Security and privacy
There is nothing to store, so we store nothing.
The readiness check is a rules engine compiled into the page, and it runs on your machine. The server never receives your answers. That is why there is no retention schedule here, no export request to file, and no breach that could ever expose a record we did not hold in the first place.
What never happens
- No account. No password. No email field.
- No analytics, no session recording, and no advertising or third-party cookies of any kind.
- No bank connection, though six of the ten comparable services offer one.
- Your answers are never transmitted. They are never stored, logged or backed up.
- Nothing you type trains a model, because no model touches your figures at all.
One thing does leave your browser: the page request, which reaches Cloudflare like any web request. We join it to nothing. There is nothing to join it to.
The headers on every response
Asserted in the site's own configuration, served by the Worker, and readable by anyone. Open your browser's network tab and check us.
- Content-Security-Policy
default-src 'self'
Scripts, styles, images and fonts may only come from this origin, so no third-party tag can be injected into a page that is working on your tax record.- Strict-Transport-Security
max-age=31536000; includeSubDomains
The browser refuses plain HTTP here for a year. Subdomains included.- X-Frame-Options
DENY
The site cannot be framed at all, which means it cannot be wrapped inside someone else's page and clickjacked into doing something you did not intend.- X-Content-Type-Options
nosniff
The declared content type is respected. No guessing.- Referrer-Policy
strict-origin-when-cross-origin
Click a link out and the other site learns you came from thetieout.com. It never learns which page you were reading.- Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=()
Camera, microphone, location, payment. All four are switched off for this origin outright, so a script that asked for one would be refused by the browser before it reached you.
GDPR and CCPA
Both matter. Both barely reach us, for one reason: they govern personal data a business holds, and we hold none. No profile to access, correct, port or delete. Nothing to sell or share, so no opt-out to operate.
If that ever changes — a paid tier that keeps your intake between sessions is on the roadmap and would hold real data — this page changes first, before the feature ships, and the privacy page carries the detail.