Privacy policy

Data and purposes

The web service processes calculator requests on its server to validate inputs, calculate a result and apply daily quotas. Not keeping a server-side calculation history does not mean that inputs are never processed. Full calculator inputs and results are not stored in a personal history or sent to error reporting or product analytics.

Account and security data support sign-in, email verification, access control and abuse prevention. Transactional email uses the destination address and the context needed for that message. API usage and USD billing records support the working API. Payment records support purchases, reconciliation and disputes when payments are used.

Necessary cookies and security

The service uses necessary browser, account-session, quota and security-clearance cookies for access and abuse controls. Account-session cookies are host-only. Security controls may use limited IP-risk and challenge signals; these are not product analytics identities.

Receiving services can see the network IP address needed to deliver a request. Cloudflare Turnstile can process device and browser signals for abuse prevention. We do not promise that no provider ever sees an IP address or uses fingerprint-like security signals. See the provider privacy information below.

Remembered calculator inputs

After valid Calculate or Enter, the browser attempts to save only the twelve input fields in a preference cookie, before the calculation request or security challenge. Merely reading or editing fields does not renew this cookie. Its maximum age is 365 days, subject to browser deletion, eviction or blocked storage.

Saved inputs remain after sign-out and can be restored by the next person using the same browser profile, including a different account. They do not sync across devices. Unsaved edits are not promised to survive navigation. Delete the cookie in browser settings if you do not want this browser to retain those inputs.

The cookie contains no calculation result, operation context, token or calculation history. Restoring fields does not replay an earlier operation or submit a calculation. A new Calculate may use another daily quota slot.

This is a domain cookie: browsers send it to matching subdomains, including API or QA hosts. Inputs therefore do not stay exclusively inside the browser. The API ignores this preference for input and authentication; servers do not persist the cookie in a database, logs, traces, caches, Sentry or PostHog.

Service providers and analytics

AWS hosts the application, database and backups. Resend handles transactional email. Cloudflare Turnstile helps prevent abuse. Sentry is connected for sanitized error reporting, with credentials, cookies, form contents and calculation inputs and results excluded.

Product analytics uses limited explicit anonymous PostHog events for public pageviews and committed product actions, without account identity or a cross-step funnel, without session replay, autocapture, forms, email, IP in stored events, GeoIP enrichment or calculation inputs and results. There is no analytics consent banner or opt-in gate. Analytics availability must not block calculations.

PostHog Free provides a year of accessible event history. That analysis window is not a promise of physical deletion after a year or after 30 days. Transport IP addresses can be visible to providers during delivery.

Stripe provides payment and card processing. When you use payments, Stripe handles card details and the customer and transaction data needed for payment, reconciliation and disputes. Do not put card details in support messages. Any additional billing-location or tax data must have a confirmed purpose and be described before collection begins; this policy does not authorize additional data collection.

Retention and deletion

Technical logs and sanitized errors have a 30-day policy; provider settings and deletion capabilities require separate confirmation. Staff audit has a one-year policy. Database backups have a seven-day policy, with documented incident exceptions. Local cleanup does not establish that a provider has physically deleted its copies.

Financial records have a seven-year policy after the operation or case completes. Records and related references needed for an active balance, an open case or dispute, or safe reconciliation are retained longer when necessary. Financial cleanup preserves those relationships and unresolved obligations; a record is not deleted solely because it is old.

Other policy periods are: nonfinancial audit, technical web usage and completed notification/job metadata, 30 days; calculation deduplication, 24 hours; daily web counters and links, through the UTC day plus 24 hours; minute-rate buckets, two hours; IP-abuse signals, 48 hours; monthly eligibility, through the UTC month plus 24 hours. Unresolved jobs and cases are not deleted just because they are old.

Expired or revoked sessions lose access immediately; physical removal of completed session records has a 30-day policy. Encrypted email-token context is removed after confirmed sending or token expiry. Cleanup procedures exist for application data; external provider tasks remain open until their outcome can be verified. Minimal suppression and replay-prevention references can outlive ordinary email metadata to prevent unsafe redelivery.

Account and privacy requests

Self-service account closure is available in account settings when there is no remaining paid balance or unresolved financial obligation. A paid balance requires a support-assisted resolution and explicit consent to any balance waiver. There is no self-service data export. Contact support for account or privacy requests; a message does not instantly erase an account or provider backups.

After permissible closure, unneeded profile data is scheduled for removal within 30 days, while necessary financial references follow their separate retention rules. Provider cleanup requires verified evidence and may remain unresolved. Backups expire under their own schedule. A separate minimal deletion journal is retained through the relevant backup lifetime plus seven days, or longer for a documented snapshot exception. Recovery reapplies recorded deletions before reopening access, so a restored backup does not authorize restoring a deleted account.