Cookie Policy

This Cookie Policy describes how TaxWallet (“we”, “our”, “us”) uses cookies, local storage, device identifiers, and similar tracking technologies (“Cookies”) to operate, secure, and improve our Services.

This applies to:

• www.taxwallet.ai (marketing website),

• app.taxwallet.ai (dashboard SaaS application),

• TaxWallet mobile applications (iOS & Android).

This Cookie Policy is issued by Tax Wallet Inc., doing business as TaxWallet. Non-essential cookies and similar technologies are used only with your consent, which you give or refuse in our cookie banner.

Cookies are small data files stored on your browser or device. TaxWallet may also use secure local storage, session storage, and mobile device identifiers for performance and security.

TaxWallet does not use cookies for third-party advertising, cross-site retargeting, behavioral profiling, or selling data. After you click Accept, we do use first-party device identifiers, IP-based approximate location, and analytics to measure and attribute our own marketing (see Section 3). Security and fraud-prevention checks run for everyone.

TaxWallet uses the following categories of Cookies. Categories 1, 2 and 4 are strictly necessary; categories 3 and 7 run on our website only after you click Accept:

1. Strictly Necessary Cookies

• Enable login, authentication, dashboard sessions, and system operations.

• Essential for e-filing, document transfer, and tax workflow functionality.

• Cannot be disabled because they are required to deliver the Services.

• On our website these include tw_consent (remembers your cookie choice, 12 months) and tw_like (lets the Like button work for visitors who have not accepted analytics, 12 months; never used for analytics).

2. Security & Fraud Prevention Cookies

• Detect unauthorized access and login anomalies.

• Enforce MFA and validate device identity.

• Prevent duplicate submissions and suspicious activity.

• Includes secure device fingerprinting for IRS & FTC Safeguards compliance.

3. Performance & Analytics Cookies (Limited)

After you click Accept, TaxWallet uses Google Analytics 4 (GA4) and Google Tag Manager (GTM) for the following. Before that, and after Decline or with a GPC signal, no Google script is loaded and no request is made to Google:

• Page views,

• Navigation flow,

• Performance metrics (load time, errors),

• Platform stability monitoring.

GA4 is configured with:

• No IP address logging or storage by Google Analytics,

• No demographic tracking,

• No Google Signals or cross-device ads,

• No advertising features enabled,

• No behavior modeling beyond aggregated analytics.

We do NOT use GA4 or GTM for third-party advertising, cross-site profiling, retargeting, or selling data. We DO use first-party, aggregated analytics — including the anonymous device ID and approximate location (derived from IP) — to measure and attribute our own marketing (e.g., which channels, campaigns, or representatives bring visitors and sign-ups).

4. Functional Cookies

• Remember theme, language, preferences, and accessibility settings.

• Maintain dashboard state for smoother workflow.

• Improve user experience but do not contain personal or tax data.

5. Support Recognition Cookies

• Used during support chat to identify the logged-in user securely.

• Store a hashed session ID + hashed name + hashed email ONLY.

• Never used for analytics, marketing, or any profiling.

• Ensures rapid troubleshooting with no disclosure of sensitive information.

6. Mobile App Device Identifiers

• Upon installation, the mobile app generates a unique DeviceID.

• Used for secure authentication, fraud prevention, and mobile notifications.

• Does NOT use IDFA, GAID, advertising identifiers, or app tracking.

• DeviceID is never shared with third parties.

7. Website Device ID & Approximate Location

• Only after you click Accept, our marketing website sets an anonymous device ID (a random first-party cookie). It does not contain your name or contact details. A hardware-derived device identifier is computed only on the tax-filing and account pages, for IRS e-file security.

• Only after you click Accept, we record your IP address with the pages you read, from which an approximate location (e.g., region or city) may be derived, and we connect your session live to our secure hub. Raw IP addresses in analytics are kept 90 days, then only aggregated location counts. We do not request or access your device’s precise GPS location.

• Separately, and whether or not you accept, for every visit our servers keep a security log (IP address, approximate location — city, region, country — page requested, time and browser type) used only to protect the site and our users: detecting attacks, fraud and abuse, and investigating incidents. Security logs are kept for 90 days, are never used for marketing or analytics, and are never sold or shared except with law enforcement or as the law requires. This log sets no cookie and no device ID (Privacy Policy, Section 3.9).

• Used only after you click Accept on our cookie banner — together with Google Analytics and Google Tag Manager and the live tracing of your session over our secure hub — for product analytics, live support, and first-party marketing measurement and attribution (which channels, campaigns, and representatives drive visits and sign-ups). If you click Decline, or your browser sends a Global Privacy Control (GPC) signal, analytics and live tracing stay off; only strictly necessary and security cookies run.

• First-party only: never sold, and never shared with third-party advertising or retargeting networks.

To protect user privacy, TaxWallet does NOT use:

• Advertising cookies of any type,

• Behavioral or interest-based tracking,

• Social media retargeting pixels,

• Facebook Pixel, TikTok Pixel, or LinkedIn tracking,

• Cross-site tracking technologies,

• Session replay tools (e.g., Hotjar, FullStory),

• Third-party or cross-site device fingerprinting (our device ID is first-party only and never shared).

We never sell, share, or disclose cookie-based data to third-party marketing systems.

TaxWallet uses Cookies strictly to:

• Authenticate and maintain secure user sessions,

• Prevent fraud and unauthorized access,

• Improve platform performance and reliability,

• Analyze navigation flow to optimize the user experience,

• Recognize your device via an anonymous first-party device ID (website: only after you accept),

• Derive approximate location from your IP for analytics and first-party marketing attribution (website: only after you accept),

• Measure and attribute our own marketing (channels, campaigns, representatives) (website: only after you accept),

• Provide faster support response (hashed identity recognition),

• Ensure IRS, GLBA, and FTC Safeguards Rule compliance.

Cookies are NEVER used to store sensitive tax return data, SSNs, bank information, documents, or personal financial information.

Strictly necessary and security Cookies do not require user permission.

Analytics, marketing measurement and live session tracing on our website require your opt-in (Accept). Before you choose, and after Decline, they do not run.

A browser that sends a Global Privacy Control (GPC) signal is treated as Decline unless you choose Accept yourself.

Declining or GPC does not stop the server-side security log of each visit (IP address, approximate location, page requested, time and browser type), which uses no cookie, serves only security and fraud prevention, and is kept for 90 days.

You may withdraw consent at any time from “Your Privacy Choices” at the bottom of every page; withdrawing deletes the analytics cookies and the device ID and stops live tracing immediately.

We do not sell personal information and do not use third-party advertising pixels.

Refusing analytics Cookies does not limit access to core features but may reduce performance optimization.

Users may manage Cookies via:

• Browser settings,

• The cookie banner, reopened any time from “Your Privacy Choices” in the site footer,

• Mobile OS privacy controls.

Disabling Cookies may impair authentication, e-signature workflows, document uploads, and dashboard functionality.

TaxWallet is not responsible for service failures caused by user-side cookie blocking or privacy extensions.

TaxWallet uses limited third-party tools for operational security and analytics:

• Google Analytics 4 (navigation analytics, only after you accept),

• Google Tag Manager (container only, no advertising tags, only after you accept),

• Infrastructure monitoring tools (e.g., uptime, error reporting),

• Authentication and fraud prevention providers.

Third-party vendors are contractually restricted from using TaxWallet data for their own purposes.

No third-party receives user identity, tax information, or sensitive data from Cookies.

To enhance support experience, TaxWallet may store a support recognition cookie that:

• Identifies the logged-in account using hashed identifiers,

• Helps our support team resolve issues faster,

• Provides audit tracking and case documentation.

This cookie is optional and contains no sensitive information.

It does NOT log user activity outside the TaxWallet platform.

TaxWallet retains cookie identifiers only for as long as necessary:

• Session cookies: expire after 20 minutes of inactivity,

• Functional cookies: 24 hours,

• Support recognition tokens: up to 30 days,

• DeviceID: persists until mobile app is removed or reset.

We do not indefinitely store cookie identifiers or sell cookie data.

All Cookies and identifiers are protected using:

• HttpOnly (where browser-supported),

• Secure flag (HTTPS-only),

• SameSite=Lax or Strict,

• Token rotation,

• Encrypted device storage on mobile apps.

Users are responsible for protecting their login credentials and device access.

We may revise this Cookie Policy as technologies evolve or as regulatory requirements change.

Users will be notified of material changes via email, banner, or in-app notice.

Previous versions remain available from this page.

TaxWallet Privacy & Security Office — Tax Wallet Inc.

Email: support@taxwallet.ai

For cookie-related questions, opt-out requests, or compliance inquiries, contact us anytime.