Privacy Policy

1. Overview

GrantExtension is an IRS tax-extension e-filing service. We collect only the information needed to prepare and transmit your extension request (Form 4868, 7004, or 8868) and to process payment. We do not sell your personal information.

2. Information we collect

• Account data: name and email used to create and secure your account.
• Filing data: the information required for your extension, which may include your address, Social Security Number or Employer Identification Number, entity/return type, and tax estimates.
• Saved clients: if you choose to save a business, nonprofit or person you file for, their name, address, Social Security Number or Employer Identification Number, return type and the other details you enter, so your next extension for them starts filled in.
• Client imports: if you upload a CSV file of clients, the details in each of its rows, which we check and keep only until you import them.
• Filing security information: when you start a filing and when you submit it, we record your IP address, the date and time, and a device identifier for your browser. For business and nonprofit extensions (Forms 7004 and 8868), IRS e-file rules require us to send this information to the IRS with your return. For every filing, we also use it to help prevent fraud.
• Waitlist data: if you ask to be told when filing opens, your email address and, if you choose to tell us, which form you need, who you file for, and roughly how many extensions you file each season.
• Payment data: processed by our payment provider, Stripe. We do not store full card numbers on our servers.
• Security and activity logs: a record of account and filing activity, such as sign-ins, changes to a filing, and each time our staff view a filing. Each entry notes what happened and when, and the IP address and browser involved. It does not include the contents of your return, and IP addresses in it are encrypted.
• Technical data: standard log and device information used to operate and secure the service.

3. How we use your information

We use your information to prepare and e-file your extension with the IRS, process your payment, send filing confirmations and service notices, provide support, and meet legal and recordkeeping obligations. Sensitive identifiers such as your SSN or EIN are used solely to prepare and submit your filing.

We email you a link to confirm your email address when you create an account, and a six-digit code each time you sign in. That code is the second step of signing in, which IRS e-file rules require before you can file or see saved tax information.

4. How we protect it

We transmit data over encrypted connections and submit filings through authorized IRS e-file channels. Your SSN or EIN is encrypted at rest, is never stored in your browser, and is shown only masked after filing. Access to filing data is limited to what is necessary to provide the service.

5. Cookies, analytics, and security checks

We don't use advertising cookies. We set two cookies of our own, both needed for the service:

• Sign-in cookie: keeps you signed in. It expires within hours and can't be read by scripts on the page.
• Device cookie: set when you start or submit a filing. It holds a random value; the device identifier we record (and, for business returns, send to the IRS) is a one-way scrambled version of it. It lasts up to two years.

Your browser also remembers whether you chose the light or dark theme.

We measure site visits with Cloudflare Web Analytics, which does not use cookies. It gives us totals, such as page views and referring sites, not a profile of you.

When one of our forms shows a security check, that check is Cloudflare Turnstile. It helps us tell people from automated bots, as IRS rules require us to guard against bulk filing. Cloudflare processes information about your browser to run the check, and our server sends Cloudflare the result and your IP address so Cloudflare can check it.

6. How long we keep it

We keep what's needed to file your extension and prove it was accepted — the return as transmitted, the IRS acknowledgment, and your payment record — encrypted, for three years after the return's due date, then delete it. Your SSN or EIN is never shown in full after filing.

If you start an extension and never pay for it, we delete it 12 months after you last changed it.

Account details (your name and email address) are kept while your account exists. Each filing stays in your account until its records are deleted on the schedule above.

If you save a client's details to file for them again, we delete that saved client two years after you last use or change it, or one year after you archive it if that comes first, and when your account is deleted. A filing you made for a client keeps its own copy of their details for as long as the filing is kept.

If you import clients from a CSV file, we don't keep the file itself. We keep each row's details, encrypted, only until you import that row or for 7 days after you last change the import, and then delete them. The clients and draft extensions you import are kept just like the ones you add yourself.

Email addresses collected for filing-open notifications are kept until twelve months after filing opens. If we email you about GrantExtension, IRS rules require us to keep a copy of that email and the list it went to until the end of the following calendar year, so your address may be kept until then. If you ask us to stop, we will stop emailing you right away.

We keep security and audit logs, which record account and filing activity but not the contents of your return, for as long as we operate the service, to protect your account and meet IRS security requirements.

7. Sharing and service providers

We share information with the IRS to file your extension. We may disclose information if required by law. We do not sell personal information.

These service providers help us operate, under agreements that limit their use of the data:

• Stripe processes payments.
• DigitalOcean hosts our servers and database.
• Cloudflare delivers our website, protects it from attacks, and provides the analytics and security check described above.
• Resend sends our emails, such as confirmation links, sign-in codes, and filing updates.

8. Your choices

You may access or update your account information, or request deletion of data we are not legally required to retain, by contacting us. Depending on your location, you may have additional rights under applicable privacy laws.

9. Contact

Questions about this policy? Reach us at [email protected] or via our contact page. GrantExtension is operated by AdroitCode LLC, Saint Paul, MN.