Privacy policy

Who we are

TaxNotes.ca is an independent website that publishes free, plain-language information about Canadian tax. We are not affiliated with the Canada Revenue Agency (CRA), Revenu Québec, any other government body, or TaxTips.ca.

This policy explains what personal information we collect, why we collect it, and what you can do about it. We follow the fair information principles of Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). If you have a question or a request, see Contact us.

Without an account

You can read every page and use every calculator without signing in. While you’re signed out, we don’t store anything about you on our servers, apart from rare entries in our server error log. If you sign up for email updates, we also keep your email address (see Email updates).

What your browser keeps

A few conveniences are kept in your own browser’s storage (called local storage) on your device. We can’t see them. They are only sent to us if you sign in, when they’re added to your account (see With an account).

taxnotes:prefs:v1

The province or territory and the tax year you picked, so pages show the figures that apply to you. Nothing is stored until you change them.

taxnotes:saved:v1

The pages you’ve saved with the Save button: each page’s address on our site, its title and when you saved it. Never anything after a “?” or “#” in the address.

taxnotes:account-cache:v1

Only while you’re signed in: a copy of the saved pages and preference in your account, and when that copy was last refreshed, so pages show them without waiting. It’s removed when you sign out.

You can remove all of these at any time by clearing this site’s data in your browser’s settings. If your browser blocks storage (some private-browsing modes do), the site still works; it just won’t remember your choices.

Calculators

Our calculators run entirely in your browser. The amounts you type are never sent to us and never stored, on our servers or in your browser’s storage. The province and tax year you choose in a calculator are remembered as your preference, as on any other page. Saving a calculator page keeps only its address, never the amounts.

When you use Copy link, the amounts go into the part of the link after the “#” sign. Browsers don’t send that part to the website, so it never reaches our servers or our logs. Anyone you share the link with can see the amounts in it, though, and it stays in your browser history like any other address.

Site search

Search runs entirely in your browser. It uses a search index that’s built with the site (by a tool called Pagefind) and stored on our own server. As you search, your browser downloads the parts of the index it needs and finds the matches itself, so what you type is never sent to us or to anyone else.

Your search is kept in the part of the address after the “#” sign (for example, /search/#q=rrsp). As with calculator links, browsers don’t send that part to the website, so it never reaches our servers or our logs. It does stay in your browser history.

With an account

An account is optional. It lets you keep your saved pages and your province and tax year on all your devices. When you have one, we store only:

• Your email address, which we use to sign you in, and the date your account was created. We don’t ask for your name, a password or anything else.
• Your sign-in sessions: one for each browser or device you’re signed in on. We don’t store your IP address or any details of your browser or device with them.
• Your saved pages: each page’s address and title, and when you saved it.
• Your province or territory and tax year, if you’ve chosen them.

We use this information only to sign you in and to keep your saved pages and preference. We don’t sell it, and we share it only as this policy describes.

While you’re signed in, your saved pages and your province and tax year are stored in your account, so the Save button and the province and year picker work the same on every device. For each saved page, we receive only its address on our site and its title, never anything after a “?” or “#” in the address. An account keeps up to 200 saved pages; saving more removes the oldest.

When you sign in on a browser that already has saved pages or a preference stored, they are added to your account (without duplicates) and the copy in that browser is then removed. Where your account already has a province or tax year, it keeps it. While you’re signed in, your browser keeps the copy described under What your browser keeps; it’s removed when you sign out, and your saved pages stay in your account.

Sign-in emails

We don’t use passwords. To sign in, you enter your email address and we email you a sign-in link and a 6-digit code. Both expire after 15 minutes and can be used only once. If you ask for a sign-in email but never use it, no account is created.

We send these emails, and our email updates, through Resend, an email service provider based in the United States. Resend receives your email address and the message we send you, including any link and code, so that it can deliver it. Our emails are sent from Resend’s United States region, so that information is processed there and may be accessible to authorities under US law. Resend handles it under its own privacy policy. We don’t use any other outside service for email.

Until a link or code is used or expires, our database keeps a scrambled (hashed) copy of it along with the email address it was sent to.

