Privacy Policy

This policy applies to Countorra, which is provided by Armin Samanian, doing business as Countorra. Countorra is the name of the service, not a company or other registered business entity. Questions about this policy or your data: support@countorra.com.

• Account information — your name and email address. Accounts use an email address and password, managed by Supabase Auth. Your password is hashed by Supabase; we never see or store it in plain text. If you choose Sign in with Google or Sign up with Google (offered only when it is available), Google shares your name, email address and profile picture with Countorra through Supabase Auth. They are used only to sign you in and set up your account; Countorra never receives your Google password.
• Financial information you enter — accounts, transactions and the details you record about them.
• Bank connection data, if you choose to connect a bank — see §6.
• Tax preparation details you enter — for example your filing status, and your dependents' names, relationship to you and dates of birth. Countorra does not ask for and has nowhere to store a Social Security number or ITIN; it records only whether one exists.
• Uploaded documents — files you upload, stored in private storage isolated to your organization, and the figures read from them. For PDFs that contain text, that text is read on our servers. For a photo or a scan, which has no text to read, the file is sent to a document-reading service — see §5 and §5b. You choose what to upload; a document you do not upload is never processed.
• AI conversations — your messages to the AI assistant and its responses, so your conversation history persists.
• Your email, if you take the product tour — see §5d.
• Your name, email and question, if you book a call — see §5f.
• If you use the iPhone app — the same information as on the web, plus what §5g describes: Sign in with Apple if you choose it, App Store purchases, and, only if you turn notifications on, a code for your device that lets us send them.
• Billing information — every plan starts with a card held by Stripe; see §7. Card details are entered with Stripe, not with Countorra.
• Security and operational information — an append-only audit log of sensitive actions in your organization, and server logs of errors and operational events. Logs are filtered before they are written so that passwords, tokens, email addresses, amounts and the content of your AI questions are not recorded in them. To limit abuse (for example repeated sign-in attempts), we process IP addresses and sign-in identifiers, and store them only as keyed hashes.

• Sign-in cookies, set by Supabase Auth so you stay signed in.
• A short-lived bank sign-in cookie, only while you are connecting a bank. It is encrypted, cannot be read by scripts on the page, lasts at most 30 minutes, and lets your bank send you back to Countorra and finish connecting. It is removed when the connection finishes.
• A layout preference — whether the side navigation is open or collapsed, how wide it is and which of its groups you folded — kept in a cookie called countorra-sidebar for up to a year. It holds only that choice, is not linked to your account and is not used to identify or track you.
• An activity cookie, countorra_activity, holding the time you last used Countorra, signed so it can't be altered, so you can be signed out after 10 minutes without activity. The same time is kept in your browser's local storage so your open tabs agree. It is tied to your current sign-in and means nothing after it ends.
• That you have started the product tour — a note in your browser's local storage, so the tour doesn't ask for your email again on this device. It holds no email address and is never sent to us.
• Your appearance preference — whether you chose the light or dark theme — kept in your browser's local storage so the choice survives a refresh. It is the word “light” or “dark”, it is not linked to your account, and it is never sent to us.

We do not use advertising cookies, tracking pixels or analytics cookies, and apart from the cookies and the browser storage described above, Countorra does not store anything in your browser. When you use Plaid's window to connect a bank, or Stripe's pages to pay, those services operate under their own policies, linked below.

• To operate the product: sign you in, keep your data within your organization, and show your records, reports and tax figures.
• To import bank transactions you have chosen to connect, into the accounts you choose.
• To answer questions you ask the AI assistant, using the records needed to answer them (see §5c).
• To take payment for a subscription, if you choose one.
• To secure the product: detect and investigate misuse, enforce rate limits, and keep an audit trail of sensitive actions.
• To contact you about your account, its security, or your subscription.
• To email you about Countorra, if you gave your email to take the product tour (§5d).

We do not sell your personal information. Countorra does not use your data to train AI models; for what our providers do with data they receive, see their own policies and §5.

