Privacy

The short version

Do I Owe Tax? runs mostly as a static site, with no database and no accounts. The answers you give the checker — which platforms you sold on, roughly what you took, whether items were your own — are stored only in your browser's local storage, on your own device, so you can leave the page and come back to your progress.

Nothing you tell the checker leaves your browser unless you ask us to email your report. If you never use that option, we never see your answers and have nowhere to send them even if we wanted to. If you do use it, "When you ask us to email your report" below sets out exactly what's sent, to whom, and for how long. (This is specifically about the checker's answers — if you paste a licence key into the recovery box on the report page, that's sent to Lemon Squeezy to look it up, whether or not you go on to email anything; see "The third parties" below.)

Cookies

We don't set any cookies ourselves. The site works entirely from files served to your browser, with your checker answers held in local storage rather than a cookie.

When you ask us to email your report

Once you've unlocked a paid report, the report page offers to email you a copy as well as letting you download it. That's optional — the download button never depends on it — but using it does send data off your device, so here's exactly what happens:

The email address you type, and the finished PDF report (built from the answers you gave the checker), are sent to a small Cloudflare Worker we run for this one purpose. It checks your licence key is genuine, then hands the address and the PDF to Resend, our transactional email provider, which actually sends it. The Worker doesn't write either of those anywhere — no database, no log file — it holds them only for the length of that one request and then they're gone.

Resend keeps a copy of what it sends — including the attached report — for 30 days, after which it's deleted; if we ever stopped using Resend, anything still held would be deleted within 90 days of closing that account. That's Resend's own published retention policy (resend.com/security, checked 23 September 2026), not a guess.

If you leave "Email me when I add new tax tools" ticked, your address is also added to a mailing list we hold with Resend, so we can tell you when we launch something new. That's separate from the one-off report email above: it stays on the list until you ask to come off it — reply "unsubscribe" to any email from us, or email hello@doiowetax.co.uk — or until we remove it ourselves; it isn't automatically deleted after 30 days the way a sent message is. Leave the box unticked and none of this happens; you still get your report either way.

The third parties

Lemon Squeezy handles payment if you choose to buy the paid report. Nothing is requested from Lemon Squeezy until you press the Buy button: their checkout script isn't loaded on this or any other page before then, so browsing the site doesn't put you in front of them at all. When you do press it, you're taken to Lemon Squeezy's own checkout to complete the purchase — your card details go to them, never to us, and their own privacy policy covers that payment step.

Umami provides cookieless, privacy-respecting analytics, so we can see roughly how many people visit the site and which pages are useful, without tracking individuals or setting cookies. It doesn't collect your checker answers, your email address, or anything else you typed in. If you import a sales file on the takings step, Umami is told only whether the import worked and which platform's export format it looked like — never the figures, rows or other contents of the file.

Resend sends the report email and holds the "new tools" mailing list, only if you use "Email me a copy" on the report page — see the section above for exactly what it receives and for how long it's kept.

Cloudflare, who already serve every page of this static site, also run the small Worker described above. So if — and only if — you use "Email me a copy", Cloudflare is briefly a processor of your address and your report's contents on their way to Resend, rather than just the host of some static files.

We don't use any other analytics, advertising or tracking tools, and we don't sell data to anyone or share it beyond what's described on this page.

The network calls this site can make are: the Umami analytics script; if you choose to buy the report, Lemon Squeezy's checkout and its licence check at api.lemonsqueezy.com (used to unlock your report on the confirmation page); and, only if you use "Email me a copy" there, one call from your browser to our Cloudflare Worker, which itself calls Lemon Squeezy again (to re-check your licence) and then Resend. The Newsreader and Source Sans 3 typefaces are self-hosted with the rest of the site's files, not loaded from Google Fonts or any other third party.

Your licence key is also stripped out of the address bar as soon as the report page has read it, so it never reaches the analytics, your browser history, or a screenshot.

Data controller

Do I Owe Tax? is a product of Fishlight Ltd (company number 04418521, registered in England and Wales, registered office 20-22 Wenlock Road, London, England, N1 7GU), which is the data controller for the data this site handles: the analytics described above, any payment details you provide directly to Lemon Squeezy, and — only if you use "Email me a copy" — the email address you type and the report sent to it.

Where your data goes: international transfers

Resend and Cloudflare, the two providers behind "Email me a copy", are both US companies. A report holds UK income figures, so using it sends personal data outside the UK. Both rely on recognised transfer safeguards — just different ones.

Cloudflare's main safeguard is its certification under the UK Extension to the EU-U.S. Data Privacy Framework: a US government scheme that lets a certified company receive UK personal data directly. If that certification ever lapsed, its contract falls back to the UK's International Data Transfer Addendum to the EU's Standard Contractual Clauses.

Resend relies on the Clauses first. Its Data Processing Agreement (section 6.2) commits to them for every transfer out of the EEA, certified or not. Its Data Privacy Framework certification (section 11) is an extra safeguard on top, not the main one. In its own words:

"The SCCs stand on their own and are not conditioned on DPF certification status."

Checked against Resend's Data Processing Agreement and security page, and Cloudflare's Data Processing Addendum, on 23 September 2026. The official register, dataprivacyframework.gov, lists both as UK Extension participants (Cloudflare also under the EU-U.S. and Swiss-U.S. frameworks); both currently show "Active – Re-certification under Review" — the normal state during a routine annual renewal, not a lapse.

Why we're allowed to do this

Emailing you the report you bought is processing we do to perform the contract you made when you paid for it — you asked for it, so we need your address and the report itself to deliver it. Adding you to the mailing list (only if you leave the box ticked) is processing we do on the basis of legitimate interests: the ICO's PECR soft opt-in rule is what lets us send that kind of email without a separate consent checkbox in the first place (see "The third parties" above), and telling existing customers about new, similar products is a legitimate interest of ours that doesn't override your own right to object, which you can exercise at any time — see below. The cookieless analytics described above run on the same basis: understanding how the site is used, without identifying anyone.

Your rights

You can ask what we hold about you (access), have anything wrong about it corrected (rectification), have it deleted (erasure), object to processing done on the legitimate interests basis above — which covers the mailing list, and is the same thing as unsubscribing (objection), or ask for a copy of what you gave us in a format you can take elsewhere (portability). There's no self-service system for any of this, because there isn't enough held here to need one: email hello@doiowetax.co.uk and we'll deal with it directly.

If you're unhappy with how we've handled your data and talking to us hasn't sorted it, you can complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.