Privacy policy

Who we are

Grubless is operated by Node Integration Pty Ltd (ABN 37 162 496 979), an Australian company, trading as Grubless. In this policy "we" and "us" mean that company.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you want to raise something under this policy, write to privacy@grubless.io.

What we collect

Everything below is collected because a function of the product needs it. We do not collect information speculatively in case it is useful later.

Because you have an account:

• Your email address, and a password, which is stored only as a scrypt hash with a per-account salt. We never hold your password and cannot recover it — a reset issues a new one.
• Session and API tokens, stored only as SHA-256 hashes. Sessions expire after 30 days, and password reset links after one hour.
• Your subscription tier and which financial years you have access to.

Because you set up an entity: the entity's name, its type (individual, company, SMSF, trust, and so on), its jurisdiction and financial-year start, and its tax settings. Where you invite someone else to an entity, we record their email address and their role.

Because you connected a source:

• Public wallet addresses you add, and the chains you track them on.
• Exchange API credentials where you connect an exchange. These are encrypted with AES-256-GCM before they are written to the database, and are never returned to any client — not to the web app, not to the CLI, not to an administrator.
• Transaction history imported from those sources: amounts, assets, counterparty addresses, timestamps and fees, plus anything derived from them — tax parcels, disposals, gains, income and the reports built on top.
• Files you upload for CSV import, and any labels or notes you add to your address book.

Because we run a service: ordinary server logs, including IP addresses, for security, rate limiting and diagnosing faults.

A note on wallet addresses

A public blockchain address is pseudonymous on its own. Held next to your account it is not: it is linked to a named person and, in this product, to their tax position. We therefore treat wallet addresses and the transaction history behind them as personal information throughout, and give them the same protection as your email address.

We do this because it is the honest reading, not because we are certain a regulator would require it. The alternative — arguing that a public address is not personal information because it is public — is a technicality, and it is not one we want to be standing on if something goes wrong.

What we use it for

Computing your tax position, showing it to you, generating your reports, and running your account — billing, authentication, support and security. That is the whole list.

What we do not do: we do not sell personal information; we do not share it with data brokers, advertisers or analytics networks; we do not use your transaction history to train models; and we do not use it to build any product other than the one you are paying for. Your financial history is what we are hired to organise, not an asset we monetise.

Who else receives it

Running this product means contacting other services on your behalf — a block explorer cannot tell you what an address did without being told the address. Every recipient is listed here, with what actually reaches it. This table is generated from the same list the application itself uses, and a test prevents us from adding a data source, or a payment, email or error-reporting service, without adding it here.

Infrastructure

Blockchain data

Exchanges you connect

Banks you connect

Accounting software you connect

Prices and asset checks

DeFi protocol data

CSV and bank-statement imports contact nobody. A file you upload is read, parsed and stored, and no third party is involved. If you would rather no external service saw your addresses, importing by CSV is a real alternative and this is us telling you so.

We will also disclose information where the law requires it — a court order, a properly issued notice from a regulator or law enforcement. If that happens, we will tell you, unless we are prohibited from doing so.

Overseas disclosure

Your data is stored in Australia, in Fly.io's Sydney region. That covers the database, the job queue and the backups.

Some recipients in the table above operate outside Australia — principally in the United States (Resend, Sentry, Stripe, Alchemy, Helius, BlockCypher, Stellar Development Foundation, Kraken, Plaid Inc., Intuit Inc., Coinbase) and Singapore (Crypto.com Exchange, CoinGecko). Under Australian Privacy Principle 8 we remain accountable for information disclosed overseas. By connecting a source you are asking us to contact that provider on your behalf, and the alternative is not connecting it — the product works entirely on CSV imports if you prefer. Paying for a plan sends your payment details to Stripe; the free plan involves no payment at all.

How long we keep it

While your account is open, we keep your data — that is the point of it. Tax records are also long-lived by nature: the ATO expects most records to be kept for five years after the return they support, and a capital gains position can depend on an acquisition decades earlier. Deleting your history on a rolling schedule would destroy the very thing you are paying us to maintain.

If you close your account we delete your personal information and your transaction data, except where we are required to keep something — for example, billing records retained under tax law.

Getting your data, and getting rid of it

Access and export. You can export at any time, without asking us: every report is downloadable as CSV, and the full transaction ledger with it. There is no lock-in and no export fee. Choosing Grubless is not a decision you cannot reverse.

Correction. You can edit entities, sources, categories and transactions directly in the app. If something we hold about you is wrong and you cannot correct it yourself, tell us and we will.

Deletion. Under Account in the app you can delete your data, or delete the whole account, yourself. Both take effect immediately rather than after a waiting period, and there is no undo. Deleting your data removes every source and transaction, and everything derived from them, but keeps the account so you can import again; deleting the account removes it along with every entity that only you own. You can also email privacy@grubless.io instead, and we will do it within 30 days.

Complaints. Write to privacy@grubless.io and we will respond within 30 days. If you are not satisfied with how we handle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au — that route exists whatever we say, and we would rather you knew about it.

If something goes wrong

We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a breach we will assess it within 30 days, and where it is likely to result in serious harm we will notify both you and the Australian Information Commissioner as soon as practicable.

How we secure the data in the first place, and how to report a vulnerability you have found, are on the security page.

Cookies

One cookie, and it is the session that keeps you signed in. It is HttpOnly, Secure and SameSite-restricted, so it cannot be read by scripts and is not sent from other sites.

There are no advertising cookies, no tracking pixels and no third-party analytics on this site or in the app. That is why you have not been asked to dismiss a consent banner: there is nothing to consent to. Your theme preference is stored in your own browser and never sent to us.

We do run error monitoring (Sentry, listed above), and it is worth being precise about the difference. It records that something broke — the fault, the line of code, and the account ID it happened to. It does not record what you did, what you looked at, or what you hold. There is no behavioural tracking and no profile of you anywhere in it; it exists so a failure reaches us without you having to report it.

Changes to this policy

If we change this policy materially — a new category of information, a new recipient, a new purpose — we will tell account holders by email before it takes effect, not by silently updating a date at the top of a page. The version and effective date are shown on this page so you can tell what you agreed to.