We share the minimum data needed with these providers, each for one purpose:

• Supabase — database, authentication and file storage. The account, financial, document and conversation data described in §2 is stored with Supabase. Supabase Auth also generates the account emails described below, which are delivered through Resend.
• Google (sign-in) — only if you choose Sign in or Sign up with Google. Google confirms who you are and shares your name, email address and profile picture, as described in §2. Nothing about your finances is sent to Google for sign-in.
• Vercel — hosting. Your requests pass through Vercel's servers, which process information such as your IP address and keep server logs.
• Cloudflare — DNS and a proxy in front of the main countorra.com address. Requests to that address pass through Cloudflare, which processes information such as your IP address.
• Anthropic — when you use the AI assistant, your message and the structured records needed to answer it are sent to Anthropic to generate a response. To categorize a transaction no rule or bank label covers, the shop's name as your bank wrote it, whether money went in or out, and the bank's own category label are sent to Anthropic (never an amount, a date, an account number or your name); the answer is kept for that shop and reused for everyone, so a shop is sent once. Payments to or from a person through an app such as Zelle, Venmo, Cash App or PayPal are the exception: their answer is kept for your workspace only. When Countorra for Chrome can't find the next step on a service's page by itself, the list of that page's visible buttons and links, its headings and its address are sent to Anthropic to choose the next click (§5h). See §5c.
• logo.dev — to show a shop's logo where your bank sends none, the shop's name as your bank wrote it (never an amount, a date, an account or anything about you) is sent to logo.dev to find the shop's website, and the logo image is fetched from logo.dev by Countorra's servers; your browser and the app never contact logo.dev.
• Plaid — only if you connect a bank. See §6 and Plaid's End User Privacy Policy.
• Stripe — when you start a plan or a trial. See §7 and Stripe's privacy policy.
• Google (Google Cloud Document AI) — reading documents, and only a file that needs it: a photo or a scan, a W-2 (read with Google's W-2 processor), or a form whose checked boxes Countorra needs to read, such as a W-9. A PDF that already contains its own text is read on Countorra's servers instead, unless it is a W-2. The whole file is sent to Google, including everything printed on it — on a tax form that means names, addresses and identification numbers — and Google returns the text and the values it identified. Countorra sends nothing else about you or your account, such as your email address. Countorra does not store the identification numbers it gets back, shows you every value to check and confirm before using it, and does not use the file or the result to train anything.
• Amazon Web Services (Textract) — reading receipts, invoices and bills; and, where Google Document AI is not in use, the text of photos and scans. The whole file is sent to AWS, including everything printed on it, and AWS returns the text and the values it identified. Countorra sends nothing else about you or your account, such as your email address, and does not use the file or the result to train anything.
• Resend — every email Countorra sends, and the receipts you forward to us. To deliver an email (account and security messages, invitations, the weekly recap, billing and alert notices, booking confirmations), your email address and that message pass through Resend. Email you send to your receipts address is received by Resend and passed to our servers (§5e).
• Microsoft, Google, Notion and Dropbox — only for an integration you turn on (§5e): Microsoft for Outlook receipts; Google for files you add from Google Drive and the Google Sheets copy; Notion for the Notion copy; Dropbox for files you add from Dropbox. Google Calendar and Google Meet are also used when you book a call (§5f).
• Apple — only in the iPhone app: Sign in with Apple if you choose it, purchases through the App Store, and notifications if you turn them on (§5g).
• Sentry — error and performance monitoring. When something fails, a technical report is sent to Sentry: the kind of error, where in our code it happened, the page or operation and when, and your browser and device type. Account, workspace and document identifiers are removed from addresses or replaced by codes that do not reveal them, and reports from your browser are relayed through our own servers. Timings for a sample of page loads and requests are sent too, so we can find what is slow. Reports do not include passwords, tokens, cookies, email addresses, amounts, documents, what you type into forms, the content of your AI questions, or your IP address.

Apart from Sign in with Google and Sign in with Apple, we do not use a social or single sign-on provider, and we do not use any analytics or advertising platform. If we add one, we will update this policy before it receives your data.

A tax document you upload moves through five steps, and the last one is yours:

1. Upload — you choose the file.
2. Extraction — the text and figures are read from it, as described in §5.
3. Your review — the figures that were read are shown to you next to the document.
4. Your confirmation — a figure becomes a tax fact only when you confirm it.
5. Tax preparation — only confirmed facts are used in a tax calculation.

A value extracted from a document is not automatically treated as a user-confirmed tax fact. Reading can be wrong or incomplete, so Countorra proposes and you decide. Countorra currently reads these kinds of documents: receipts, invoices and bills, bank statements, pay stubs, W-2, W-4, W-9, 1040, 1099 (NEC, MISC, INT, DIV, B, R, G and K), SSA-1099, 1098, 1098-E, 1098-T, 1095-A and 1095-C forms. Other files can be stored, but their figures are not read.

Three different kinds of provider can see your information, for different reasons:

• Countorra's own application and database hold your records, documents and conversations (§2, via Supabase).
• The AI provider (Anthropic) generates the assistant's replies, names the category of a shop that no rule or bank label covers (§5), and chooses Countorra for Chrome's next click when its usual steps don't match a page (§5h).
• The document-reading provider (§5) turns a scan or photo into text and figures.

The assistant does not receive your uploaded files. It receives your message, your recent conversation, and the structured records it asks for — for example transactions, balances and the confirmed tax facts in your workspace — plus, for a document, the fields read from it. Social Security and account numbers are masked. The assistant can suggest a tax figure, but a suggestion is stored only as a proposal until you confirm it. Its answers can be wrong; see the Terms.

The product tour at /demo/tour asks for your email address before it starts. We keep that address, the date you gave it and that it came from the tour, and use it only to email you about Countorra. It is stored in Countorra's own database, readable only by our servers, and is not sent to any marketing or advertising service. The tour itself shows sample data and records nothing about what you look at. Every email we send you about Countorra lets you unsubscribe, and you can also unsubscribe or ask us to delete your address at any time by writing to support@countorra.com; once deleted, it is gone.

Each integration is off until you turn it on in Settings → Integrations, and you can turn it off there at any time.

Excel export. An Excel file is made on our servers from the records you are looking at, when you download it, and is sent only to your browser. It is not shared with Microsoft or anyone else.

Calendar feed. If you make a calendar address, we store a fingerprint (a hash) of it and when a calendar last fetched it. Whoever has the address, normally the calendar service you add it to such as Google, Apple or Microsoft, receives the tax deadlines for your state and the names and usual amounts of your bills, subscriptions and paydays for the next 90 days; that copy is held under the calendar service's own privacy policy. Making a new address or turning it off stops it working.

Receipts by email. Email sent to your forwarding address is received by Resend, our email provider, and passed to our servers. We keep each attachment, or the email's words when it has none, as a document in your workspace, read as described in §5b. For each email we also keep a fingerprint of its Message-ID and what came of it, not its addresses, subject or body. Mail is accepted only from the email you sign in with and from addresses you add and confirm; for an address you add we store it and a fingerprint of its confirmation link. Email from anyone else is discarded, and only counted.

Outlook receipts. If you connect Outlook, you sign in at Microsoft and allow Countorra to read your email (Microsoft's Mail.Read permission). We store an encrypted Microsoft token, your Microsoft account's email address, and a subscription with Microsoft that tells us when new email arrives in your Inbox. For each new email, and for the last 90 days if you leave that choice on, we read who sent it and its subject to decide whether it is a receipt. Only a receipt is kept: its attachment, or its words as a PDF, as a document in your workspace, read as described in §5b, with a fingerprint of its message ID so it is kept once. We keep nothing about any other email, and we never send, move or delete email. Disconnecting deletes our token and the subscription at Microsoft.

The file for your accountant. When you choose Download for my accountant, we make a ZIP of the year's transactions, an income summary, your calculated taxes and your receipts on our servers, keep it in private storage for 24 hours so the download can finish, then delete it. It is sent only to your browser.

