What we keep, and for how long

What happens the moment you ask

All of this is erased as soon as your request is confirmed. Not hidden, not flagged, not moved somewhere quieter — erased.

• Your sign-in sessions and any connected accounts, so you are signed out everywhere and no third-party sign-in still points at us.
• Your two-factor secret. A one-time-code seed is a credential, not a record.
• Every uploaded slip image — the photographs of your T4. A picture of a slip with your Social Insurance Number on it is the highest-risk thing we hold, so it goes first and it goes completely: every stored copy, every earlier version, every thumbnail we generated from it.
• The bank account details you gave us so a refund could be deposited.
• Your support conversations, with everything you typed into them.
• Error reports your browser sent us when something broke.
• Any checkout you started and never finished.
• Any return you never downloaded, never paid for and never completed, along with everything attached to it.

That last one matters more than it sounds. A return you never downloaded is erased outright, because we never handed you anything and so there is nothing about it the law requires us to keep. Most deleted accounts contain nothing else, and those accounts are erased in full — the account record itself included. Deletion for those filers is simply deletion.

What has to be kept, and why

One fact changes the answer: whether you downloaded a return, paid for one or completed one. Any of those three means we prepared a return for you, and the Income Tax Act requires the records of a prepared return to be kept and produced to the Canada Revenue Agency on request. We cannot switch that off, and neither can you.

So for a return you downloaded, paid for or completed, four things are kept for six years: the completed return itself, the record that you downloaded it, the payments and refunds attached to it, and any tax information consent you signed.

Six years is the period the Income Tax Act sets, at s. 230(4): records have to be kept until six years after the end of the taxation year they relate to. It is one number for every filer, we do not shorten it for anyone, and we do not pad it either — a record we are keeping without a rule that says to is a record we should have deleted.

A consent you signed is kept on the same footing, because it is the only evidence that a disclosure of your tax information was authorised by you, and a disclosure whose authorisation has been erased is indistinguishable from one that was never authorised at all. Withdrawing a consent is recorded as a withdrawal and stops the disclosure at once; it is never recorded by rubbing the signature out. You can read both consents in full on the tax information consents page — both are still drafts awaiting legal review, so nobody has been asked to sign one yet and no disclosure to an AI vendor has been made by anyone.

When the last of it goes

The six years run from 31 December of the tax year the return relates to — not from the day you filed it, and not from the day you asked to be deleted. A return for the 2026 tax year is therefore erased after 31 December 2032.

A consent runs on its own clock, because it authorises disclosures right up to the moment you take it back: six years from the day you signed it, or six years from the day you withdrew it, whichever is later.

When the longest of your clocks expires, the remainder goes with it, including the name and email address described next. Nothing is kept indefinitely except the audit log, and the audit log does not contain your return.

What is left behind, and why it cannot reach you

If anything at all has to be kept, we cannot make your account disappear, because a kept consent has to say whose consent it was. A signed consent identifying nobody proves nothing. So instead of clearing your identity we move it: your name and email address are copied into a set-aside field that nothing in the running product ever reads, and the live address on the account is replaced with one at a domain that does not exist.

Four things follow from that, and each one is the point of doing it this way.

• It cannot be signed into. The sessions, connected accounts and two-factor secret are gone, the address is no longer a verified one, and the substitute address resolves nowhere.
• It cannot be emailed. That holds by construction rather than by a setting somebody could flip back: every path that sends you mail reads the live address, and the live address is the dead one.
• It does not stand in your way. Signing up again with the same address next season creates a genuinely new account; the old record is not revived, and the two never touch.
• Staff cannot browse it. Deleted accounts do not appear in ordinary support or admin listings, and an operator who explicitly asks to see one writes an audit record by asking.

Two records nobody at Hypertax can delete

The consents you signed and the audit log are protected by the database itself, not by a policy someone follows. The application has no permission to delete a row from either table. If some future piece of code tries, the database refuses and the attempt fails loudly rather than quietly succeeding.

That is a feature. A record proving a disclosure was authorised is worth nothing if the same software that made the disclosure can quietly remove the proof afterwards. Clearing those rows when their six years are up is a deliberate, logged operation carried out by a person, never a background job. The audit log itself holds who did what and when — never your figures, your documents or your messages, which is what makes keeping it defensible at all. The privacy policy covers what goes into it.

How to ask

You start a deletion from your account settings. We check it is really you first, because an account deletion a stranger can trigger is an attack rather than a right. Then, before you confirm anything, we show you which of the two categories above your own data falls into — the actual sentences, on the screen, not a link back to this page. If everything you have is in the first category, we say so, and the deletion is complete.