Privacy Policy

Document status:

Draft v2 (replaces Draft v1 of June 12, 2026)

Drafted:

October 15, 2026

Effective date:

to be set on attorney clearance

Last updated:

draft

Overview

cryptoBASIS sells two products:

• cryptoBASIS Return Check and CoinTracking Audit, sold together. You give us your filed federal tax return and two CoinTracking files. We check them and give you a report.
• cryptoBASIS Load. You give us your exchanges' export files and your wallets' addresses or public keys. We build a file you import into CoinTracking.

The short version: we keep none of your files.

• There is no account and no sign-in.
• We have no database.
• Your files are used to produce your report or load file, then discarded.
• No AI reads anything you give us.

This policy says what reaches us, who else it passes through, and for how long.

1. What you give us, and what happens to it

Your files.

• Return Check and CoinTracking Audit: your federal tax return as a PDF, your CoinTracking Tax Report (.xlsx) and your CoinTracking trade list (.csv).
• Your tax return carries what is on it, such as names, Social Security numbers, addresses and income figures, and it can include medical or HSA lines.
• Load: your exchanges' export files (.csv or .xlsx), and the wallet addresses or extended public keys you type in. A month-end update also takes your CoinTracking trade list (.csv).
• Before you pay, your browser holds the files in the page's own memory on your computer. When you choose each file, a copy is sent to our server to check it is the right file. The check returns a short answer, such as how many rows the file has and its first and last dates. The server keeps nothing from the check.
• When you pay, the page sends the files to our server again to produce your report or load file. The server holds them only while it works and keeps nothing afterwards.

Your password. Before you pay, you set a password of 8 to 15 characters. We use it to lock your report, or the zip file that holds your load file and its import steps. It is sent with your files when the work starts, used to lock the file, and not kept. We can't open your locked file, and we can't recover the password for you.

Your results.

• Your report or load file is sent back to your browser and kept in the page's memory.
• The page shows it, and offers it to save, for four hours from when your payment completes, as long as the page stays open.
• After four hours the page clears it. Save it as soon as it is ready.
• We keep no copy.

Your email address. You don't type it on our pages. Stripe's payment form collects it.

• If the purchase page says your results will be emailed, we use that address once, to send you your locked file and, if your purchase earned one, the code for a free second check. The email is sent when the work finishes. We don't keep it on our systems. It stays in Stripe's record of your payment, which we can see.
• If the purchase page doesn't say so, we don't email you. Stripe sends its own payment receipt.

What we never ask for. Private keys, seed or recovery phrases, exchange passwords, exchange API keys, or card details. cryptoBASIS can't move your crypto. If anyone claiming to be cryptoBASIS asks for these, don't give them.

A month-end update. If you bought cryptoBASIS Load in its first week, its month-end updates are free. To claim one, you type the receipt number from Stripe's receipt and your card's last four digits. Our server compares them with Stripe's records of first-week payments and keeps neither. After the update is delivered, we add a note to your payment's record at Stripe: which month, the statements you agreed to, and the time.

A free second check. If you bought Return Check and CoinTracking Audit in its first week, your results come with a code for one more check, free. The code is shown on your results page, in the email when your results are emailed, and in a link that carries it in its web address. When you enter it, we look it up at Stripe, where we created it to work once, until a date.

Washington consumers. Our Washington Consumer Health Data Privacy Policy, at cryptobasis.ai/washington-health-data, says what consumer health data a tax return can hold and how we handle it. For Return Check and CoinTracking Audit, we ask whether you live in Washington or are in Washington now and, on a yes, for your consent. Your answer goes with each file check and with your payment, and Stripe's record of your payment holds it, with your consent. It isn't kept in your browser.

Your location. Vercel tells our server which country and US state each request comes from, worked out from your IP address. We use it only to refuse purchases from California, and we don't keep it or write it to our logs.