To stop the sign-in form from being used to flood someone’s inbox, the server counts recent sign-in requests for each email address and each network (IP) address. These counts are held in the server’s memory only, never written to our database or logs. A request stops counting after an hour (a day, for some of the limits on codes), and all the counts are cleared whenever the server restarts.

Email updates

You can ask for a short email when we post changes readers would notice, such as newly published rates or corrected guides. It’s optional, and it’s separate from accounts: you don’t need an account to sign up, deleting your account doesn’t unsubscribe you, and unsubscribing doesn’t delete your account.

Confirming your address

When you enter your email address, we send you a confirmation email with a link. You’re subscribed only once you open that link and press Confirm my subscription on the page it opens on our site. The link works for 7 days. If you’re signed in with the same email address when you subscribe, you’ve already shown it’s yours, so you’re subscribed straight away and we don’t send a confirmation email.

An address gets at most 2 confirmation emails, at most one an hour, and never more than 2 in any 30 days. If you don’t confirm, you won’t get any updates, and your address is deleted automatically 30 days after the last confirmation email.

What we keep

• Your email address.
• Its status: waiting for confirmation, subscribed or unsubscribed.
• A few dates: when the address was added, when it was confirmed, when we last sent it a confirmation email, and when it was unsubscribed.
• How many confirmation emails we’ve sent it (2 at most).
• Scrambled (hashed) copies of the secret codes in your confirmation and unsubscribe links (SHA-256 hashes). We never store the codes themselves.

Nothing else: no name, no IP address, and no tracking of whether you open our emails or click their links. We use your address only to send these emails.

Sending

The list of addresses stays on our own server. Our emails are delivered by Resend, the US-based email service described above, which receives your address and the email only when one is sent to you. We send an update only when our weekly round of updates includes changes readers would notice. Every email we send includes our postal address.

Unsubscribing

Every update email has an Unsubscribe link at the bottom, which opens a page with an Unsubscribe button, and mail apps that support it offer their own one-click unsubscribe. Confirmation emails also have a Don’t email me again link, in case someone else entered your address.

After you unsubscribe or choose “Don’t email me again”, we keep your address and the date as a do-not-email record, for as long as we run email updates. It stops anyone from using our sign-up form to email you again. To subscribe again later, sign in with that address and subscribe, or contact us.

To have that record removed completely, contact us. Without it, though, someone could use our sign-up form to send your address a confirmation email again.

To stop the sign-up form from being misused, the server also counts recent requests for each email address and network (IP) address, in the same way as for sign-in emails.

Reporting an issue

When you use our Report an issue form, we receive what you type: the page, what kind of issue it is and your message, plus your name and email address if you choose to give them. It’s sent to our own email inbox through Resend, with your email address (if you gave one) set as the address to reply to. It isn’t saved on our site or in our database, and we don’t add you to any mailing list.

We use a report only to look into the issue and, if you gave your email address, to reply to you. We delete reports once we’ve dealt with them, and within a year at most. Please don’t include your social insurance number, income or other personal details in a report.

To stop the form from being misused, the server counts recent reports from each network (IP) address, held in memory only, as for sign-in emails.

Bot check on our forms

The forms that make us send an email (signing in, signing up for email updates and reporting an issue) use Cloudflare Turnstile to keep automated abuse out. It loads only once you start filling in one of those forms: your browser then fetches a small check from Cloudflare (challenges.cloudflare.com), which looks at signals such as your IP address and your browser’s details to tell people from bots. Most people never see it; now and then it may ask you to tick a box.

The check can’t see what you type into the form. When you send the form, our server asks Cloudflare whether the check passed, along with your IP address. Cloudflare says it uses these signals to detect bots and improve its bot detection, not to identify, profile or target anyone; see its Turnstile privacy addendum.

Public API and MCP server

Our public API and MCP server let programs and AI assistants look up our figures, run the income tax calculator, and search and read our guides (see For AI agents and developers). They need no sign-in and no key, and they don’t read or set cookies.

