>The application is specifically meant to track this information
So a privacy risk is the cost of doing business. Knowing about it upfront and consenting to the data collection doesn't negate that. If H&R block stores all of the data you give them forever, that's a privacy concern because they could be hacked or they could (depending on relevant laws) change their mind and decide to share or sell some of that data in the future.