Your accountant's access. If you invite your accountant in Settings → Sharing, we email them an invitation and store their email address, what you chose to share, any end date, and, once they accept, their Countorra account. They can see what you chose (your calculated taxes and documents, or also your transactions and accounts) and download the file for your accountant, but cannot change anything. We record each time they view or download, and show it to you. Removing their access ends it at once.

Google Drive. When you add a file from Google Drive, Google asks you to let Countorra open the files you pick. We use that access once, to copy the file you picked; we do not store a Google token or see your other files. Google's handling of your data is covered by Google's Privacy Policy.

Google Sheets. When you connect Google Sheets, Google gives us permission (the drive.file scope) to create and update one spreadsheet, called Countorra, and no other file in your Drive. We store an encrypted Google token and your Google account's email address, and write a copy of your transactions, summaries, budgets, subscriptions, goals and, on Countorra Tax, your calculated tax position to that spreadsheet every hour. Disconnecting deletes the token and asks Google to revoke it; the spreadsheet stays in your Drive under Google's terms.

Notion. When you connect Notion, you pick one page in Notion's window and Notion lets us see and write under that page only. We store an encrypted Notion token, your Notion workspace's name, and which pages we created, and write your transactions, subscriptions, goals, monthly summaries and, on Countorra Tax, a tax checklist there every hour. Disconnecting deletes the token; what we wrote stays in your Notion under Notion's terms.

Dropbox. When you add a file from Dropbox, Dropbox's Chooser gives us a temporary link to the one file you picked, and we copy it once. We do not receive access to your Dropbox account.

Payroll. Payroll is optional and part of Countorra Tax. It connects through Plaid (§6): you sign in to your payroll provider in Plaid's window, and we never see that login. We store an encrypted Plaid token and your employer's name. When your payroll is checked, we keep the figures from your newest pay stub (employer, pay date, how often you're paid, gross pay and the income tax withheld) and the date of the check for 12 months, so you can use them without connecting again; you can remove the figures at any time from Settings → Integrations. They go into your Tax Alarm only when you choose “Use in Tax Alarm”. Disconnecting payroll asks Plaid to forget the connection.

When you book a call from the homepage, we keep your name, your email address, the question you add (if any), the time you chose and your time zone. The call is put on our Google Calendar with a Google Meet link, and Google sends you the invitation, so Google receives your name, email address and the time; the call itself is a Google Meet call under Google's privacy policy. We email you a confirmation and tell our team, through Resend. We use these details only to hold the call and answer your question, and you can ask us to delete them at any time by writing to support@countorra.com.

The iPhone app shows the same workspace as the website and collects the same information (§2), through the same servers and providers. In addition:

• Sign in with Apple, if you choose it: Apple confirms who you are and shares your name and an email address — your own or a private relay address that forwards to it. Countorra never receives your Apple ID password.
• App Store purchases: if you subscribe in the app, Apple takes the payment, and we receive from Apple the purchase, its plan and its status, not your card details.
• Notifications, only if you allow them: your iPhone gives us a code for your device (a push token) so Apple can deliver alerts such as your Tax Alarm. We keep it with your account until you turn notifications off or sign out on that device.
• Your sign-in on the device is kept in the iPhone's Keychain, and the app signs you out after 10 minutes away from it.

The app has no advertising and no analytics, and it does not track you across other apps or websites.

Cancelling subscriptions. When you choose to cancel a subscription in Countorra, we record your approval: your name, the time, the subscription, its amount, the way you chose to cancel it, and the exact words you approved. We also record each step you take afterwards (for example, opening the service's page, marking it cancelled, or adding a confirmation), so you and the other members of your workspace can see what was done and when. If you add a screenshot or paste a confirmation email, we keep it with your documents. We use these records to show you your cancellations, to tell you if the service charges you again, and to work out what cancelling saved you. We never ask for, receive or store your password, login, cookies or card details for another service, and we never sign in to another service for you.

