Privacy

Your salary is never stored. Not encrypted, not hashed — never sent at all.

What is recorded

When a calculation settles, the site records what you are working out, never who you are: the state, the salary bracket, the filing status and pay frequency, which calculator you used, roughly how many hours a week if you entered them, and the hour of day. If you use the optimizer it also records your contribution rate as a band, and if you pick a job to compare against it records that occupation code.

Alongside that it stores the country, region and city your request came from, taken from Cloudflare’s edge metadata. Cloudflare also offers latitude and longitude; we deliberately do not read them. A city name is coarse — a coordinate pair is a precision a tax calculator has no business having.

Brackets are wide on purpose — “$75k–$100k”, not “$83,412”. The bucketing happens in your browser before anything is transmitted, which means an exact salary never exists on the server for anyone to leak, subpoena or sell.

What the analytics never record

• Your exact salary. Bucketing happens in your browser, before anything is sent.
• Your IP address. It is never read and never stored.
• Any device fingerprint.
• Any location you did not deliberately give. Coarse geography comes from Cloudflare’s edge and is never finer than a city; your device’s own location is never read unless you press the button that asks for it, and even then the coordinates never leave your browser — see below.
• Anything you typed as free text — there are no free-text fields.
• Who you are. The analytics carry no user id and are not joined to an account, even if you have one. Signing in does not change what is measured.

There are no third-party analytics scripts, no advertising trackers and no social pixels. The typeface is served from this domain, not from a font provider, so nobody else sees your browser fetch it. There is no advertising or tracking cookie and nothing to consent to, which is why there is no cookie banner. If you sign in there is one cookie, described below.

Your neighbourhood, if you offer it

The calculator can tell you where your pay sits among the tax returns actually filed where you live, from the IRS’s published ZIP-code statistics. That needs to know roughly where you are, so it asks, and it is the only field on this site that does.

• Three digits, never five. A full ZIP code can be a single building. The first three are a sectional centre facility — hundreds of thousands of people. The server rejects anything that is not exactly three digits rather than shortening it.
• If you share your location instead, the coordinates never leave your browser. They are rounded and matched to a ZIP3 area on your own device, and only those three digits are sent. We deliberately do not send even the rounded pair: it would be about ten times finer than the city-level geography this site already has, and the feature works identically without it.
• It is never on by default, the calculator is complete without it, and nothing else changes if you decline.
• Published only in aggregate, and never for an area with fewer than twenty calculations behind it.

One honest limitation, because it affects what the answer means: in dense cities several ZIP3 areas overlap — Manhattan is 100, 101 and 102 at once — so the location button can land on a neighbouring area. The area it picked is always shown, and you can change it.

Why record anything?

Aggregate patterns — which states people check, which salary ranges dominate — are genuinely useful and get published openly on the data page. That is only defensible because the data is anonymous by construction rather than by promise.

Opting out

Use the switch below. It takes effect immediately and applies to every page. You can also add ?notelemetry=1 to any URL, or ?notelemetry=0 to undo it.

The full write-up of what is collected, how each band is defined and what the dataset cannot tell you is in the telemetry methodology.

Accounts

Optional, and the calculator is complete without one. Everything above describes the site whether or not you have an account. This section is the whole of what changes if you make one.

There is no password. You give an email address, we send a link, opening it signs you in. The link works once and expires in fifteen minutes, and we store only a hash of it — a copy of our database does not yield a working link.

What an account stores, and nothing else:

• Your email address, so the link has somewhere to go.
• The exact figures you press “Save this figure” on, with the state and tax year. This is the one place on the site that keeps an exact amount rather than a bracket, and it only happens when you ask for it. It is your own record, shown to you and to nobody else, and it is never mixed into the anonymous statistics on the data page.
• One cookie, tha_session, which says only that you are signed in. It is HttpOnly, Secure, and lasts thirty days. It is not used to track anything.

Delete any saved figure from your account page, one click each, or delete the whole account there — email address, every saved figure and your settings, gone for good. Signing out clears the cookie. We do not sell any of this, do not advertise against it, and there is nobody to share it with — there are no third parties in this product at all.