2. Who else your data passes through

These services handle your data so that we can deliver what you paid for. We don't sell your data or share it for marketing.

Chain data services, by chain (Load only):

• Ethereum: Blockscout, also for ICO purchases.
• Bitcoin: mempool.space, or Blockstream's Explorer API.
• Litecoin: litecoinspace.org.
• Bitcoin Cash: Blockchair.
• BSV: WhatsOnChain, used only if BSV is switched on.
• Bitcoin Gold: NOWNodes, used only if Bitcoin Gold is switched on.
• XRP Ledger: No service today, so XRP Ledger addresses aren't read. A commercial provider is named here before we send it anything.
• Solana: Helius.
• If you give an extended public key, it stays on our server. We work out its addresses there and send the services addresses, never the key. mempool.space, Blockstream and litecoinspace.org get one address per request; Blockchair (Bitcoin Cash) gets up to 20 or 100 in one request, and WhatsOnChain (BSV) up to 20, so they can see the addresses belong together.
• We read only the chains listed here. A service is added to this list before we send it anything.

3. Logs

• Vercel's logs. Vercel, our host, records requests to the site in its logs. Vercel's documentation says it keeps these runtime logs for 1 hour on the Hobby plan and 1 day on the Pro plan.
• What our code writes to them. When something goes wrong, our code writes one line naming the kind of error and, for a file check, which kind of file it was. It also writes a line counting the requests each wallet read took, and a daily count of automatic refunds. It never writes your files, your password, your email address, your wallet addresses, or their contents.
• Web addresses. Our pages never put your files, password, email address or wallet addresses in a web address. Only a free second check's link carries something: its code.

4. Cookies

• Ours: two cookies, both counts. cb_checks counts how many file checks you have run this visit (at most 50), and cb_update_checks how many month-end receipt checks (at most 5). Each holds only that number, is sent only to our /api addresses, and ends when you close your browser. They are there to stop our servers being used for free.
• Stripe's: only once you press Pay. Stripe's payment code loads only when you press Pay. Visitors who don't press Pay get no Stripe cookies. When it loads, Stripe sets its own cookies for fraud prevention: __stripe_mid, which lasts 1 year, and __stripe_sid, which lasts 30 minutes. Stripe's own policies govern them.
• Nothing else. No analytics, no advertising or tracking cookies, no session replay. Our fonts are served from our own site. The page doesn't use your browser's local storage, session storage or IndexedDB.
• Do Not Track. Our site doesn't track you across other sites, so it doesn't change anything when your browser sends a Do Not Track signal.

5. What we don't do

• We don't use AI on anything you give us.
• We don't store your files, report, load file, password or wallet addresses, and we keep no copy of your email address outside Stripe's record of your payment.
• We don't sell your data, or share it with marketing or advertising networks.
• We don't use your data for anything except producing the report or load file you paid for.
• We don't track what you do on other websites.

6. Your rights

• We keep none of your files or results, so we hold no copy to give you, correct or delete. Save your report or load file when it is ready. We can't send it again.
• Stripe holds your payment record, under Stripe's own policies. Stripe's receipt email is your copy of it.
• If you are in the EU/EEA or the UK, you may complain to your local data protection authority.
• cryptoBASIS is for adults 18 and over. We don't knowingly take information from children under 13.

7. Security

• In transit: every connection to cryptoBASIS uses TLS.
• No storage to protect: we have no database and no storage for your data.
• Isolated runs: Return Check runs in a separate machine with no internet access, deleted after each run.
• Locked results: your results are locked with the password you set, and the email copy (when sent) is locked too.
• No accounts: there are no customer accounts to break into.

8. Changes to this policy

When we change this policy, we update the date at the top and publish the new version at cryptobasis.ai/privacy. We keep no customer email list, so we can't email you about changes. The version that applies to a purchase is the one published when you made it.

9. Seller

Cryptobasis Technologies LLC. The payment screen shows the company's address and an email address to write to.