enter trips by hand. You can change this permission anytime in your device Settings.

Calendar

If you allow calendar access, the App reads your calendar events on your device so you can link a trip or expense to a meeting or appointment. When you link an event, we save only a reference identifier for that event. Event details such as the title, time, location, attendees, and notes are read from your calendar on your device when you view the trip. They aren't uploaded or stored by us. We don't upload the rest of your calendar.

Motion and fitness

If you allow Motion & Fitness access, the App uses your device's motion activity (for example, whether you're driving) on your device to help detect when trips start and stop. Motion data isn't stored or uploaded.

Camera and photos

The App uses your camera to photograph receipts and lets you choose existing images from your photo library. It accesses only the photos you select.

Invitations

If you invite someone to an entity or workspace, we store the email address and role you enter for them. The App creates an invitation link that expires. You decide how to send it (for example, by text message or email), and we don't send it for you.

Device and technical information

To keep your account secure, the App records an identifier for the device you're signed in on, so it can enforce one active device per account. Our service providers may also keep standard technical logs, such as IP addresses, request times, and error information, for security and reliability.

What we don't collect

We don't use advertising identifiers, third-party advertising, or third-party analytics, and we don't track you across apps or websites owned by other companies.

How we use information

We use the information above only to:

• provide the App's features, including syncing your records, generating reports and exports, applying IRS mileage rates, and enabling shared access;
• secure your account and prevent misuse, for example by enforcing one active device;
• respond to your support requests and send service messages such as invitations and account notices;
• maintain, troubleshoot, and improve the App; and
• comply with legal obligations.

We don't use your records for advertising, and we don't sell or rent them.

How information is shared

• People you invite. Members of your entities or workspaces (for example, a partner or your accountant) can see and change records according to the role you give them.
• Service providers. We use Supabase to host our database, user authentication, and file storage. Supabase also sends our account emails (sign-up verification and password reset). Supabase processes data on our behalf under contract and may not use it for its own purposes. We don't use any other email, analytics, or advertising providers.
• Exports you share. When you export a report or audit bundle and send it to someone, such as your tax preparer, what happens next is controlled by you and the recipient.
• Legal reasons. We may disclose information if required by law, or to protect the rights, property, or safety of our users, the public, or Bufo Labs LLC.
• Business transfers. If Bufo Labs LLC is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

Where data is stored and how it's protected

Your data is stored with Supabase in data centers in the eastern United States (Northern Virginia). Every database table uses row-level security, so records are isolated per account and workspace at the database level. Receipt images are kept in private storage and opened only through short-lived signed links. Data is encrypted in transit and at rest by our hosting provider.

No system is perfectly secure, but we work to protect your information and to limit access to it. Please protect your device with a passcode and keep your sign-in credentials private.

How long we keep information

We keep your records for as long as your account is active, so they're available for tax filing and recordkeeping. When you delete your account, your account and the records it owns are deleted right away. Uploaded receipt images are removed from storage within 7 days after that. During that time they aren't linked to any account and can't be opened through the App. Our hosting provider also keeps daily backups for 7 days, so deleted data can remain in backups for up to 7 days before it's permanently removed. We may keep limited information longer when the law requires it.

The IRS generally expects you to keep tax records for several years. Export your reports before deleting your account.

Your choices and rights

• Permissions: You can allow or revoke location, calendar, camera, and photo access at any time in your device Settings. Turning one off only affects the feature that uses it.
• Access and export: You can view your records in the App and export them as PDF, CSV, or an audit bundle.
• Correction: You can edit your records in the App at any time.
• Deletion: You can delete individual records in the App. You can also delete your account from the App's Settings, or ask us to do it by email. Deleting your account permanently deletes the entities, trips, expenses, distributions, and member records it owns right away. Receipt images are deleted within 7 days (see How long we keep information).
• Your privacy rights: Depending on where you live, you may have rights to access, correct, delete, or get a copy of your personal information, and to appeal a decision about a request. To make a request, email infodev@bufosoftware.com. We'll verify your request and respond within the time the law requires. We won't treat you differently for exercising your rights.

Children

The App is meant for adults managing business and tax records. It isn't directed to children under 13 (or the minimum age in your country), and we don't knowingly collect their information. If you believe a child has given us information, contact us and we'll delete it.

International users

Bufo Labs LLC is based in the United States, and your information is processed in the United States. By using the App, you understand that your information will be transferred to and processed in the United States.

Changes to this policy

We may update this policy from time to time. We'll post the new version on this page and update the effective date. If the changes are significant, we'll also tell you in the App or by email.

Contact us