Privacy and security

A FIRE file holds the name, address and taxpayer identification number of everyone the payer paid. Sevenfifty never sees any of it. This page says what happens instead and how you can check.

What happens to your file

When you open a file, your browser hands it to the page's JavaScript, which reads it in memory inside the tab. The returns, the checks and your edits all stay in that tab. When you close or reload the tab, everything is gone.

The page sets no cookies and keeps nothing in your browser's storage. There are no accounts and no ad trackers, and no fonts or images from anywhere else.

What the page loads

Its own files: the HTML, one stylesheet, the scripts that read FIRE files and write IRIS files, and an icon. The sample file is one more script, loaded only when you ask for it. You can read every one of these scripts; they are plain, unminified JavaScript.

To count visitors I use Cloudflare Web Analytics, a small script from Cloudflare that records page views and which pages were opened, without cookies, without storing your IP address and without any identifier that follows you from one visit to the next. It is the only script from outside the site. Cloudflare also serves the pages and runs the sign-up server, so like any web host it sees your IP address and browser details when it does that. Cloudflare's own handling is covered by its privacy policy.

The email form

The page has one form, the one that asks for your email address so I can tell you when the export opens. When you send it, a small server of mine (a Cloudflare Worker) checks that the address looks like an email address and stores three things in Cloudflare's key-value storage under my account: the address, which page you signed up on (this one is recorded as "sevenfifty"), and the date and time. That is the whole record. Nothing from a FIRE file you have open goes with it.

I use the address to email you when the export is ready. I don't add it to any other list, and I don't share it or sell it. If I decide not to open the export, I delete the list.

To stop bots filling the list, the server counts how many sign-ups come from one connection. The counter is keyed by a salted hash of your IP address, not the address itself, and it deletes itself after about an hour. The form also has a hidden field that people never see; anything typed into it is thrown away. The server's request logging is switched off.

To have your address removed, or to ask what is stored, email jonathonwager@plaugstudios.com. I'll delete it and tell you when it's done.

The security policy

Every page is sent with this Content-Security-Policy. Browsers enforce it on the page: connect-src lets a script reach the sign-up server and Cloudflare's visitor counter and nothing else, form-action lets the one form post only to the sign-up server, and script-src allows the site's own scripts and Cloudflare's counter script.

default-src 'none';
script-src 'self' https://static.cloudflareinsights.com;
style-src 'self';
img-src 'self';
connect-src https://plaug-waitlist.jonathonwager10.workers.dev https://cloudflareinsights.com;
base-uri 'none';
form-action https://plaug-waitlist.jonathonwager10.workers.dev;
frame-ancestors 'none';

Checking it yourself

Open your browser's developer tools on the Network tab, reload the page, then open a file and work through it. Apart from the page's own files and Cloudflare's page-view count, you will see no requests. You can also load the page, disconnect from the internet, and open files as normal.

The files you download

When the export opens, the CSV files will have to contain full TINs, because IRIS needs them. Keep them the way you keep the FIRE file, and delete them once IRIS has accepted the returns. The report that comes with them shows only the last four digits of each TIN.

Questions

Write to jonathonwager@plaugstudios.com. I answer security questions myself, usually within a working day.