Privacy Policy

Who We Are

CryptoTax AU ("we", "us", "our") operates the website at www.innerdrive.com.au. We provide a tool that helps Australian cryptocurrency investors calculate their Capital Gains Tax (CGT) obligations and generate reports compatible with Australian Taxation Office (ATO) requirements.

This Privacy Policy explains how we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Information We Collect

We collect the minimum information necessary to provide our service. Here is exactly what we collect and why:

How We Use Your Information

We use the information we collect solely to provide and improve CryptoTax AU. Specifically we use it to:

• Create and manage your user account
• Process your CoinSpot CSV files and calculate your CGT obligations
• Generate ATO-compatible tax reports for your use
• Send password reset emails when requested
• Maintain the security and integrity of our platform
• Comply with our legal obligations under Australian law
• Improve the accuracy and performance of our tax calculations

We will never sell your personal information to third parties. We will never use your financial transaction data for advertising or marketing purposes.

Data Storage & Security

Your account information is stored securely using Google Firebase Authentication, which provides enterprise-grade security including:

• Passwords are never stored in plain text — they are hashed using industry-standard encryption
• All data is transmitted over HTTPS with TLS encryption
• Firebase data centres are located in the United States and comply with international security standards including ISO 27001 and SOC 2/3
• We enforce session timeouts — you are automatically signed out after 60 minutes of inactivity
• Rate limiting prevents brute-force login attacks

CSV File Processing

This is one of the most important sections of our privacy policy. Please read it carefully.

This means:

• Your full transaction history never leaves your device
• We cannot see, access or store your individual crypto transactions
• If you close your browser tab, all uploaded data is cleared immediately
• No transaction data is retained between sessions

The only data that touches our servers is your account credentials (email and encrypted password) managed by Firebase Authentication.

Third Party Services

We use a small number of trusted third-party services to operate CryptoTax AU:

We do not use advertising networks, analytics trackers, or any data broker services. We do not share your personal information with any other third parties.

Your Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights regarding your personal information:

• Access: You can request a copy of the personal information we hold about you
• Correction: You can request that we correct inaccurate or incomplete information
• Deletion: You can request that we delete your account and all associated data
• Portability: You can export your generated tax reports at any time using the download buttons in the app
• Complaint: You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, please contact us using the details in Section 12 below. We will respond to all requests within 30 days.

Data Retention

We retain your personal information only for as long as necessary to provide our service and comply with our legal obligations:

• Account data (name and email) — retained while your account is active, and for up to 12 months after account deletion for fraud prevention purposes
• CSV transaction data — never retained (processed in-browser only, see Section 5)
• Authentication logs — retained for up to 90 days for security purposes

If you request account deletion, we will remove your data within 30 days, except where retention is required by law.

Cookies

CryptoTax AU uses a minimal number of cookies necessary to operate the service:

• Authentication cookies: Set by Firebase to maintain your login session. These are essential and cannot be disabled without breaking the service.
• Security cookies: Used to protect against cross-site request forgery (CSRF) attacks.

We do not use advertising cookies, tracking cookies, or any third-party analytics cookies. We do not use Google Analytics or any similar tracking service.

By using CryptoTax AU you consent to the use of essential authentication cookies described above.

Disclaimer

We make no warranty, express or implied, that:

• The calculations produced are accurate, complete or up to date
• The service is suitable for your specific circumstances
• Use of the reports will result in compliance with your ATO obligations

You should always verify all figures against your original CoinSpot records and consult a registered tax agent or tax accountant before lodging your tax return. The ATO can impose significant penalties for incorrect reporting.

To the maximum extent permitted by law, CryptoTax AU and its operators accept no liability for any loss or damage arising from your use of this service or reliance on any report generated by it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes we will:

• Update the "Last updated" date at the top of this page
• Display a notice within the app notifying you of the changes
• Where required by law, seek your consent before applying changes

We encourage you to review this policy periodically. Your continued use of CryptoTax AU after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a complaint about how we handle your personal information, please contact us:

• Website: www.innerdrive.com.au
• Response time: We aim to respond to all privacy-related inquiries within 5 business days

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.