Incomes and anything else you send them are used only to answer that request. Our app never logs or stores them. The amounts for a calculation, and everything sent to the MCP server, travel in the body of the request, which our server logs don’t record. Simple lookups, such as which figure you asked for, are part of the web address, so they appear in our server logs like any other page request.

To keep the service fair for everyone, the server counts each IP address’s requests over the last minute and turns away any over the limit. These counts are held in the server’s memory only, never written to our database or logs, and they’re cleared whenever the server restarts.

Cookies

If you aren’t signed in, we don’t set any cookies. When you sign in, we set two:

Session cookie (__Secure-better-auth.session_token)

Keeps you signed in. It holds a random session token, can’t be read by scripts on the page, and is only sent over a secure (HTTPS) connection. It lasts 30 days and is renewed as you use the site.

tn_signed_in

Holds only the value “1”: no secret and nothing about you. It tells our pages to show the saved pages and preference from your account instead of the ones in this browser. Like the session cookie, it lasts 30 days and is renewed as you use the site.

Signing out or deleting your account removes both. Email updates, site search, the public API and the MCP server don’t use cookies.

Your answer to the analytics banner is remembered in a cookie on this site (cf_consent), set by Cloudflare. If you accept analytics, Google Analytics also sets cookies holding a random ID (see Analytics). We don’t use advertising cookies.

Our pages are delivered by Cloudflare. If Cloudflare ever needs to check that a visit isn’t automated, it shows a short check and may set a security cookie (cf_clearance) used only for that check.

Analytics

We use Google Analytics to see which pages people read and where the site needs work, but only if you agree. On your first visit a banner asks; until you accept, Google Analytics doesn’t run. You can change your choice any time with Privacy choices at the bottom of every page.

It runs through Cloudflare Zaraz: our pages report a visit to Cloudflare, and Cloudflare’s servers pass it on to Google, so your browser doesn’t load Google’s own script. Before anything is passed on, it’s set to:

• remove everything after the “?” in page addresses (sign-in and email links carry codes there),
• shorten your IP address, so Google only gets a rough idea of where you are,
• strip detail from the identification string your browser sends, and
• leave out the address of another website that sent you here.

It doesn’t run on the sign-in, account or email-update pages. It never sees what you type into a calculator or a search: those stay after the “#” in the address, which browsers don’t send.

What Google receives: the address and title of each page you view, your approximate location (city or region), your browser and device type, screen size and language, and a random ID kept in a cookie so a repeat visit isn’t counted as a new visitor. It isn’t linked to your account or your email address, and we don’t use Google’s advertising features. Google keeps this visit-level data for 2 months; after that we see only totals. Google (Google LLC, based in the United States) may process it in the United States or other countries, under its privacy policy.

Server logs

Our web server doesn’t keep a log of the pages people visit. Its error log records only serious server faults, which are rare. An entry there can include the IP address a request came from, the date and time, and the address that was asked for. We use it only to keep the site running and secure, and it’s deleted after 14 days.

The site’s own error log is written to leave out email addresses, the secret part of sign-in, confirmation and unsubscribe links, codes, and anything sent to the public API or the MCP server. It’s limited in size, so older entries are deleted as new ones are written. Calculator amounts and search terms never reach our servers, so they can’t appear in any log.

Every request also passes through Cloudflare on its way to our server, and Cloudflare handles the full address of each request, including links from our emails, to deliver it. Cloudflare can also ask your browser to report problems it has loading our pages (network error logging) to Cloudflare. What Cloudflare keeps, and for how long, is set by its own privacy policy.

