Your tax information is sensitive. We treat it that way.

How we protect your information

• Encrypted connection. Every page of our website and client portal is served over an encrypted (HTTPS) connection.
• Encrypted on your device. Your uploaded documents, and your most sensitive details (Social Security numbers, birth dates, and bank routing and account numbers) are encrypted in your own browser before they’re sent. Only your preparer’s private key can unlock them; our servers store only the encrypted copies.
• Encrypted while stored. Your other intake answers and your portal messages are also stored encrypted.
• Two-step sign-in. Signing in to the client portal takes your password plus a 6-digit code from an authenticator app. Passwords are stored only in a protected, one-way form, and we check new passwords against lists of known breached passwords.
• Protection against break-ins. Repeated wrong sign-in attempts temporarily lock the account, and we email you when your account is signed in to from a new device.
• Automatic sign-out. You’re signed out after 30 minutes without activity.
• Limited staff access. Only the preparer assigned to you can see your information, through a separate secure sign-in. Access to your records is logged.
• No tax details in email. Our emails never contain your tax information. They simply ask you to sign in to your portal.
• Card payments stay with Stripe. You pay on Stripe’s secure page; your card number never reaches us.

No system can promise perfect security, but these safeguards are built into how our portal works. They aren’t optional settings.

Please don’t email your tax documents

Ordinary email isn’t a safe way to send Social Security numbers, W-2s, 1099s, tax returns, or ID documents. Please upload them through your Square Penny account instead. If you ever receive an email asking you to send these by email, it didn’t come from us.

How we use your information

We use what you submit to evaluate your tax situation, give you a quote, and, if you choose to work with us, prepare and file your tax return. We don’t sell your information.

We rely on a few service providers to run the portal:

• Cloudflare hosts our website and portal, stores your encrypted files and data, and delivers our notification emails.
• Stripe processes the Initial Review Fee payment.
• Google handles booking and video for your New Client Interview (the name and email you enter when booking, and the Google Meet call).
• Google Analytics and Google Ads measure visits to this public website (which pages are viewed, approximate location at city level, device type, and how visitors found us) using cookies. They are not used anywhere in the client portal, so nothing you enter or upload there is shared with them. You can opt out with Google’s opt-out browser add-on.

Independent tax professionals and specialized services. We may engage qualified independent tax professionals, technical consultants, and specialized service providers to help with tax preparation, verification, technical analysis, and review. These may include cryptocurrency transaction reconciliation and capital-gains calculations performed by a separately operated business.

Before anything is shared, we remove the information that identifies you: your name, your spouse’s and dependents’ names, Social Security numbers and ITINs, IP PINs, your address, phone and email, bank and account numbers, employer names and addresses, and anything else that could be traced back to you. Outside professionals see only the tax figures they need, under a reference number, in our secure system. They can’t download your documents or contact you, and your original documents never leave The Square Penny. Everyone who helps us works under a written confidentiality agreement, and we remain responsible for the accuracy of every return we prepare and sign. If the law requires your separate consent before we share any information, we’ll ask for it first.

“Remind me” emails. If you ask for a reminder on our website, we keep your email address only to send that one email, then delete it (or after 120 days at the latest). It isn’t a subscription or newsletter, and it’s never sold, shared, or used for anything else.

If you decide not to become a client

You become a Square Penny tax client when you pay the Initial Review Fee after accepting your quote. Until then, we don’t keep your information indefinitely.

Every year on October 31, we permanently delete the accounts of people who haven’t become clients, along with their intake answers and uploaded documents. This applies to accounts created before that date. October 31 falls after the October 15 extension deadline, so anyone still deciding during tax season has time. We keep only a minimal internal record that an account was deleted, and when. We don’t keep your tax information.

Want it deleted sooner?

You don’t have to wait. Sign in to your portal and go to Account → Your data. You can delete your intake information, your uploaded documents, or your whole account at any time. We’ll ask you to confirm with your password, because deletion is permanent.

If we prepare your tax return

Tax preparers are required to keep certain records. Once you become a client, your records follow our client record-retention policy instead of the yearly deletion: we keep them securely for seven years, then review them for secure destruction. Copies in the online portal are removed after they’ve been archived securely offline.

Questions about your information

Send us a secure message from your portal, or reach us through our contact page.