Countorra for Chrome (browser extension). When you connect the extension to your Countorra account, it keeps a sign-in key for Countorra in your browser; we keep only a scrambled copy of it, with when it was created and last used, and you can disconnect it at any time in Settings. The extension works only on the subscription services it lists, only in the tab it opened for a cancellation you approved in Countorra, and in that service's own website as you are already signed in to it. It clicks the service's buttons for you and always stops to ask before the click that cancels. It never types anything: no password, code, card number or message. If the service asks you to sign in, prove it's you, solve a check, enter payment details or consider an offer, it stops and leaves that to you.

The extension sends Countorra the steps it took (for example, “opened the account page”), the confirmation page's heading, and a screenshot of that confirmation page, which we keep with your documents and the cancellation. When it can't find the next button by itself, it sends a list of the page's visible buttons and links, the page's headings and its address (without anything after a “?”) so the next step can be chosen (§5c); it never sends what you have typed, a field's contents, the page's hidden content or the service's cookies. When a service's page has changed, we keep a note of which step and which page address (again without anything after a “?”), with nothing from the page itself, so we can update the steps.

Connecting a bank is optional, and happens only when you choose it. Countorra uses Plaid to connect to your financial institution. You sign in to your bank in Plaid's window; Countorra never receives or stores your bank username or password.

With your permission, Plaid provides Countorra with:

• your institution's name and identifier;
• each account's name, type and subtype, currency and last four digits — never the full account number;
• each account's current and available balances;
• transactions: amount, currency, date, whether the transaction is pending or posted, the merchant name and description, and the category label Plaid assigns.

Where your plan includes them and you agree to share them in Plaid's window, Plaid can also provide two more kinds of information. Each is asked for separately, and you can decline it and still connect your bank:

• Investment holdings — for an investment account: each security's name, ticker and type, the quantity you hold, its price and value, and its cost basis where your institution reports one. Countorra does not read your investment transactions.
• Card and loan details — for credit cards, student loans and mortgages: interest rates, the minimum or next monthly payment, the next due date, the last payment and statement balance, and whether a payment is overdue.

If you connect your payroll on Countorra Tax, that also goes through Plaid; what it reads and keeps is described under Payroll in §5e.

Plaid also gives Countorra an access key for your connection. Countorra encrypts it (AES-256-GCM) before storing it, with a key kept only in our server environment and separate from the database. It is never sent to your browser. It is used only to fetch updates from Plaid for your connection, on our servers.

Each bank account is added to your books automatically, unless you already keep a matching account by hand, in which case Countorra asks you first. Pending transactions are kept but not added to your books until they post. Changes you make to an imported transaction are not overwritten by later updates from your bank.

Disconnecting. You can disconnect a bank at any time from Bank connections. Countorra asks Plaid to end its access and destroys the stored access key. Transactions already imported stay in your books until you delete them, and the record of the connection and the transactions it reported stays with your organization's history until the organization is deleted. Plaid's own policy explains what Plaid keeps and how to manage it.

Every plan, including its free trial, is billed by Stripe. You enter your card details on Stripe's pages; you change plan, cancel and see your invoices in Settings → Billing, which reads them from Stripe. When you start checkout, Countorra sends Stripe your workspace and account identifiers, the plan you chose and, so Stripe can set up the customer record, your email address. Countorra never receives or stores your full card number or security code. Countorra stores the Stripe identifiers for your customer record and subscription, your plan, its status and the current billing period — what it needs to know which plan your organization is on.

Two more billing records are kept, so the trial and the terms you agreed to can be honoured and shown later:

• Your free trial. To give each account one free trial, Countorra records that your account started one, with a one-way hash (SHA-256) of your email address — not the address itself — the plan, and the Stripe checkout and subscription it belonged to. This record is kept after a workspace or your account is deleted (it is then no longer linked to your account; the hash remains), so the same email address cannot start a second trial. It is used for nothing else.
• The terms you confirmed. When you confirm a plan's price, trial and renewal before checkout, Countorra records the exact wording, the price, the version of these terms, the time, and the checkout it led to. It is kept as evidence of what was agreed, including after your account is deleted (no longer linked to it).

Billing emails — the trial reminder and the confirmation of a cancellation — are sent through our email provider to the address on your account; receipts and invoices come from Stripe.

• Every table containing your data enforces row-level security scoped to your organization, in the database itself — another organization's members cannot read or change your records, whatever the application asks for.
• Connections to Countorra are encrypted in transit (HTTPS), and the site instructs browsers to refuse unencrypted connections.
• Bank access keys are additionally encrypted by Countorra before storage, as described in §6, in a table no user can read.
• Credentials for our providers are held only on our servers, never sent to your browser.
• Messages from Plaid and Stripe to Countorra are accepted only after their signatures are verified.
• Uploaded documents are private; a download link is issued only to a member of your organization and expires within minutes.
• Sensitive account actions, such as deleting your account, require you to enter your password again — or, for an account created with Google, to have signed in with Google in the last 10 minutes.

See Security for more detail. No system is perfectly secure, and we cannot guarantee that it is.

We keep your data for as long as your account and organization exist. You can delete individual records at any time.

Deleting your account is self-serve, in Settings, and requires your password (or, for an account created with Google, a Google sign-in in the last 10 minutes). It permanently deletes every workspace you are the only member of — with all of its financial records, documents, tax information and bank connections (Countorra first asks Plaid to end its access, and destroys the stored access keys) — removes you from workspaces you share with others, deletes your AI conversations and your profile photos, ends your Outlook and payroll connections, and deletes your sign-in. A child's login in a household being deleted is deleted with it (a teen's own email account stays theirs). If you own a workspace that other people use, you are asked to make another member its admin first, so their data is not deleted with yours. Records you created in a shared workspace stay there for its other members, no longer linked to you.

Sign in with Apple: if your account uses Sign in with Apple, deleting your account also ends Countorra's Sign in with Apple access. You confirm with Apple once more when you delete, and we ask Apple to revoke Countorra's access. You can also remove Countorra yourself in your Apple Account settings, under Sign in with Apple.

Subscriptions: deleting your account cancels the paid subscription of every workspace being deleted, before anything else is deleted, and Countorra confirms with Stripe that it will not be charged again. If that cannot be confirmed, nothing is deleted. Stripe retains records of payments made, under its own obligations. A subscription bought in the iPhone app is billed by Apple; only you can cancel it, on your iPhone, and deleting your account does not.

Security audit log entries record security and account activity — changes to two-step verification, bank connections and your records — so that we can investigate security incidents, prevent fraud and help with account recovery. They cannot be edited, and each entry is kept for 24 months from the date it was recorded, including after a workspace or account is deleted, when it is no longer linked to it or to you. Some entries record the name you gave a workspace, and a failed attempt to connect a bank records the bank's name and the error message Plaid returned. After that period, entries are permanently deleted by an automatic daily process. If entries are needed to investigate a specific security incident, or the law requires us to keep them, we pause that deletion until they are no longer needed. Deleted data may also remain in our database provider's backups until those backups expire; we have not yet confirmed how long that takes.

Tax figures in Countorra are calculated by its tax engine, for the situations it supports, from the information you provide, with the limitations described in our Terms of Service. They are not tax returns, and Countorra does not file anything with a tax authority on your behalf.

You can, at any time:

• view and correct your profile, organization and records in the product;
• disconnect any bank connection;
• delete your account, as described in §9;
• ask us for a copy of your data, or what we hold about you, by contacting us. Countorra does not yet have a one-click export of everything; we will respond by hand.

Whatever state you live in, you can ask us to access, correct, or delete your personal information, and we will respond within 45 days. We do not sell or share your personal information for advertising. Depending on your state, you may have additional rights; contact support@countorra.com to exercise them.

Our service providers may process data in countries other than your own. Where that involves transferring data out of the European Economic Area, the UK or other regions with transfer requirements, we rely on the safeguards those providers make available. This policy is governed by the laws of the State of California, United States.

Countorra is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18 as an account holder. If you believe a child has created an account, contact support@countorra.com and we will look into it. (Tax preparation can record the name, relationship and date of birth of a dependent a user enters; that is the account holder's information about their dependent, not an account for a child.)

If we make a material change, we will update the date at the top of this page and, where appropriate, tell you directly before it takes effect.

support@countorra.com.