Privacy

What you type into the calculator is never sent: the arithmetic happens in your browser, and only a salary bracket leaves it. An exact salary is stored in one case only — you made an account and pressed “Save this figure” — and then only for you.

What is recorded

When a calculation settles, the site records what you are working out, never who you are. Every item is a category or a band, never a figure you typed:

• The calculation: state, salary bracket, filing status, pay frequency, which calculator you used, hours a week and overtime as bands, how your pay compares with the state median as a band, and — if you used them — the optimizer’s contribution band and the occupation code you compared against.
• The extras you filled in, as bands or yes/no: the city or county tax you picked, tips and bonus as a band of your pay, the 401(k) you entered as a band of your pay, whether you had a shift differential, and whether you used the HSA, Section 125, union dues, other after-tax, unpaid break or weeks-per-year fields — never the amounts.
• The context: the hour and day of the week on your own clock, the device type (phone, tablet or computer), operating system, browser, and phone brand where the browser reports one, the page language, the page you started on, and where you came from as a site name or campaign tag — never a full address.
• Whether you are signed in, as a yes or no. Not who you are: no account id travels with it.
• Your answers to the optional one-tap questions under a result — whether the figure was more or less than you expected, how you work, an age band — only if you answer.
• A random visit number, made fresh for each visit, so several calculations in one visit can be told apart from several visitors.

Alongside that it stores the country, region and city your request came from, taken from Cloudflare’s edge metadata, and the coordinates of that city rounded to a tenth of a degree — about 11 km, no finer than the city name — which place the dot on the map on the data page. They are Cloudflare’s estimate from your connection, never your device’s own location.

Brackets are wide on purpose — “$75k–$100k”, not “$83,412”. The bucketing happens in your browser before anything is transmitted, which means an exact salary never exists in these records for anyone to leak, subpoena or sell.

What the analytics never record

• Your exact salary. Bucketing happens in your browser, before anything is sent.
• Your IP address. It is never read and never stored.
• Any device fingerprint.
• Any location you did not deliberately give. Coarse geography comes from Cloudflare’s edge and is never finer than a city; your device’s own location is never read unless you press the button that asks for it, and even then the coordinates never leave your browser — see below.
• Anything you typed as free text — there are no free-text fields.
• Who you are. The analytics carry no user id and are not joined to an account, even if you have one. Signing in adds a single yes/no to the record and nothing else.

There are no advertising trackers and no social pixels. There is one page-view counter, described next. The typeface is served from this domain, not from a font provider, so nobody else sees your browser fetch it. There is no advertising or tracking cookie and nothing to consent to, which is why there is no cookie banner. If you sign in there is one cookie, described below.

The page-view counter

Besides the calculation record above, pages load a small page-view counter from avowd-analytics.qharbert.workers.dev, run by Avowd, the studio that builds this site. For each page it sends the page address and title, the page you came from, your screen size and browser language, how far you scrolled, and the text and address of any link you click that leaves this site. It keeps a random session number in your browser’s session storage (gone when you close the tab) and a flag in local storage that says you have visited before. It sets no cookie and records no IP address.

The site itself keeps four things in your browser’s local storage, and nothing else: the language you chose, your opt-out if you set one, the occupation you last compared your pay against, so the comparison is still there next time, and which of the optional one-tap questions you have answered — the question, not your answer — so you are not asked twice. None of them leaves your browser except as the band or code already listed above.

It is never loaded inside the embeddable widget, and never on a page whose address carries a pay figure — a shared link such as ?salary=85000 — so an exact salary cannot reach it. Adding ?notelemetry=1 to any address switches off both this counter and the calculation record in that browser.

Cloudflare, which serves this site, also adds its own Web Analytics script from static.cloudflareinsights.com to pages. By Cloudflare’s description it measures page loads and performance without cookies or fingerprinting. It is kept out of the embeddable widget.

Your neighbourhood, if you offer it

The calculator can tell you where your pay sits among the tax returns actually filed where you live, from the IRS’s published ZIP-code statistics. That needs to know roughly where you are, so it asks, and it is the only field on this site that does.

