Your miles are yours. We just do the math.
This is written the way we'd explain it at a truck stop, not the way a lawyer would prefer. It is still the real policy.
Last updated July 30, 2026 · applies to iftabuddy.com and the IFTABuddy app
What we collect
What you send us to file with. ELD exports, fuel receipts, trip sheets, photos of paper logs, odometer readings, truck and IFTA license numbers, and the state lines you crossed. If it appears on your return, we hold it.
Who you are.Name, email, phone, carrier name, USDOT number, and the states you're based in. Your password is stored as a one-way hash — we cannot read it, and no one here can tell you what it is.
What you pay with. Card details go straight to our payment processor and never touch our servers. We keep the last four digits, the brand, and the receipt.
How the app is used. Which screens you opened, what errored, and rough location from your IP address (city-level, so we can guess your time zone and default state). No advertising trackers, no session recording, no third-party pixels on the logged-in app.
What we do with it
Four things: prepare your return, keep the audit trail behind it, tell you when something needs your attention, and answer you when you write in. That's the list.
We use anonymous, aggregated numbers — how often ELD formats break, how long a quarter takes to close — to improve the product. Those numbers can't be traced back to a truck or a person.
We do not train outside AI models on your data, and we do not send your records to a third-party model provider for anything other than reading a document you uploaded, at your request, in that moment.
What we never do
Who else touches it
A handful of vendors keep the lights on. Each is contractually barred from using your data for anything but the job named here.
Ask us for the current named list any time and we'll send it: contact@iftabuddy.com
How long we keep it
Filed returns and their audit trail stay for four years and one quarter— the window a state can come back at you. That's the whole point of keeping them.
Delete your account and we remove your records within 30 days, except anything we're legally required to hold. Before you delete, we push you to download your packet first. Once it's gone, we cannot get it back for you.
Your controls
If you're in California, Colorado, Virginia, or another state with its own privacy law, you have the rights that law gives you — access, correction, deletion, and a copy in a portable format. The buttons above already do all of it. Email us if one of them fails you and we'll do it by hand.
Security, honestly stated
Encrypted in transit and at rest. Access inside the company is limited to the people who need it, logged, and reviewed. Support can only see your account after you ask them to look, and only for as long as that takes.
No one can promise a breach is impossible. If one happens and your data is involved, we'll tell you what happened, what was taken, and what to do about it — within 72 hours of knowing, in plain words, by email and in the app.
The rest of it
Cookies. One to keep you logged in, one to remember your preferences, and privacy-respecting counts of page visits. No ad networks.
Kids. This is a tax tool for commercial carriers. Not for anyone under 18.
Where your data lives.United States. If that ever changes, we'll say so here first.
Changes to this policy. Material changes get an email at least 30 days ahead, not a quiet edit. Old versions stay available on request.
Write us and a person — not a form — will answer. If we can't defend a line in this policy, we'll change it.