Privacy Policy

This Privacy Notice for QuantaForge ("we," "us," or "our") describes how and why we might access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at keelfile.vercel.app, or any website of ours that links to this Privacy Notice
• Use Keelfile, which imports your bank and card statements, reads tax documents you upload, and uses AI to flag expenses that may be deductible so you can prepare a federal and state return summary
• Engage with us in other related ways, including any support, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at quantaforgetech@gmail.com.

What personal information do we process? The account details you give us (email address and password), the tax information you enter, the transactions and documents you upload, and your conversations with the AI assistant.

Do we process sensitive personal information? Yes. Tax and financial information is sensitive by nature. We never ask for a Social Security number, ITIN, government ID number, or bank account or routing number. Note that documents you choose to upload, such as a photo of a W-2, may themselves contain identifiers of that kind; we do not read them into separate fields, but the file is stored in your private folder until you delete it.

Do we collect information from third parties? No. We do not buy or receive personal information about you from data brokers or other third parties. We do not connect to your bank; transactions reach us only when you upload a CSV file or type them in.

How do we process your information? To provide, improve, and administer the Services, to categorize your transactions and read your documents using AI, to take payment, for security and fraud prevention, and to comply with law.

Do we sell your information? No. We do not sell or share your personal information for advertising, and we do not use advertising or cross-site tracking technologies.

How do you exercise your rights? You can export or delete your data, and delete your account, from Settings inside the app at any time, or by emailing us.

In short: we collect the personal information that you provide to us.

We collect personal information that you voluntarily provide when you register, use the Services, or contact us. This includes:

• Account information: your email address and password. Passwords are stored as salted hashes by our authentication provider; we never see them.
• Tax profile: filing status, state of residence, occupation, types of income you earn, number of dependents, whether you or your spouse is 65 or older or blind, and home office size.
• Financial information you enter or upload: transaction dates, descriptions, merchants and amounts, income amounts from your tax forms, estimated tax payments, property taxes, and your mileage log.
• Documents: photos or PDFs of W-2s, 1099s, and receipts that you upload.
• Messages: the questions you ask the AI assistant and its replies.

Sensitive information. Tax and financial information is sensitive. We process it because it is the purpose of the Services, and only for that purpose. We do not ask for, and the app has no field for, a Social Security number, ITIN, government ID number, or bank account or routing number.

Payment data. If you subscribe on the web, payment is handled and stored by Stripe; if you subscribe in the Android app, by Google Play, with subscription status relayed to us by RevenueCat. We receive only your subscription status and, from Stripe, a customer identifier. We never receive or store your full card number. See Stripe's privacy notice.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes to it.

In short: some information — such as your IP address and browser and device characteristics — is collected automatically when you visit our Services.

This information does not reveal your specific identity but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and information about how and when you use our Services. It is needed to keep the Services secure and working, and to diagnose errors. We do not collect precise device location.

In short: we process your information to provide, improve, and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law.

• To create and manage your account and keep you signed in.
• To deliver the Services: to categorize your transactions, read the documents you upload, calculate your estimated federal and state tax, and answer your questions in the assistant.
• To take payment and manage your subscription, trial, and renewals.
• To keep the Services secure, prevent fraud and abuse, enforce rate limits, and diagnose and fix problems.
• To respond to you when you contact support.
• To comply with our legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not use your tax or financial information to build advertising profiles, and we do not use it to train our own models.

In short: we share information with the service providers that run the Services for us, and in the specific situations described below.

We use the following service providers, each under a contract that limits them to processing your information on our instructions:

• Supabase — database, authentication, and file storage. Your account, tax data, and uploaded documents are stored here.
• Vercel — website and API hosting, including server logs.
• Google (Gemini API) — AI processing. See section 5 for exactly what is sent.
• Stripe — payments on the web.
• Google Play and RevenueCat — purchases and subscription status in the Android app.
• Sentry — error reports, so we find out when something breaks. These carry the technical detail of the failure: the page or API route involved, the error message, and the stack trace. They are configured not to include your tax data, your income figures, the contents of your documents, or the values of variables at the point of failure.

We may also share your personal information in these situations:

• Business transfers. In connection with a merger, sale of company assets, financing, or acquisition of all or part of our business.
• Legal obligations. Where we are required to by law, or to establish, exercise, or defend legal claims.

We do not sell your personal information, and we do not share it for targeted advertising. We have not disclosed, sold, or shared personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, other than to the service providers listed above.

In short: we use only the cookies needed to sign you in and keep the Services secure.

We set cookies to keep you signed in, to refresh your session, and to protect against cross-site request forgery. We also store your theme preference in your browser, which never reaches our servers. We do not use advertising cookies, analytics trackers, web beacons, or pixels, and we do not permit third parties to run tracking technologies on our Services.

Most browsers accept cookies by default. If you block or remove them, you will not be able to sign in.

