Privacy Policy — CryptoTaxCheck

Last updated: 27 September 2026.

CryptoTaxCheck is built so that we hold as little of your data as possible. Your exchange files are opened and processed inside your own browser and are never sent to us. This policy explains what we do and do not collect, why, how long we keep it, who else is involved, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

CryptoTaxCheck (cryptotaxcheck.uk) is operated by Andrew Pickett, who is the data controller for the personal data described in this policy.

• Contact for privacy matters: privacy@cryptotaxcheck.uk
• ICO registration number: [to be confirmed]
• Postal address: [to be confirmed]

CryptoTaxCheck is independent and is not affiliated with or endorsed by HM Revenue and Customs (HMRC).

The short version

• Your transaction files (CSV or XLSX exports from exchanges) are parsed and calculated in your browser. They never leave your device. We do not see your trades, balances, wallet addresses or account identifiers.
• The only thing the calculator sends to our server is a list of coin symbols and dates when a sterling price is missing from your file, so we can look up a historical price. No amounts, no file contents, no identity.
• We store four categories of data, and only when they arise: your email address if you choose to give it, payment records for reports you buy (the Stripe session reference, product, amount and dates — not your card details), our price cache (which contains no personal data), and cookieless, aggregated analytics.
• We do not use advertising cookies, tracking pixels or third-party scripts on the calculator or letter pages, so there is no cookie banner.

What we collect and why

Data that stays in your browser (not collected by us)

When you use the calculator, your files are read by code running in your browser and your progress is saved locally in your browser's storage (IndexedDB) so that a page refresh does not lose your work. This data is on your device, not our servers. You can delete it at any time with the "Clear all my data" button in the calculator, or by clearing your browser's site data. When you buy a report, the calculated figures are also held briefly in your browser's storage while you are sent to the payment page and back, so the report can be generated when you return.

Your answers in the letter helper are kept in your browser's local storage in the same way, so you can come back to them over a few days. They never leave your device unless you choose the email reminder, and the "Clear my answers" button removes them.

Price lookups

If a transaction in your file has no sterling value, the calculator asks our price service for the daily GBP price of that coin on that date. The request contains only the asset symbol and the date (for example, "BTC, 2025-06-10"). Our server checks its cache and, if the price is not cached, fetches it from our price provider (currently CoinGecko) and stores the result. We do not log which user asked for which price. Our web server keeps standard, short-lived request logs (IP address, time, path) for security and abuse prevention; these are deleted automatically.

Lawful basis: legitimate interests (operating the service you have asked to use and protecting it from abuse). We have assessed that this minimal processing does not override your interests.

Payments and reports

If you buy a Tax Year Report or HMRC Letter Pack, payment is taken by Stripe through Stripe Checkout. Stripe collects your card details and billing information directly; we never see your full card number. Our own records hold only what we need to confirm the payment and deliver the report: Stripe's checkout session reference, the report ID, the product bought, the amount and currency, the date, when the report was delivered and how many times it was downloaded. The email address you give at checkout, the card type and the last four digits stay in Stripe's records, which we can see in our Stripe dashboard and use to issue refunds and receipts.

After payment is verified, your browser sends the computed report data (the calculated figures and schedules, not your original files) to our server so the PDF can be generated. The server renders the PDF, streams it back to you and deletes the report data immediately after rendering — nothing about your transactions is written to disk or to our logs. You can download the report again from the same browser for 7 days.

If you tick "email me a copy", we keep an encrypted copy of the report figures (not the PDF and not your files) for 7 days so the link in the email can re-create the report. The copy is encrypted with a key that is split between our server and the link itself: the link is the only way to open it, we cannot read the copy without the link, and after 7 days it is deleted.

Lawful basis: performance of a contract (supplying the report you bought) and legal obligation (keeping accounting records of sales).

