What we can touch, and what we can't

1. We have no access to your account

We cannot see your balance, place a trade, or move money, because you never give us anything that would let us. You bring the data to us:

• Kalshi: a CSV file you download from Kalshi yourself and upload.
• Polymarket: your wallet address. A Polymarket wallet’s history is already public, so the address lets us read the same trades anyone could read, and nothing more.
• Anything else: trades you type in by hand.

2. What happens to your trades

When you run a report, your trades travel over HTTPS to our server, a Cloudflare Worker. It matches your buys to your sales, prices the four tax methods, fills your forms, sends the result back, and discards the trades. They are not written to a database.

Our server logs record the request method and path, for example “POST /api/calculate,” and nothing else. No trades, no dollar amounts, no financial fields.

3. The one exception, and you control it

The CSV upload screen has an unticked box: “Save this export for testing/review.” If you tick it, we keep that file so we can improve how we read that platform’s format. Stored exports delete themselves after 90 days, are readable only by us behind an admin key, and are never shared or sold. Leave the box unticked and nothing is kept.

4. What stays in your browser

Your browser’s local storage carries your loaded trades from the upload page to the report page, remembers small preferences, and holds an anonymous analytics ID. It never leaves your device that way. Clearing site data removes it.

5. We don’t record your screen

Many sites run “session replay,” which records what you see and type so the company can watch it back later. On a tax tool, that recording would include your trades and your results.

We don’t run it. Our analytics is a small client we wrote ourselves that can only send a fixed list of named events, like “report run,” and it has no way to read the page. Our error reporting has replay switched off, sends no IP address or request bodies, and scrubs every error before it leaves your browser. Your trade data is filtered out of both.

6. Every outside service we use

• Cloudflare hosts the site and runs the server that computes your report.
• PostHog counts anonymous usage (page, anonymous browser ID, browser type). It sees your IP address, as any web request does.
• Sentry reports crashes, scrubbed as described above.
• Resend delivers your forms if you ask us to email them. We keep no copy.
• Kit holds your email address only if you sign up for the filing reminder or opt in to updates. It is kept apart from any trade data.
• Lemon Squeezy will run checkout when Pro purchases open. We never see your card.

No advertising networks, no tracking cookies, no data sales.

7. Coming next: connecting an account

We are building an optional way to connect Kalshi directly instead of uploading a file. It will work only with a read-only key, the kind Kalshi lets you create that can see your history but cannot trade or withdraw, and we will walk you through making one.

Before it launches, this page and our privacy policy will say exactly what we keep and for how long. Until then, nothing above changes, and the CSV and wallet routes stay available for anyone who would rather not connect anything.

8. Found a problem?

If you think you have found a security issue, email [email protected] with “security” in the subject. We will reply, fix it, and credit you if you want the credit.