Privacy

Last reviewed 5 September 2026 · How Tax Letters checks its facts

The short version: Tax Letters is built to know as little about you as possible.

The longer version is this page: what the tools send, what your file stores if you create one, and what is deleted when you ask, while Tax Letters still stays useful about your tax position. The controller for any personal data is Tax Letters' operating company. To reach us about anything on this page, use the get help form.

The checkers: your device does the work

• The Simple Assessment checker compares your figures on this device. Nothing is sent to Tax Letters unless you choose to email the dossier, save to your file, set a reminder, or join the Watch waiting list, and at each of those moments the screen says exactly what will be sent. Choosing the dossier emails your entered figures to you; Tax Letters sends that email and does not keep the figures.
• Safety checks run in your browser before anything is transmitted. Letters with fraud-investigation markers, distress language or scam hallmarks are handled entirely on your device: that text is not sent to Tax Letters unless you later, explicitly, choose to save it to your file.
• The letter checker strips identifying details first. Reference numbers, National Insurance numbers, postcodes, emails, phone numbers and bank details are redacted before anything else happens, and you see what was removed. Nothing you paste is stored unless you choose to save the check, and what would be saved is the redacted version, shown to you first.
• If the server-assisted mode is on, the redacted text is processed to identify the letter type, including by Anthropic's AI service. Anthropic does not use this material to train its models and deletes it from its systems within 30 days by default; limited exceptions exist, for example where material is flagged for safety review. Tax Letters keeps only an anonymous count of which letter types are identified.

Your file, if you create one

• Everything in your file exists because you chose a capture: email me a copy, save to my file, set a reminder, or join the Watch waiting list. Each creates the same sign-in (your email, nothing else; no passwords exist).
• What a saved check stores: the letter type, tax year, the outcome per line (never your figures), your dates, your set-up answers, and, for pasted letters you chose to save, the redacted letter text. Stored letter text and documents are encrypted at the application layer, over and above disk encryption.
• Documents you add (photos and PDFs of letters) are stored encrypted and served download-only from a separate files address, through short-lived links minted for you when you are signed in.
• Letters can carry sensitive details, including health or other personal circumstances. The first save says so and asks for your agreement before anything is kept.
• Your file is never purged. It stays until you delete it. Sign-ins last about 30 days per device and can be revoked from settings, everywhere, at once.
• Delete really deletes. The delete button in settings removes your checks, stored letter text, documents, reminders, sign-ins and the watch list entry for your address, immediately, with no archive. Tax Letters keeps no backups of its own. Your documents go from storage outright; the database platform keeps a point-in-time restore window of up to 30 days, so a database copy can exist there that long. What survives is anonymous aggregate counting that was never joined to you.
• Export is one click (plus an email confirmation): a single download with every check, stored letter text, your dates and your documents.
• Helper files: if you manage letters for someone you help, their file sits under your sign-in, separate from anything of yours, with a declaration each time that they know. If they have an email address we send them a short note that the file exists; if they have none, we record that no note was sent. Their file can be handed over to them later.

Tax Letters for Practices

An accountancy practice can use Tax Letters to see the HMRC letters its clients receive. The practice signs in with its own email and enters its clients' names and, if it chooses, their email addresses and its own references. Each client then has two ways to send a letter in, and what Tax Letters holds depends on which one they use.

• Sent from the client's link, the whole letter, text or photograph, is locked on the client's own device to a key that only the practice holds. The practice's private key is stored only wrapped under a passphrase Tax Letters never receives. Tax Letters keeps the client's name as the practice typed it, the letter type, the letter's own date, any statutory deadline and a priority flag, plus the locked letter, which it cannot open. For a forwarded email it also keeps the address it came from, so the practice can see who sent it. It does not keep the email's subject line.
• Forwarded by email, the letter reaches Tax Letters readable, because there is no device in between to lock it. Tax Letters reads it once, on arrival, to identify the letter, read its date and start the statutory clock. It then locks the whole letter, and every attached photograph or document, to the practice's key in the same way as the link, and discards the readable copy. The letter is kept, locked; Tax Letters keeps nothing it can read. If the practice has not yet set up its key, the email is refused and the sender's mail app is told, rather than the letter being kept somewhere unsafe.
• Mail sent to an address Tax Letters cannot place is refused, so the sender's mail app shows a bounce with the reason. Its sender, recipient and subject line are recorded, so that a letter is never lost silently.
• The letters are held for the practice. The practice chose to use Tax Letters for its clients' letters and is the one that tells them so; the client's link page also says in plain words what happens to what they send. Tax Letters keeps the letters until the practice deletes them, and uses them for nothing else.
• Deleting a practice file removes every client, every letter and every document under that sign-in, immediately.

Older anonymous check links

A check saved with one of Tax Letters' earlier anonymous links stores the letter type, tax year, outcome, the amount as a band, and your dates, keyed to an unguessable link, with an optional reminder email held in a separate table. Those anonymous checks delete themselves 90 days after their deadline passes; your signed-in file, above, does not. Deleting one removes it, its reminders and its email immediately.

Watch

Watch is not live yet; what exists today is its waiting list. Joining it stores your email and the fact you asked, and joining from a check also stores that check's summary: the outcome, line statuses, dates and your set-up answers, never your figures. It sets your deadline reminders where a date exists. Deleting your file removes the waiting-list entry for your address too. Leaving the list deletes rows, not just a sending flag.

Enquiries and applications

If you send an enquiry, Tax Letters holds your email and what you wrote until the enquiry is answered, and deletes it 90 days after you send it, answered or not. Enquiries are reviewed with Vision Consulting, Tax Letters' founding review partner, and the form says so where you send it. A Tax Letters Private Client application holds your answers and email while it is reviewed, and deleting your file also deletes any application made with that email. Beyond that, nothing is passed to anyone else without asking you first, by name.

Analytics without surveillance

Tax Letters records de-identified product events: which tool was used, which step, which outcome, which offer was shown. No advertising pixels, no cross-site trackers, no fingerprinting, and nothing that joins an event to a person. There is no cookie banner for tracking because there is no tracking; the only cookie that exists at all is the sign-in cookie for your file, which does nothing until you create one.

What Tax Letters cannot do

Because of the design above, Tax Letters cannot look up "your file" from your name (only from your email, which only you can confirm), cannot read your figures back out of a saved check (statuses and bands are all a check stores), cannot hand anyone a list of its users' tax positions, and cannot recover a deleted file. We think the right way to protect data is to hold as little of it as possible, encrypt what you ask us to hold, and delete fully when you ask. The one moment Tax Letters sees a letter's words is a forwarded email, once, on arrival, before it is locked to the practice, as described above.

Your rights

You can ask for a copy of what Tax Letters holds about you (the export button does this without waiting for us), ask for correction or deletion (the delete button in settings does this immediately), or object to processing, through the get help form. You can also complain to the Information Commissioner's Office at ico.org.uk. Tax Letters does not sell personal data, full stop.