ReturnReady Privacy Policy

Last updated: November 1, 2026

1. Introduction

ClearStack Apps ("we", "us", "our") operates the ReturnReady mobile application and the client checklist pages it serves at returnready.web.app. ReturnReady is where a tax preparer tracks which documents each client has sent. This policy explains what is stored, where, who can see it, how long it is kept and how to delete it. It covers ReturnReady only; the rest of ClearStack Apps is covered by our main privacy policy.

A preparer using ReturnReady is responsible for their own clients' information. The client of a preparer should ask that preparer about their own handling of it. ReturnReady does not prepare, file or store tax returns, and it does not read documents.

2. What ReturnReady Stores

  • The practice's account: an anonymous account is created when the app first opens. If the preparer adds an email address and password, they are held by Google Firebase Authentication and never seen by us. The name a seat gives is stored with the practice.
  • The practice's settings: its name, phone, reply email, retention window and reminder schedule.
  • Clients: for each client, the name, email, phone, filing type, language and notes the preparer types, whether the preparer recorded that the client agreed to email reminders, and whether the client stopped them. The app tells preparers never to type a Social Security number or account number.
  • Checklists: which documents are expected from each client and whether each has arrived, been reviewed or does not apply, with dates and how many times it was asked for.
  • Encrypted documents (Pro): see section 3.
  • Records of activity: a log of files read and deleted, kept with the practice's records. Deletion log rows are removed after one year.
  • Purchase check: if the practice buys a plan from Google Play, the purchase token, used only to confirm the purchase with Google and to renew or end the plan.

3. Documents and Encryption

This is exactly what happens to a document a client uploads on the Pro plan:

  1. On the phone, the preparer's app creates an RSA-2048 key pair for the practice. The private half stays on the phone in Android's secure storage. A copy goes to our servers only after being locked with AES-256-GCM under a recovery code, using a key derived with PBKDF2-HMAC-SHA256. The recovery code is shown to the preparer and is not sent to us.
  2. In the client's browser, each file gets a new random AES-256-GCM key. The file, and separately its name and type, are encrypted with that key, and the key is wrapped to the practice's public key with RSA-OAEP and SHA-256. Only then is anything sent.
  3. Our servers receive and store only that encrypted data, in a storage bucket that no phone or browser can reach directly. We check the link, the plan, the declared file type and the size. We cannot look inside the file, and we cannot read its name.
  4. The preparer's app fetches the encrypted file, with the signed-in seat checked on every read and logged, and decrypts it on the phone. A decrypted copy sits in the app's temporary folder while it is being viewed and is removed the next time a document is opened or the app is launched. If the preparer shares a document or a zip from the app, what happens to it next is up to the preparer and the app they share it with.

Limits you should know about. We hold the locked copy of the private key, so the strength of the protection depends on the recovery code, which is generated by the app at about 99 bits. If a preparer loses both their phone and the recovery code, stored documents cannot be opened by anyone, including us. An assistant who was given the recovery code keeps what they know after their seat is removed; a practice that wants to rule that out should start a new key, which erases the stored documents. Names and contact details of clients, and the checklists themselves, are not encrypted this way: they are encrypted in transit and at rest by Google, and they are readable by the practice's seats and, like any data on a server, by us if we had to look for a support or legal reason. We do not read them otherwise.

4. How Long Documents Are Kept

  • A document is deleted automatically once the retention window has passed after its client is marked complete. The preparer sets the window, 60 days by default.
  • Whatever else happens, a document is deleted within 180 days of arriving.
  • A preparer can remove one document, delete a client, close the season or use Erase everything at any time. Each removes the stored files at once.
  • Deleted files are not kept in a recycle area. Our bucket has soft delete turned off.

5. Client Reminder Emails and the Checklist Page

Reminder emails are sent through Resend on behalf of a preparer on a paid plan, only to clients the preparer has recorded as agreeing. They name the practice, the documents still missing and the client's link. Every email has a link to stop them. The checklist page shows the practice's name, the client's first name and their checklist to anyone holding the link, so a link should be treated like a key. Links are 22 random characters, can be stopped by the preparer at any time, and are not listed anywhere or indexed by search engines. The page sets no cookies and runs no analytics.

6. Crash Reports and Analytics in the App

  • Firebase Crashlytics (Google LLC): crash reports, device model, operating system and app version, so we can find and fix bugs.
  • Firebase Analytics (Google LLC): basic usage events such as app opens and screen views, tied to a random ID for the app on your phone. The advertising ID is not collected.

These never include client names, checklists or documents. ReturnReady shows no third-party ads. The free tier shows a banner for ClearStack's own website service; nothing from the practice's records is used to choose it. Nothing in a practice's records is sold or shared with advertisers.

7. Where It Is Stored

On Google Cloud (Firebase) in the United States, encrypted in transit and at rest. The app keeps a copy of the client list and checklists on the phone so the board works without a connection.

8. Who Can See It

  • Every seat of the practice (the owner and, on Pro, one assistant) sees its clients and checklists. Reading documents also needs the recovery code on that phone.
  • Anyone holding a client's link sees that client's first name and checklist, and can mark a document as not applicable or upload a file to it. They cannot see or download files already sent.
  • Google acts as our processor to store the data, and Resend to send reminders.

9. A Preparer's Own Duties

US tax preparers have their own duties under the FTC Safeguards Rule, including keeping a written information security plan. See IRS Publication 4557 and Publication 5708. ReturnReady is one tool within such a plan. It does not replace one, and nothing here is legal advice.

10. Deleting the Practice or Your Account

In the app: Settings, then Delete account, and confirm. Or email support@clearstackapps.com from the address on the account. When the owner deletes the account, the whole practice goes with it: every client and checklist, every link and every stored document. An assistant who deletes their account leaves the practice; its clients stay.

A client of a practice who wants their details removed should ask that practice, which can delete the client and everything stored for them. Crash reports are kept by Firebase for 90 days and then deleted.

11. Contact

support@clearstackapps.com