TaxQuarter

Privacy notice

Last updated: 14 August 2026

TaxQuarter is operated by Stratum ICS, a sole trader business based in Georgetown, Guyana. This page says what we hold about you, where it lives and who else sees it. If anything is unclear, or you want something removed, write to leandre.jack@gmail.com.

What we store

  • Your account: name, email address, a hashed version of your password (never the password itself) and your two factor secret, which is encrypted.
  • Your tax records: the income and expense entries you type or import, the businesses HMRC lists for you, and a copy of every submission we sent to HMRC with the reply that came back. The submission copies are your evidence of a filing, so we keep them.
  • Your HMRC connection: your National Insurance number, your Making Tax Digital identifier, and the access and refresh tokens HMRC issued. Both tokens are encrypted at rest with AES-256-GCM and are never shown in the interface.
  • Session details needed for the headers described below: a device identifier we generate, your browser user agent, your window and screen dimensions, your timezone offset, and the public IP address and port your request arrived from.

Where it is stored

On a single server rented from Hetzner in Germany. The database is one file on that server, backed up nightly to the same machine. It is not shared with any advertising, analytics or profiling service, and we do not sell it to anyone.

What we send to HMRC, and why

We reach HMRC only with your consent, given on HMRC's own authorisation screen, and only for the things you ask for: reading your business details, obligations and calculations, and sending your quarterly updates and final declaration.

UK law also requires software that files on your behalf to send fraud prevention headers with every call. These describe the device and connection the filing came from, so HMRC can tell a genuine submission from a fraudulent one. We are required to send them and you cannot file through us without them. They cover:

  • Device: an identifier we generate for your browser and keep in a cookie, and the timestamp of the two factor check on this session.
  • Browser: your user agent string and the size of the browser window you are filing from.
  • IP: the public IP address and TCP source port your request came from, when it was observed, and the public IP address of our own server.
  • Timezone: the UTC offset your browser reports.
  • Screen data: the width, height, scaling factor and colour depth of your screens.
  • Account: your TaxQuarter user identifier, and a one way hash of your two factor secret used as a reference. Never the secret itself.

HMRC publishes what these headers are for and how they are used in its fraud prevention specification for software vendors.

Withdrawing your HMRC consent

You can disconnect TaxQuarter from HMRC in Settings at any time, which deletes the stored tokens from our database. You can also revoke the authorisation from your own HMRC account at tax.service.gov.uk, which stops it at HMRC's end whatever we hold.

Payments

Billing runs on Polar, which is the merchant of record for the sale. Polar takes and stores the card details, issues the receipt and handles any sales tax or VAT due. We never see or store your card number. What we receive from Polar is your email address, the subscription status and the dates it covers, so the app knows whether your account is active.

Cookies

Only the ones the product needs: a session cookie that keeps you signed in, a short lived cookie between sign in and the two factor check, the device identifier described above, and a marker recording when your browser last reported its screen and window details. There are no advertising or analytics cookies.

How long we keep it

Your records stay while your account exists, because you may need them for an HMRC enquiry. Ask us to delete your account and we remove your records, your HMRC tokens and your submission history. Nightly backups roll off after fourteen days, so a deleted account disappears from those within a fortnight.

Your rights

Write to leandre.jack@gmail.com and you can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. We answer within 30 days. One limit worth being straight about: we cannot delete what you have already filed with HMRC, because that is HMRC's record of your tax affairs, not ours.

Governing law

This notice and the terms of use are governed by the laws of Guyana, where Stratum ICS is based.