Email addresses

We only hold your email address if you give it to us, for one of these purposes:

• Report receipt. Stripe emails you a receipt for any report you buy using the address you gave at checkout; that address stays in Stripe's records.
• Emailed copy of your report. If you tick "email me a copy" after paying, we send the download link to the address you enter. We do not store that address ourselves; our email provider processes it to deliver the message. The link works for 7 days and the encrypted copy behind it is then deleted.
• Letter helper reminders and updates. In the letter helper you can ask us to remind you before your deadline, or to tell you about HMRC and CARF changes. We use double opt-in: you must confirm from the email we send before we add you. We store your email address, which reminders you chose, the deadline date you gave us, the page you asked from, when you asked and when you confirmed, and the codes behind your confirmation and unsubscribe links — nothing else from your answers. Requests you do not confirm are deleted after 7 days. Every email includes an unsubscribe link.
• Support. If you email us, we keep the correspondence to deal with your query.

Lawful basis: consent for reminders and updates (PECR requires your consent for marketing emails; you can withdraw it at any time by unsubscribing); performance of a contract for the emailed copy of a report you bought; legitimate interests for support correspondence.

Analytics

The site launched without any analytics script. If we switch analytics on, we will use Plausible Analytics, a cookieless, privacy-focused service hosted in the EU. Plausible does not use cookies or persistent identifiers, does not store IP addresses or user-agent strings, and gives us only aggregated statistics — which pages are visited, roughly where visitors are located to country or city level, which browsers are used and where traffic comes from. We cannot identify you from it. No analytics script will ever run on the calculator or letter helper pages, and we will update this page when analytics are enabled.

Lawful basis: legitimate interests (understanding how the site is used so we can improve it), with no impact on your privacy given the aggregated, cookieless design.

Price cache

Our database stores historical daily prices for coins and dates that have been requested. This is market data, not personal data, and is kept indefinitely so that repeat lookups are fast and consistent.

Affiliate link clicks

When you follow one of our Koinly affiliate links (they all go through /go/koinly), we add one to a daily count for that link and the page it was on. No IP address, cookie or other identifier is recorded, so the count cannot be tied to you.

What we do not do

• We do not sell, rent or share your personal data for marketing.
• We do not use advertising networks, retargeting or social media pixels.
• We do not store your transaction files, wallet addresses, exchange account identifiers or National Insurance number. We never ask for exchange API keys.
• We do not store your report after generating it, unless you ask us to email a copy — and then only an encrypted copy of the figures for 7 days, which only your link can open.
• We do not make automated decisions about you with legal or similarly significant effects.

Who else processes data

Where a provider is outside the UK, we rely on the UK's adequacy regulations or the International Data Transfer Agreement and Addendum approved by the ICO.

How long we keep data

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten") where we have no overriding reason to keep it — for example, we must keep payment records for tax purposes, but we can delete your email from our lists at any time;
• restrict or object to processing, including objecting to any processing based on legitimate interests;
• data portability for data you provided that we process by automated means;
• withdraw consent at any time where consent is our lawful basis, without affecting processing before withdrawal.

To exercise any right, email privacy@cryptotaxcheck.uk. We will respond within one month. We may need to confirm your identity first, usually by asking you to write from the email address we hold.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.

Cookies and local storage

We do not set analytics or advertising cookies. The site uses browser storage for three purposes only: saving your calculator progress locally (IndexedDB, including the calculated figures while you pay for a report), saving your letter helper answers locally (local storage), and remembering your light or dark mode preference (local storage). All of it stays on your device; the "Clear all my data" and "Clear my answers" buttons remove the first two. Stripe sets its own cookies on Stripe's checkout pages when you pay; these are covered by Stripe's privacy policy. Because we use no non-essential cookies, no consent banner is needed under PECR.

Security

Files are processed in your browser, which removes the biggest risk: we cannot lose data we never receive. On our side, the site is served over HTTPS with a strict Content Security Policy, the report data we briefly hold is deleted after rendering, the price and PDF endpoints are rate-limited, and access to the server is restricted to the operator. No system is perfectly secure; if we ever became aware of a breach affecting your personal data, we would notify you and the ICO as required by law.

Children

The service is intended for UK taxpayers and is not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

We will update this page when our practices change and record the date at the top. Significant changes affecting people on our email lists will be notified by email.

Contact

Privacy queries: privacy@cryptotaxcheck.uk. General contact details are on our contact page.