Privacy policy

Every calculation on this site runs in your browser. The formulas are JavaScript that is downloaded to your device and executed there. When you enter a salary, a loan balance, a date of birth or a set of body measurements, that value is held in your browser’s memory and nowhere else. It is never transmitted to us, and never included in any request this site makes, on any calculator.

For almost every calculator, that also means no request is made at all: there is no API call, no form submission and no logging of calculator values. You can verify this yourself — open your browser’s developer tools, switch to the Network tab, and use the calculator.

One calculator is the exception. The Currency Calculator fetches current exchange rates from a public rate provider so its conversions stay up to date. That request carries no information about you — it is the same request with the same response for every visitor, regardless of what amount or currencies you’ve entered. Your actual conversion is still computed locally, in your browser, exactly like every other calculator; only the rate table itself comes from the network. If that request fails, the calculator falls back to its last known rates rather than sending anything to find out why.

This is a structural property of how the site is built, not a policy promise we could quietly change without rewriting the application — which is also why we can be this specific about the single exception to it.

When you change a calculator’s inputs, the values are added to the URL so that you can bookmark or share the result. That URL is part of your browser history and is visible to anyone you send it to.

Be careful what you share. A link to the salary calculator contains your salary; a link to the body fat calculator contains your measurements. The values are not sent to us by putting them in the URL, but they are visible in the address bar and in any messaging app you paste them into.

We use your browser’s local storage for a small number of things:

• stepwise-theme — whether you chose the light or dark theme.
• stepwise-cycle-tracker — everything you log in the period tracker: periods, symptoms, mood, water intake and notes. By default this exists only in your browser; see the accounts section below for the one way it can go further.
• stepwise-account-consent — a record of whether you agreed to account data storage, and when, so we do not ask you twice.
• If you sign in, your session token (set by our authentication provider) is also kept in local storage so you stay signed in between visits.

None of this is readable by other websites. Clearing your browser data removes all of it.

Some tools (currently the period tracker) can remember your data between visits. By default they are local-only: the data lives in your browser, nothing is transmitted, and no account exists. Signing in is optional and exists for one reason — backing your tool data up and syncing it across your devices.

What we store if you sign in. Your name and email address as provided by Google sign-in, the data you log in tools (for the period tracker: period dates, symptoms, mood, water intake and notes), and a record of the consent you gave. Nothing else — no browsing history, no calculator inputs, no profile built from your activity.

Cycle data is health data, and we treat it that way. It is stored in a database hosted by Supabase (our processor), encrypted in transit and at rest, and readable only by your own authenticated session — enforced by row-level security in the database itself, not just by application code. We do not sell it, share it with advertisers or analytics providers, use it for ad targeting, or use it for anything except showing your own data back to you. Sign-in is gated behind an explicit consent screen; we store your data only after you have agreed.

Your controls are self-service. On the My profile page you can see exactly what is stored, export it as a file, delete all tool data, or permanently delete your entire account — which erases your data and consent record from our database immediately, with no email to write and no waiting period. Withdrawing consent is exactly that deletion. Data is kept only until you delete it; there is no other retention schedule.

Wherever you live, we hold ourselves to the strictest of these. For the UK and EU, the GDPR treats cycle data as special-category health data processed on the basis of your explicit consent (Article 9(2)(a)), which you may withdraw at any time as described above, and you have the rights of access, portability, rectification, erasure and complaint to your supervisory authority. For the United States, we honour the rights granted by state privacy laws (including the California Consumer Privacy Act and state consumer-health-data laws): we do not sell or share your personal information, and access and deletion are available on the profile page without needing a formal request. For Canada, this is the meaningful, express consent PIPEDA requires for sensitive information. For India, the Digital Personal Data Protection Act, 2023 recognises the same structure — processing on consent, withdrawable as easily as it was given. If you cannot use the self-service controls for any reason, the contact page reaches us for any of these rights.

Like essentially every website, the server that delivers these pages records standard request information: the URL requested, the time, your IP address, and your browser’s user-agent string. This is how web servers work and is necessary to deliver the site and to identify abuse.

These logs contain the URLs you visit. If you have used a calculator and its values are in the URL, those values appear in the request log. If that matters to you, use the reset button before navigating away, or visit the calculator’s clean URL directly.

This deployment uses Google Analytics 4 to understand which calculators are used and where they fall short.

We record which calculator was used, whether a calculation succeeded, and how many characters a search query contained. We do not record any value you enter into a calculator, and the analytics layer is written so that it is not possible to pass one — the event API accepts only a calculator identifier and a small set of counters.

We do not record the text of your search queries, only their length and the number of results returned.

This deployment shows no advertising. No advertising script is loaded and no advertising cookies are set.

If advertising is enabled in future, this section and the cookie policy will be updated before it goes live, and a consent mechanism will be presented where the law requires one.

This site sets cookies for the purposes described above and in the cookie policy. See the cookie policy for the full detail.

The site loads no external fonts, no content delivery network scripts, no social media widgets and no tag managers. The Content Security Policy served with every page blocks requests to origins other than those explicitly required by the configured analytics and advertising providers.

This site is a general-purpose utility and is not directed at children. We do not knowingly collect personal information from anyone, including children.

For calculators, we hold nothing about you — there is nothing to export or erase. For tool accounts, every right is self-service on the My profile page: see, export, delete your data, or erase your whole account, immediately and without asking us. If you believe we hold other information about you, or you have a question about this policy, please use the contact page.

Depending on where you live, you may have rights under laws such as the UK and EU GDPR, the California Consumer Privacy Act, or similar legislation — including rights of access, correction, deletion and objection. We will respond to any such request in line with the applicable law.

If the way this site handles data changes — particularly if analytics or advertising are switched on — this page will be updated and the “last updated” date at the top will change.

This page describes what the software actually does. It is a factual description, not legal advice, and it does not by itself constitute compliance with any particular data protection regime. Anyone operating this platform commercially should have it reviewed against the requirements of the jurisdictions they serve.