• Three digits, never five. A full ZIP code can be a single building. The first three are a sectional centre facility — hundreds of thousands of people. The server rejects anything that is not exactly three digits rather than shortening it.
• If you share your location instead, the coordinates never leave your browser. They are rounded and matched to a ZIP3 area on your own device, and only those three digits are sent. We deliberately do not send even the rounded pair: it would be about ten times finer than the city-level geography this site already has, and the feature works identically without it.
• It is never on by default, the calculator is complete without it, and nothing else changes if you decline.
• Published only in aggregate, and never for an area with fewer than twenty calculations behind it.

One honest limitation, because it affects what the answer means: in dense cities several ZIP3 areas overlap — Manhattan is 100, 101 and 102 at once — so the location button can land on a neighbouring area. The area it picked is always shown, and you can change it.

Why record anything?

Aggregate patterns — which states people check, which salary ranges dominate — are genuinely useful and get published openly on the data page. That is only defensible because the data is anonymous by construction rather than by promise.

Opting out

Use the switch below. It takes effect immediately and applies to every page. You can also add ?notelemetry=1 to any URL, or ?notelemetry=0 to undo it.

The full write-up of what is collected, how each band is defined and what the dataset cannot tell you is in the telemetry methodology.

The iOS app

The iPhone app calculates on your phone, with the same tax engine as this website. Your salary is never sent anywhere.

It asks for no permissions up front: no location, no contacts, no tracking. Sharing a result as an image goes through the iPhone’s own share sheet. If you pick “Save Image” there, iOS asks once whether the app may add photos; it can only add, and never reads your photo library.

An account is optional and is the same account as on this website — see Accounts below. In the app you sign in with a six-digit code sent to your email instead of a link. The code works once and expires in fifteen minutes; five wrong codes lock code sign-in for that address for fifteen minutes. The app keeps your sign-in in the iPhone’s Keychain. “Delete my account” in the app removes everything, exactly as it does here.

Anonymous statistics are on unless you turn them off. After each calculation the app sends the same bucketed record as the website — state, salary range (never the salary), filing status, pay frequency, 401(k) range, language, local hour and weekday — marked as coming from the app on iOS, with a random id that lives only until the app is closed. Our server adds country, region and city from the connection, as it does for the website. No device identifier, no advertising identifier, no IP address is stored.

From version 1.3 the app also shows the website’s optional one-tap question under a result. An answer travels with that record as one of the listed choices, exactly as on the website, and the question is not shown at all while statistics are off.

From version 1.3 the app lists this site’s articles under Tax guides. It fetches the list from this site without your sign-in or anything about you, and opens an article in an in-app browser page with the page-view counter switched off.

To turn it off, use the “Anonymous statistics” switch at the bottom of the app. When it is off the app sends nothing at all, not even a record that you turned it off.

On your phone the app stores your language, that switch, counters that decide when to ask for an App Store rating, which one-tap questions you have answered (not your answers) and the last list of articles; if you sign in, also your sign-in, in the Keychain.

Accounts

Optional, and the calculator is complete without one. Everything above describes the site whether or not you have an account. This section is the whole of what changes if you make one.

There is no password. You give an email address, we send a link, opening it signs you in. The link works once and expires in fifteen minutes, and we store only a hash of it — a copy of our database does not yield a working link.

What an account stores, and nothing else:

• Your email address, so the link has somewhere to go, and when the account was made and last used.
• The exact figures you press “Save this figure” on, with the state and tax year. This is the one place on the site that keeps an exact amount rather than a bracket, and it only happens when you ask for it. It is your own record, shown to you and to nobody else, and it is never mixed into the anonymous statistics on the data page.
• One cookie, tha_session, which says only that you are signed in. It is HttpOnly, Secure, and lasts thirty days. It is not used to track anything.

Delete any saved figure from your account page, one click each, or delete the whole account there — email address, every saved figure and your settings, gone for good. Signing out clears the cookie. We do not sell any of this and do not advertise against it. The only outside services involved are the ones named on this page: Cloudflare, which hosts the site and sends the sign-in email, and the page-view counter described above.