What we store, what we never touch, and for how long

The four free tools compute entirely in your browser

Every figure you type into one of these four tools stays on your device. Nothing you enter is posted to a server, and nothing is stored — not client-side, not server-side. The formulas each tool uses are printed visibly on its own page, so you can check the math yourself rather than trust a hidden calculation.

• Job offer comparison
• Counteroffer calculator
• Startup equity calculator
• Offer deadline request

This tool computes entirely in your browser. Your figures are never sent to our servers, and nothing about this result is saved to storage or a cookie.

The email gate stores exactly four fields

Each free tool shows you a real result before it ever asks for your email. If you choose to unlock a saved copy or further detail, the gate writes exactly these four fields — never the offer figures you typed into the tool, and never a fifth field beyond these:

Uploaded documents: storage, reads, retention and deletion

If you go on to the paid 24-Hour Offer Decision Sprint, you upload documents (your offer letter, and recruiter correspondence if you have it) so they can be read into your Decision Brief. Here is exactly what happens to them — the same numbers stated on the how-it-works page and explained further on the security page.

Where uploaded documents live

A private object store, not a public bucket — MinIO in this build, under docker-compose. There is no public URL for any uploaded document.

How a document is read

Every read — whether you open a file in the portal or one is read to build your Decision Brief — is a freshly issued presigned URL, valid for 5 minutes or less. It is issued per request and never written to a database, a cache or a log; two reads of the same document get two different URLs, and neither is reusable once it expires.

How long a document is kept

Documents are deleted 30 days after your case closes by a scheduled purge job that runs against the case store — no request from you is required.

Deleting a document sooner

The portal’s delete-now control removes the object from storage immediately and cuts off any further read at once. The case keeps a record that a deletion happened — an audit row with a deleted-at timestamp — but the file itself is gone on request, not just after 30 days.

What never appears in a URL

Neither a filename nor any figure extracted from a document ever appears in a URL path or query string — object keys are opaque identifiers, not filenames.

Analytics never carries your data

• Analytics is Google Analytics, with a measurement ID read from configuration — never a literal written into the code.
• The wrapper is a silent no-op when no measurement ID is configured: it never throws and never logs.
• A payload naming an email, a company name, an offer value or a query-string value is dropped before it is ever sent — the calling code cannot opt out of that filter.
• No event fires on a page marked noindex: your portal, checkout and the logon page never generate a public analytics event.

Signing in: no password, ever

• No password field exists anywhere on this site. Signing in uses a magic link sent to your email, or WebAuthn where your device supports it.
• A magic-link token is single-use, stored on the server only as a hash, and expires 15 minutes after it is issued.
• Your access token lives in memory in your browser tab only. Your refresh token lives in an httpOnly cookie your browser’s JavaScript cannot read. Neither is ever written to localStorage or sessionStorage.
• An email address that has no account still gets a normal-looking response — this site never confirms or denies whether an address is registered.

What we do not do

• We never send an offer figure you type into a free tool to any server — the four tools compute the entire result in your browser, and the tool’s own math and formulas are shown on the page.
• We never store a filename or an extracted offer figure in a URL, a log line, or an analytics event.
• We never call a third-party integration (Stripe, Google Gemini, Amazon SES) that isn’t configured with real credentials in this environment — an unconfigured integration shows a visible not-configured state rather than fabricating a response.
• We never keep an uploaded document past its retention window unless you asked us to, and we never make a presigned read reusable past its 5-minute window.

When this answer changes

• You use the Offer Risk Snapshot instead of one of the four calculators — it is the one tool that does talk to a server, because grounding a claim in a real, dated source requires it; see the methodology page for exactly how.
• Your case closes and 30 days pass with no delete-now request — the purge job removes your documents on its next scheduled run, with no action needed from you.
• You use the portal’s delete-now control — retention drops from "up to 30 days" to "removed now," and only an audit row survives.
• A term on this page turns out to be wrong or the code changes — the correction is filed and dated on the corrections page, not silently edited in place.

See something on this page that no longer matches the product? Read how corrections are filed and dated, or read the editorial policy for how every claim on this site is sourced.