In short: yes. We use Google's Gemini API to categorize transactions, read documents, and answer your questions.

The following is sent to Google's Gemini API when you use those features:

• Categorization: the date, description, merchant, and amount of the transactions you ask us to categorize, plus your filing status, state, occupation, and income types so the suggestion fits your situation.
• Document reading: the image or PDF you upload, in full.
• Assistant: your message and a summary of your current return, including income totals, deduction totals, and your tax profile.

Your email address and account identifier are not sent. All tax calculations are performed by our own software, not by the AI. AI output is a suggestion for you to confirm: it can be wrong, it is general tax information rather than tax advice, and unusual situations deserve a qualified tax professional.

Google processes this content under the Gemini API Additional Terms of Service, which set out whether and how submitted content may be retained and reviewed. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In short: we keep your information for as long as you have an account, unless a longer period is required by law.

We keep your personal information only for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law, such as tax or accounting requirements. No purpose in this notice will require us to keep your personal information for longer than three (3) months past the termination of your account.

When you delete your data or your account in the app, we delete your uploaded files and your records straight away. Copies may persist in encrypted backups for a short period, after which they are overwritten; while they exist they are isolated from any further processing.

In short: we protect your information with organizational and technical security measures, but no system is perfectly secure.

The measures we take include:

• Encryption in transit (HTTPS with HSTS) and encryption at rest by our database and storage provider.
• Row-level security in the database, so every query is restricted to the signed-in user's own rows.
• A private document store where each user has an isolated folder that only they can read.
• Authentication and rate limits on every API request, and secrets that are held only on the server and never sent to your browser or phone.

Despite these safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never defeat our security. You should only access the Services in a secure environment.

In short: we do not knowingly collect data from or market to children under 18 years of age.

By using the Services, you represent that you are at least 18, or that you are the parent or guardian of such a minor and consent to their use of the Services. If we learn that we have collected personal information from a user under 18, we will deactivate the account and promptly delete the data. If you believe we may have collected such data, contact us at quantaforgetech@gmail.com.

In short: you may review, change, export, or delete your data and your account at any time.

Withdrawing your consent. Where we rely on your consent to process your personal information, you may withdraw it at any time by contacting us using the details in section 13, or by deleting your account. This does not affect the lawfulness of processing before the withdrawal, nor processing carried out on other lawful grounds.

Account information. In Settings inside the app you can update your tax profile, export everything you have given us as a JSON file, delete all of your tax data, or delete your account entirely. Deleting your account removes your uploaded files and all of your records.

Cookies. You can set your browser to remove or reject cookies, but you will not be able to sign in without them.

If you have questions about your privacy rights, email us at quantaforgetech@gmail.com.

Most browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal that you do not want your online browsing activities monitored. No uniform technology standard for recognizing DNT signals has been finalized. We do not track you across other websites at all, and we do not currently respond to DNT signals. California law requires us to tell you this. If a standard is adopted that we must follow, we will update this notice.

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we hold about you, to correct inaccuracies, to obtain a copy of it, or to delete it.

The table below shows the categories of personal information we have collected in the past twelve (12) months.

We collect sensitive personal information only for the purposes allowed by law or with your consent, and we do not collect or process it to infer characteristics about you. We keep the information in every category listed above for as long as you have an account with us.

Depending on where you live, your rights may include:

• The right to know whether we are processing your personal data
• The right to access your personal data, and to obtain a copy of it
• The right to correct inaccuracies in your personal data
• The right to request deletion of your personal data
• The right to withdraw your consent
• The right to non-discrimination for exercising your rights
• The right to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects — none of which we do
• The right to limit the use and disclosure of sensitive personal data

How to exercise your rights. Use the export and delete controls in Settings, or email us at quantaforgetech@gmail.com. You may designate an authorized agent to make a request on your behalf; we may deny a request from an agent who does not provide proof that they are validly authorized.

Verification. We will need to verify that you are the person the information belongs to. We will use information you provide in the request only to verify your identity, and we may ask for further information if we cannot verify you from what we already hold.

Appeals. If we decline to act on your request, you may appeal by emailing us at quantaforgetech@gmail.com. We will respond in writing with our decision and the reasons for it. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" law. California residents may request, once a year and free of charge, information about personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information for that purpose. To make a request, contact us at the address in section 13.

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

The updated version will be indicated by an updated date at the top of this Privacy Notice. If we make material changes, we will notify you either by prominently posting a notice or by contacting you directly. We encourage you to review this notice regularly.

If you have questions or comments about this notice, email us at quantaforgetech@gmail.com, or write to us at:

QuantaForge
[Postal address]

Depending on the laws of your country or state, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, a copy of it, or its deletion, and to withdraw your consent. These rights may be limited in some circumstances by applicable law.

The fastest way to exercise them is in the app: open Settings to export everything as JSON, delete all of your tax data, or delete your account. You can also email us at quantaforgetech@gmail.com.