Tax60 Subprocessors
Version 1.0 · Effective September 1, 2026 · Last updated September 1, 2026
Effective September 1, 2026. This list is part of the Tax60 Privacy Policy (https://tax60.app/legal/privacy). It names every service provider that receives personal information on behalf of PLUSH LLC, doing business as Tax60, what each receives, and where it operates. No provider on this list receives a decryption key or any readable location, jurisdiction, hours, document, or decree data. We update this page at least 30 days before adding a provider, except for an emergency replacement needed to keep the Service running, which we post as soon as practicable.
| Provider | Function | What it receives | Location |
|---|---|---|---|
| Apple Inc. | Sign in with Apple; App Store billing; Apple Push Notification service; TestFlight; iCloud Keychain and iCloud Drive (on your own Apple account, under Apple's terms) | Apple user identifier, relay or real email, purchase transactions, push tokens and content-free push payloads; your key-encryption key and monthly exports live in your own iCloud account, which Apple end-to-end encrypts and which we cannot access | United States |
| Supabase, Inc. | Database, object storage, authentication, server functions | Account email and Apple identifier, device records, subscription state, ciphertext blobs and their metadata, commitments, legal-hold flags, server request logs | AWS us-east-2 (Ohio), United States |
| Amazon Web Services, Inc. | Underlying cloud infrastructure for the database and storage provider | Same as above, as the infrastructure host | us-east-2 (Ohio), United States |
| Vercel Inc. | Hosting for tax60.app and the web viewer; server-side functions for web checkout and push delivery | Request logs (IP address, pages, timestamps); web viewer sessions (ciphertext only; decryption happens in your browser) | United States |
| Resend, Inc. | Transactional email (sign-in codes, receipts, security and legal notices); the tax60.app launch list (Privacy Policy Section 4.4) | Recipient email or Apple relay address and the message content of those notices; for the launch list, the email address of anyone who confirms a launch-list request, stored as a contact until the release email is sent, plus delivery metadata | United States |
| Stripe, Inc. | Payment processing for purchases made on tax60.app | Name, email, payment card details (held by Stripe, never by Tax60), billing address, transaction records | United States |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Stack traces, device model, iOS version, app version, memory and performance metrics; no user identifier, no coordinates | United States |
| TelemetryDeck GmbH | Aggregate product analytics | Event names (for example "day confirmed"), app version, iOS version, device model, and a random per-install identifier not linked to your account; no coordinates, jurisdictions, counts, hours or decree data | Germany (aggregate, non-identifying event data only) |
| Backblaze, Inc. | Nightly encrypted off-site backup of the ciphertext blob store (B2 Cloud Storage), so that the record survives the loss of the primary provider | Ciphertext and blob metadata only; no key | United States |
Questions: privacy@tax60.app.