Security & Data

Authentication is provided by Supabase Auth. Accounts may use email/password or optional Google sign-in. Google sign-in uses the PKCE OAuth flow. Session persistence uses browser localStorage via the Supabase client. Dedicated callback and password reset routes exchange authorization codes once.

TaxMoov does not receive Google passwords.

Profiles, questionnaire answers and reports are stored in the Supabase-backed database and associated with authenticated users. Administrative tools are limited to designated admin users. Customer report routes are private and configured not to be indexed by search engines.

TaxMoov collects information needed to authenticate users, run questionnaires, generate reports and provide support. Optional Google Analytics 4 and optional Google advertising measurement are consent-gated via Advanced Consent Mode v2 (analytics and marketing preferences). Non-essential Google storage remains denied until granted; tags are configured to avoid sending customer PII, Stripe IDs, report identifiers, or questionnaire/tax content. AI providers are used server-side for narrative and verification assistance.

Users should:

• choose a strong unique password for email/password accounts;
• keep Google Account security settings up to date if using Google sign-in;
• sign out on shared devices; and
• contact support@taxmoov.com if they suspect unauthorised access.

The product relies on:

• Supabase (authentication and application database);
• Vercel (application hosting);
• Google (optional sign-in identity provider via Supabase Auth);
• OpenAI (server-side report narrative generation); and
• Google Gemini (server-side report verification assistance).

This page does not claim bank-level security, unbreakable encryption, SOC 2, ISO certification, or guaranteed security.

Email support@taxmoov.com with a clear description. Do not include passwords or live authentication secrets.

Related pages: Privacy Policy, Cookie Policy.