Outside services

We use four outside services:

• Cloudflare (Cloudflare, Inc., based in the United States) sits between your browser and our server. Every request to TaxNotes.ca goes through its network, usually through a location near you, which delivers our pages and protects the site from attacks. To do that it handles your IP address, the address of the page you ask for and the information your browser sends with each request. It may process this in the United States or other countries where it operates. We don’t use Cloudflare’s own analytics. It shows the analytics banner and, only if you accept, passes your visits on to Google (see Analytics). It also runs the bot check on our forms. Cloudflare’s use of this information is covered by its privacy policy.
• Resend sends our sign-in emails and email updates, and delivers the issue reports you send us (more about Resend).
• Amazon Web Services (Amazon Web Services, Inc., based in the United States) stores our database backups, in its Amazon S3 storage service. A backup is a copy of our database: accounts, saved pages, preferences and email-update subscriptions. We make one a week and keep each for 4 weeks. Amazon stores them on our behalf, possibly outside Canada, under its privacy notice.
• Google (Google LLC, based in the United States) runs Google Analytics, which counts visits only if you accept analytics (more about analytics).

Our fonts and our search index are stored on and served from our own server, so loading a page or searching doesn’t send a request to Google or any other service. Our pages don’t load ads, social media buttons or scripts from other companies’ servers, with two exceptions: Cloudflare’s small Zaraz script, served from our own address, which shows the analytics banner and, if you accept, sends visits on to Google Analytics; and Cloudflare’s bot check, which loads only once you start filling in a form that sends an email.

Links to official sources, such as canada.ca and revenuquebec.ca, take you to those websites, which have their own privacy policies.

How we protect it

• The site is served over a secure (HTTPS) connection.
• Sign-in links and codes, and the secret codes in email-update links, are stored only in scrambled (hashed) form.
• Each code allows only a few wrong tries, and the number of sign-in and confirmation emails per address and per network is capped.
• The session cookie can’t be read by scripts on the page and is only sent over HTTPS.

How long we keep it

• Your account, saved pages and preference: until you delete your account. Accounts aren’t deleted automatically.
• Sessions: a session stops working after 30 days without use. It’s deleted when you sign out on that device, and all of them are deleted with your account.
• Sign-in links and codes: they expire after 15 minutes and work only once. The record is removed once it’s used and cleared out automatically after it expires.
• Email updates: a subscription is kept until you unsubscribe. An address that’s never confirmed is deleted 30 days after its last confirmation email. After you unsubscribe or choose “Don’t email me again”, your address and the date are kept as a do-not-email record for as long as we run email updates, unless you ask us to remove it.
• Issue reports: kept in our email inbox until we’ve dealt with them, and deleted within a year at most. Nothing about them is kept on our site.
• Request counts (sign-in, email updates, issue reports, the public API and the MCP server): held in the server’s memory only. A request stops counting after a minute, an hour or a day, depending on the limit, and all the counts are cleared whenever the server restarts.
• Server logs: the web server’s error log is deleted after 14 days. The site’s own error log is limited in size, and older entries are deleted as new ones are written.
• Backups: we back up our database once a week and keep each backup for 4 weeks. Anything deleted from our database, including a deleted account, can stay in a backup for up to 4 weeks, until that backup is deleted.
• Analytics: Google keeps visit-level data for 2 months, then only totals remain. Your answer to the banner stays in the cf_consent cookie until you change it or clear your cookies.
• Your browser’s storage: until you clear it. The signed-in copy is removed when you sign out.

Your rights and choices

• See what we hold. Your account shows your email address, your saved pages, and your province and tax year. For a copy of everything we hold about you, including any email-update subscription, contact us.
• Correct it. Change your province or tax year with the picker on any page, and remove saved pages with their Save button or on Saved pages. To change your email address, contact us.
• Delete it. Delete my account on Your account removes your account, sessions, saved pages and preference from our database immediately, cancels any sign-in links or codes still in your inbox, and signs you out on every device. It can’t be undone. Copies in our weekly backups are gone within 4 weeks. Deleting your account is also how you withdraw your consent. It doesn’t cancel email updates, which are separate.
• Stop email updates. Use the Unsubscribe link in any update email, or your mail app’s unsubscribe button. To have the do-not-email record removed as well, contact us.
• Clear your browser. Clearing this site’s data in your browser’s settings removes everything kept there.

We answer requests within 30 days. If you aren’t satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we change how we handle personal information, we’ll update this page and the “Last updated” date at the top.

Contact us

For questions, requests or concerns about your privacy, email hello@taxnotes.ca, or write to us at: