Privacy policy

Cette politique est aussi offerte en français. Version française

Interim version. This policy is interim: a lawyer has not yet reviewed it. It describes what the site does today. Any change after that review is published as "Changes to this policy" says.

This policy covers tax-explained.com and www.tax-explained.com, and the address of our analytics dashboard, metrics.hesameskandari.com (see "Who sees your information"). It explains what personal information we collect, why, how long we keep it, who can see it, and your rights.

In short

• The calculator works without an account. We don't sell your information or use it for advertising.
• The amounts you type are used to compute your result. We don't store them, except in the cases set out in "The amounts you enter".
• Our servers keep logs of each request, with your IP address, to run and protect the site, for the periods in "How long we keep it".
• Analytics are only for visitors whose device is set to a Canadian time zone, and only if you say "Yes". Until you answer, analytics collect nothing. "Yes" turns on basic counts, such as the page viewed and how fast it loaded, records how long you spend on each page, and links your visits for up to 12 months with a random ID. If you say "No" or close the banner, nothing is counted.
• Your information is hosted in Toronto, Ontario, with Akamai, a United States company. Some copies and logs may be held or accessed outside Canada: see "Where your information is kept".
• You can ask to see, correct or delete your information. We answer within 30 days.

Who is responsible

This site is operated by its owner, an individual in British Columbia, Canada. The person in charge of the protection of personal information is:

• Title: Owner
• Email: privacy@hesam-eskandari.com

Write to this person with any question, request or complaint about your personal information.

What we collect and why

The amounts you enter

What: your income, RRSP and FHSA amounts, province or territory, and tax year.

Why: to compute your tax estimate.

How: your browser sends them to our server in the address of each calculation request. Our server computes the result and sends it back.

What we keep: we don't store these amounts in a database. Our calculation service does not write them to its logs, and our web servers' logs record the page address without them. The exception is a rare critical server fault (see "Server logs"): a line can then still record a calculation's amounts, at the first of our web servers together with your IP address, for the period in "How long we keep it". Your browser keeps every result calculated in a tab in memory until you close or reload that tab. After 3 minutes, a result is fetched from our server again when it is needed; the 3 minutes don't remove it.

Shared links: "Share" builds a link that contains the amounts you entered. Anyone who has the link can see them. When someone opens the link, the amounts reach our server in the page address. Our logs record that address without the amounts, except on a critical server fault, as above.

Older logs: before we changed our log formats, our servers' logs also recorded the amounts of calculations, with the visitor's IP address: in the address of each calculation, in the address of the page a request came from, and in the address of a request that failed. A job on our servers deletes each of those lines 14 days after it was written, and a backup of our servers, if one is kept, can hold a line up to 14 days more. So the last copy, backups included, is gone at most 28 days after the change.

Server logs

What: each time your browser asks our servers for a page or a calculation, the first of our web servers to receive it records:

• your IP address;
• the date and time;
• the page address, without the part after "?";
• the result code and the size of the response;
• the address of the page you came from (the "referrer"), without the part after "?";
• your browser's description (its "user agent").

The web server behind it records the same, with the first one's address in place of yours.

Our web servers' error logs record only critical server faults, such as a full disk or a file that can't be read. On such a fault, a line can still record the full address requested, including the part after "?", which holds a calculation's amounts: in the first web server's error log together with your IP address, and in the second's without it.

Our calculation service also records the requests it refuses: the time, the method and the address requested, without the part after "?", why it was refused, and, for a request refused because too many were sent in a minute, the random value of the session cookie it came with (see "Cookies and local storage"), or, without one, our own web server's address.

Our token service, which issues the token that protects your requests against forgery, records each request our site makes to it: its method and procedure, the result, how long it took and a random request number. It records nothing that identifies you.

Why: to keep the site running, find and fix faults, and protect it from abuse and attacks.

Who: only the person in charge, and Akamai as our host (see "Who sees your information").

Analytics requests (addresses starting with /m/ ) are recorded in neither the access logs nor the error logs of the first of our web servers. Until our analytics service answers, the check your browser makes for it (see "Analytics") can reach the web server behind it instead, which then records it as above, with the first one's address in place of yours.

Cookies and local storage

The first four are needed for the site to work, or only remember your settings. They are not used for analytics. Local storage stays in your browser, with two exceptions: the province it remembers is sent to us as part of each calculation you make, from the first one of each visit (see "The amounts you enter"), and the request that gx_metrics_pending keeps is sent to us until our server confirms it.

Our analytics dashboard's address, metrics.hesameskandari.com, sets two cookies of its own, only when a sign-in starts there: see "The dashboard's address".

Your language. Your browser's language settings are read to choose the page's language when you have not chosen one. We don't keep them.

Your time zone is read by your browser to suggest a province and to decide whether analytics apply (see "Analytics"). It is never sent to us. The suggestion is made in your browser: the suggested province reaches us only when you calculate or pick a province.

Fonts and other files come from our own server. The site loads nothing from other companies.

Analytics

We measure how the site is used, so we can fix errors and make it faster and clearer. We built this measurement ourselves. No analytics company receives it.

Where it applies. Only if your device is set to a Canadian time zone. Your browser checks this itself and sends us nothing to decide. Elsewhere, or if the time zone is unknown, we collect no analytics and show no banner.

Until our analytics service answers. In a Canadian time zone, and on the "Your analytics data" page, your browser first checks that our analytics service answers. The check sends no cookie, ID or analytics data. Until the service answers, analytics collect nothing and the site shows no banner or feedback box. Only a browser that said "Yes" is then offered "Turn off" and "Your analytics data" in the footer, and that page does not offer to download or delete feedback.

Global Privacy Control. If your browser sends this signal, we collect no analytics. If you had said "Yes", receiving the signal turns analytics off as if you had withdrawn: the data linked to your ID is deleted.

Before you choose. Until you answer the banner, analytics collect nothing: your browser sends us no analytics data, and keeps none to send later. Our web servers still log each request, as described in "Server logs". The banner first says what we would count and why, then asks for your answer in a part of its own, "Your choice", where "Yes" and "No" are side by side and equally easy. Until you answer, the footer says analytics are off.

If you say "Yes". From the moment you say "Yes", we count the page you are on; we never send anything measured before your answer. So that page is counted without how you arrived at it or how fast it loaded: those are counted only when you open the site again later. We count:

• the page viewed (its type, not its full address) and when it changes;
• how you arrived: the site you came from, if it is on our fixed list of search engines, social networks and AI assistants (any other site is stored as "other"), and the campaign tags in the address ( utm_source , utm_medium , utm_campaign ), kept only if they match our fixed lists (any other value is stored as "other");
• device type (phone, tablet or computer), browser and operating system and their major versions, and a range for the window's width;
• the page's loading time and other speed measures (Web Vitals): name, value, rating, and how the page was loaded (for example, a reload);
• errors: their kind (a failed request, a script error) and, for a failed request, its HTTP status code. Never an error message or a trace;
• whether a calculation was completed, with the tax year you chose, never the amounts.

We also record:

• a visit, so the pages you viewed in one visit are linked together;
• how long you spend on each page;
• a random ID, kept in a cookie, so your visits over the next 12 months are linked together.

Your browser matches the site you came from to a site name on your device, so the address of the page you came from is never part of what analytics sends.

Each item is stored with the hour it reached us, rounded down, its own random number, your visit and your random ID. We don't store your IP address with it. Our analytics service holds your IP address (for an IPv6 address, its first half) in memory while you use the site, and for at most 10 minutes after your last request, to limit abuse, and never writes it down. The service runs as two copies, and each copy keeps the address in two limits of its own: one for counts, one for your requests to turn analytics off or to get or delete your data. Our web servers' logs, kept for the periods in "How long we keep it", do record your IP address and the time of each request, so while they are kept, analytics data could be matched to them. We never make that match. We treat all analytics data as personal information.

The reports in our analytics dashboard, such as Overview, Sessions and Traffic, are computed from these stored items. When few people visit the site, a figure in them can describe a single visitor.

This creates a history of how you used the site. That is why it is off until you say "Yes". We use it only to understand how people use the site, never to make decisions about you, for advertising, or to sell.

If you say "No", or close the banner. Nothing is counted. We remember your choice in a cookie that holds no identifier.

Changing your mind. Where analytics apply, every page's footer offers "Analytics choices" until you answer, then "Turn off" or "Turn on". In any time zone, and with Global Privacy Control, a browser that said "Yes" is offered "Turn off" in the footer; where analytics don't apply, it only turns them off. If you said "Yes" under an earlier version of this policy, the footer offers "Turn off" beside "Analytics choices" until you answer again. In any time zone, the "Your analytics data" page, which this privacy policy page links to, also turns analytics off when you delete your data there. Turning analytics off takes one click. The analytics data linked to your ID is then deleted within 5 minutes, or, if our deletion process is stopped, as soon as it runs again, and so is the ID's record. Copies in backups are gone within 14 days (see "How long we keep it"). The ID itself is kept only on a list of withdrawn IDs, with the day you withdrew and the day its cookie expires, so we refuse anything still sent with it. It is kept until a month after its cookie's expiry date, or a month after you turned analytics off if that is later; at most 13 months. Turning analytics back on, including with "Turn on again" in the notice that follows turning it off, where analytics apply, shows the banner again, and a new "Yes" gives you a new ID.

How long your choice lasts. Your answer lasts 12 months, and so does the ID's cookie. We ask again after that, or sooner if we change what analytics collect, why, who receives it or where it is kept, or keep it longer. The ID's record, with any analytics data still linked to it, is deleted 13 months after we first see it, a month after your answer lapses, to allow for late counts. If you turn analytics off, it is deleted within 5 minutes, or as soon as our deletion process runs again, as described above.

What we keep about your choice. When you say "Yes", and again if you later turn it off, we write a record: the date, what you chose, the version of this policy and of the banner text, and your language. Each record is written once and never changed, so turning analytics off adds a second record and leaves the first as it was. Each record holds a one-way hash of your ID cookie's value, not your ID, and no browsing data. That value includes a random part that only your cookie keeps, so without your cookie we can't tell which ID a record belongs to. Only the dates could suggest it: on a day with a single "Yes", the record's date is also the day we first saw an ID; on a day with a single withdrawal, it is also the day the list of withdrawn IDs gives for one ID, and the "Yes" record that holds the same hash then points to that ID too. Answering "No" in the banner writes no record, except that a "No" from a browser that still holds an ID ends that ID like a withdrawal, and is recorded. When you agree to send feedback, we keep the same kind of record, with the date only and a one-way hash of the feedback's confirmation code, never the text. Whenever that feedback is deleted, we add a record of the deletion, also with the date only and the same hash, and with the site, the policy version and the language of your agreement. Its text version is your agreement's if you delete it. Otherwise it says how the feedback was deleted: operator if the person in charge deleted it (for example on a request, or because it came from a child), scan if our nightly check found what looks like an email address, a web address or a long number in it, retention when its 90 days ended, or restore if we deleted it after restoring our database from a backup. We keep each record for 5 years after it was written, so we can show what you agreed to, and that we did what you asked and what this policy says.

Receiving or deleting your analytics data. The "Your analytics data" page works in any time zone, and with Global Privacy Control. This privacy policy page links to it in any time zone, and so does the footer in a Canadian time zone or wherever this browser said "Yes", so you can still delete feedback you sent. If you said "Yes", it lets you, in that browser:

• see this browser's analytics ID, and copy it;
• download, in a structured file (JSON), what is linked to your ID: the ID and when we first saw it; the records of your choices, each with the site, the version of the text shown and its language; and the analytics data linked to the ID from the last 6 months and the current month, each item with its site, device type, browser and operating system major versions, window-width range and hour. Data received in the last 10 minutes may not be in it yet: a later download includes it;
• or delete it. Deleting also turns analytics off, since it withdraws your consent. As when you turn analytics off, we keep the record of your choices for 5 years, and the ID on the list of withdrawn IDs until a month after its cookie's expiry date, or a month after the deletion if that is later; at most 13 months.

The file is plain text, which any browser or text editor can open. If you need it in another form, write to us (see "How to ask").

Feedback is never linked to your ID. With its confirmation code, the same page lets you download your feedback, in the same format, or delete it. The download includes its status, which says whether we have read it (new, read or done), and the record of your agreement to send it. Deleting it adds a record of the deletion (see "What we keep about your choice"). We can only find data linked to this browser's analytics ID, which the "Your analytics data" page uses for you, or to a feedback's confirmation code. Without the code, we can find a feedback only from the day you sent it and what it said, to delete it (see "Feedback"). If this browser has no analytics ID, for example because you cleared your cookies, we can't find analytics data for it: data linked to an earlier ID may remain until its period ends, but nothing connects it to you. Your feedback can still be found with its confirmation code.

Feedback

Some pages ask whether anything was missing. Answering is optional.

• What we receive: your answer, the topics you tick as missing (such as deductions or credits) and any text you type, only if you tick both boxes: the one that agrees to send them, and the one that says you are 14 or older. Neither box is ticked for you. We keep with it the type of page the question was on, the day we received it, and the mark the person in charge gives it when sorting feedback (new, read or done).
• Please don't include your name, income, or any other personal details. Your browser removes email addresses, web addresses and long numbers before sending. Our server does it again.
• Why: to understand what is missing and improve the site.
• How long: 90 days, then it is deleted, with its mark. We keep a record that you agreed to send it, and a record of its deletion, however it is deleted (see "What we keep about your choice").
• Getting a copy or deleting it sooner: after sending, we show you a confirmation code. Use it on the "Your analytics data" page, which works in any time zone, to download or delete your feedback. Deleting it adds a record of the deletion, without the text. If you can't use the page, write to us with the day you sent it and what it said, and we delete it.
• From a child: if feedback shows that it was sent by someone under 14, we delete it (see "Children").
• The person in charge reads feedback. Each time feedback is viewed, the view is recorded.

The feedback box appears only where analytics may apply: in a Canadian time zone, without Global Privacy Control.

Who sees your information

Within our business: only the person in charge. Analytics reports are in a private dashboard, at metrics.hesameskandari.com, that only they can sign in to.

The dashboard's address. When your browser starts a sign-in at metrics.hesameskandari.com, or sends it a security report, the dashboard holds your IP address (for an IPv6 address, its first half) in memory, to limit sign-in attempts and reports, for at most 10 minutes after your last request, and never writes it down. Starting a sign-in there sets a cookie, __Host-gx_dashboard_flow , which holds, encrypted, the dashboard page to come back to, the time the sign-in started and random values that protect the sign-in. It lasts at most 10 minutes, and is removed as soon as your browser comes back from the sign-in. Only the person in charge can complete a sign-in: their browser then holds __Host-gx_dashboard_session , which holds, encrypted, their account's identifier, their email address, their sign-in tokens, when their access token expires and when they signed in. It expires 14 days after it was last renewed, and the dashboard refuses it 14 days after the sign-in, or once they sign out. The dashboard keeps no record of each visit. A request sent to it without HTTPS is only redirected, and our first web server records it as "Server logs" describes. When its security policy blocks something on one of its pages, your browser sends it a report: it keeps only the rule, the blocked site and which of its pages, for 30 days, never your IP address.

Service providers. These companies keep or process information for us:

• Akamai Technologies, Inc. (United States) hosts our servers and our database, in its Toronto, Ontario data centre.
• Aiven , which runs Akamai's managed database service.
• Akamai's own providers and support staff. Akamai's support staff, including teams in the United States, India and Poland, and others worldwide, may access our servers to give support. Akamai publishes the list of its providers: the latest we could read names Akamai's own companies in the United States, India and Poland, for support; Google, in the United States, for storage; and Salesforce, in the United States, for managing support tickets.
• Squarespace and Google. Squarespace, our domain provider, forwards the mail sent to privacy@hesam-eskandari.com to a mailbox at Google (Gmail), where your messages to us arrive. Both may keep that mail outside Canada.

We don't sell your information. We don't share it with anyone else, except when the law requires it (for example, a court order).

Where your information is kept

Your information is hosted in Toronto, Ontario, with Akamai. That is outside Québec. Some copies and logs may be held or accessed outside Canada:

• Akamai keeps its own technical logs of traffic to its cloud, which can include IP addresses and page addresses. It processes those logs in the United States.
• Database backups may be kept in the United States.
• Akamai's support staff, including teams in the United States, India and Poland, and others worldwide, may access our servers to give support.
• Squarespace, our domain provider, forwards the mail sent to privacy@hesam-eskandari.com to a mailbox at Google (Gmail). Both may keep your messages to us outside Canada.

Akamai is a United States company. Under United States law, it may have to give your information to United States authorities, without telling us. Akamai's terms also allow it to disclose data on a valid court order or subpoena without notice to us.

How we protect it

• The site is served over HTTPS.
• Analytics run on a separate server, reached over a private, encrypted link. The database accepts connections only from our analytics server; Akamai's administrators, and Aiven's on its behalf, can also reach it.
• Each part of the system can reach only the data it needs.
• The analytics database never receives your IP address.
• A nightly check looks for personal information that should not be there, such as an email address, and deletes it.

How long we keep it

The full table is kept by the person in charge and is available on request.

Your rights

You have the right to:

• know whether we hold personal information about you, see it, and get a copy, including a written copy you can read;
• receive information you gave us in a structured, commonly used format;
• correct information that is inaccurate, incomplete or ambiguous;
• withdraw your consent at any time, with "Turn off" in the footer, or "Delete my data" on the "Your analytics data" page, which this privacy policy page links to in any time zone, in the browser that said "Yes";
• ask us to stop disseminating information about you, or to de-index a link, where the law allows it;
• complain to us, and then to the Commission d'accès à l'information du Québec or, if you live outside Québec or your information crossed a provincial or national border (our servers are in Ontario), the Office of the Privacy Commissioner of Canada.

How to ask. Write to the person in charge at privacy@hesam-eskandari.com. Tell us what you want. We may ask for information to confirm the request is yours. We answer in writing within 30 days of receiving your request. It is free. If we refuse a request, or can't find what you ask for, we tell you why, and how to ask the Commission d'accès à l'information to review our answer.

Analytics data by request. The "Your analytics data" page, opened in the browser that said "Yes", downloads or deletes your analytics data at once, and shows that browser's analytics ID. An analytics ID quoted in a message is not enough on its own for us to send or delete its data, since anyone who saw it could quote it. Until we have a way to check that an ID is yours, we answer such a request by pointing you to that page.

When you write to us. We keep your message, any information you send to prove who you are, and our reply for 3 years, so we can show how we handled your request. We ask only for what we need to confirm it is you.

What we can find. We can find analytics data only through this browser's analytics ID, which the "Your analytics data" page uses for you, and a feedback only through its confirmation code or, to delete it, the day you sent it and what it said. Server logs are kept only for the periods above and are searched by IP address and time: tell us your IP address, when you visited, and your browser's description (its "user agent"), and we will look. We send you only the lines that match all three. If another visitor's lines can't be told apart from yours, we tell you so and send nothing of theirs.

Children

This site is a general tax calculator. It is not designed for children. If you are under 14, only a parent or guardian may say "Yes" to analytics or send feedback for you. The banner and the feedback box both say so, and the feedback box also asks you to confirm that you are 14 or older: we store no feedback without that box ticked. Analytics collect nothing before a "Yes". If we read feedback that shows it was sent by someone under 14, we delete it.

Complaints

Please write to the person in charge first. We acknowledge a complaint within 5 business days and answer it within 30 days.

If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, if you live outside Québec or your information crossed a provincial or national border (our servers are in Ontario), the Office of the Privacy Commissioner of Canada (priv.gc.ca).

How we manage personal information

• Roles: the person in charge is responsible for all personal information on this site and is the only person in our business with access to it.
• Keeping and destroying: our analytics system deletes its data automatically when each period above ends. A job on our servers deletes the log lines of our web servers and our services when their period ends.
• Assessments: we are completing the assessment of this site's privacy risks, and of keeping its information outside Québec.
• Incidents: if an incident creates a risk of serious injury, we notify the Commission d'accès à l'information and, where federal law applies, the Office of the Privacy Commissioner of Canada, and the people concerned.
• Complaints: handled by the person in charge, as described above.

Changes to this policy

When we change this policy, we post the new version here with its date. At least 30 days before the change takes effect, a dated notice on every page of the site, in English and French, says what is changing. We keep each earlier version for 5 years after it is replaced, and send it to you on request. If a change means new data, a new purpose, a new recipient or location, or a longer period for analytics, we ask for your consent again. Each version has a number, such as v1.0: the first part changes when we ask for your consent again, and the second for any other change.

Contact

Owner, Tax Explained privacy@hesam-eskandari.com