Privacy

No account is required to use any calculator. Your salary, hourly rate, hours, tips, bonus, filing status and deduction amounts are processed in your browser. The paycheck calculator also keeps a temporary draft in this tab's sessionStorage so state and language navigation can preserve your entries. Browser session restoration may retain that draft until the session is cleared. These entries are not written to our servers, not logged, and not sold or shared.

You can use the guest tools without creating an account. Creating an account does not automatically save your form entries. When you explicitly save a company or employee profile, or archive an eligible document, that information leaves your browser and is stored in your private company workspace. Company and employee profiles, recipient labels and saved PDF contents are encrypted on our servers. Profile forms collect only the last four digits of an employee's Social Security number, not the full number.

Access requires a confirmed email, authenticator verification, a current session and active company membership. Document type, dates, status and year-to-date ledger amounts are stored as private account records protected by company access rules. The ledger is a document summary; it does not establish that payroll was paid or taxes were filed. Account and recovery pages do not load our public-page analytics.

Saved account documents have a default access period of 365 days. Expired documents cannot be opened through the account; this is not a promise of automatic database erasure at that date. Deleting a saved document removes its stored PDF and hides it from the vault. Its metadata and any finalized ledger history may remain for record integrity; deleting a PDF does not reverse payroll totals. Company and employee profiles remain until separately removed. Contact support for account data requests. The separate seven-day paid-delivery period described below is unchanged.

Signing out clears account session credentials and account-derived browser drafts, while unrelated guest drafts and purchased-document access remain in that browser. Emailing a saved PDF requires your explicit action and sends it only to your verified account email. No company, employee or financial details appear in public QR results.

The calculation engine ships to your browser and executes there. Nothing you type is transmitted in order to produce a result.

QR Beta exports are generated on our secure PDF server. For paystubs, this uses the existing paid export authorization. Employment letters use this service only when you select the QR option; the local download remains available. An encrypted PDF copy expires after 7 days and is removed by retention cleanup. Verification records retain only the random code, document type, file fingerprint, creation time and revocation status, without company names, employee details or financial amounts. The verification page hashes your selected PDF on your device and does not upload it. Origin and byte integrity do not verify employer statements, income or tax compliance.

Paystub draft editing and calculations run in your browser. Paid paystub delivery sends the document to our delivery service and stores an encrypted copy for 7 days, after which it is deleted. When you buy Paystub credits, we store the purchase email, Stripe payment and checkout identifiers, credit balance, document-unlock identifier and transaction history. We use this information only to confirm payment, prevent duplicate credit use, support refunds and disputes, and email your purchased PDF to the address used at checkout.

For W-2 and 1099-NEC purchases, the completed form and every tax-form entry remain in the browser. Checkout sends the receipt email, product, price, currency, Stripe checkout identifiers, and a random document-entitlement reference needed to confirm that specific purchase. The receipt contains no completed form and no form is attached. If analytics is accepted, the product and checkout-stage metadata described below may also be counted; tax-form entries are never analytics fields.

Entering an email address never unlocks, downloads or prints a paid document in your browser, and never reveals whether a purchase exists. Resending requires the valid purchase authorization in the original browser as well as the checkout email. If these match an eligible purchase, the PDF is emailed as an attachment to the address stored on that purchase and nowhere else. Requests are limited to one email per purchase per minute, and we store only a one-way hash of the address used to request it. PaycheckVista does not receive or store your card number; Stripe handles payment details.

We use Google Analytics 4 to understand how many people visit and which pages they use. It records the page address, referring site, approximate location, and device or browser type. It never receives anything you type into a calculator: salary, hourly rate, hours, tips, bonus, filing status, tax details and deduction amounts are excluded, and page addresses are sent without query strings so no entry can be attached to a visit.

Analytics cookies stay switched off until you press Accept on the cookie banner. If you decline, or simply ignore it, no analytics cookies are set and no measurement data is sent. Your choice is remembered in your browser, and clearing your browser storage brings the banner back so you can change it.

When analytics is accepted, we also count anonymous steps of the buying journey on our own servers: which tool page was viewed, whether a document form was started or completed, whether checkout started, and — from our payment records — whether a purchase was completed and its PDF emailed. These counts hold only the product name, plan, price, page path, a broad device type and a traffic-source category such as Google, Bing, direct, referral or social. They never hold your email address, name, Social Security or employer number, addresses, document contents, payment references or the full address of the site that referred you. Campaign labels and the first page you landed on are kept for 30 days and then removed.

If you decline analytics, browser measurement and traffic attribution stay completely off: no campaign labels, landing page, referring-site category or device type is recorded anywhere. What still happens is accounting for what we sold and delivered: when a payment is confirmed by our payment provider, we count the product type, plan, price, currency, the type of event and the time it happened. That count holds no browser or session identifier, no attribution, no payment or purchase reference, no email address, no IP address and no customer details. Our database uses a one-way internal digest so a repeated payment notification or a page refresh cannot be counted twice; that digest is never shown, returned or included in any export. Visiting the confirmation page is never treated as a purchase — only a confirmed payment is.

How long these counts are kept: visitor measurement and attribution data are deleted automatically after 14 months. Accounting counts of sales and deliveries are deleted automatically after 24 months, after being summarised into monthly product totals that cannot be traced back to a visitor, a visit, a payment or a purchase. A cleanup runs once a day on our servers.

Completed purchases, PDF delivery and refund records are operational records we must keep to deliver and support what you bought, so they exist whether or not you accept analytics. We do not use session replay, heatmaps, browser fingerprinting or third-party advertising trackers.

Any additional feature that sends form details off your device will be described here before introduction. Optional account saves and eligible document emails already use the server processing described above; guest calculations remain available without an account.

Sections on cookies, analytics, third-party processors, retention periods and your rights under applicable state privacy law are still to be drafted with counsel.