Every payroll and tax calculation runs entirely in your browser or on your phone. The exact money amounts you type — hourly wage, salary, tips, RRSP amounts — are never sent to us, with one exception you choose: buying a report, which is built from the salary you enter for it (section 5). If you save a calculation to an account, that one calculation is stored so you can reopen it on another device, and you can delete it at any time.

What is sent is an anonymous record of each calculation, listed in full in section 2. Money appears in it only as ranges. Your work pattern is the one thing sent as plain numbers: when you use the shift or timesheet calculator, the usual start and end hour, days per week, average shift length and unpaid break. You can switch all of it off (section 2).

The calculator other websites embed (our “widget”) sends less: the province, income as a range, annual or hourly, language, device and browser family, the hour and weekday, the time-zone name, a temporary visit identifier and the domain it is embedded on. It sends no work pattern, stores nothing in the browser, and loads nothing from any other website. A website that embeds it with &notelemetry=1 turns even that off: the widget then sends nothing at all.

To understand how the calculator is used and to publish research such as “which income ranges Canadians calculate most, by province”, we record one anonymous record per settled calculation. It contains:

• the calculator used, the province selected, and your gross income as a range (such as “$50k–$70k”) — never the amount;
• the interface language, your device type (phone, tablet or computer), browser family, operating-system family and, on some phones, the handset maker — never the full browser signature or a device fingerprint;
• the pay frequency you chose, a work-type label worked out from what you entered (full-time or part-time hourly, salaried, tipped, shift) — worked out, never asked — and where your pay sits against Statistics Canada’s median for your province, as a range, together with the median we compared it with;
• whether you opened the detailed breakdown, and, if you tap a paid report, which one — never anything about a purchase;
• which page of our own site you were on before calculating (the path only — never a link from another site and never anything after a “?”);
• optional answers you choose to give: the industry you compare against (and its position in the list, and whether this browser had chosen it before), why you are calculating, whether the result matched your expectation, where you work (on-site, remote, hybrid), your age group, tenure, union membership, employer size and vacation days;
• your typical work pattern when you use the shift or timesheet calculators (usual start and end hour, days per week, average shift length, unpaid break) — never the calendar dates you worked;
• broad ranges for entries you make (RRSP contribution as a share of pay, shift premium, overtime hours, tips as a share of pay, union dues, other deductions, bonus, commission or other income, and restricted stock units as a share of pay), whether you entered a disability-insurance premium, holiday or sick pay, or a taxable benefit (yes or no), how your employer matches RRSP contributions, and whether your tips are paid through payroll — always ranges or yes/no, never the amounts;
• if you use the free offer comparison, how offer B’s salary differs from offer A’s as a range (such as “up 5–10%”), the province of offer B when it is a different province, and whether it has more, the same or fewer vacation days — never either salary;
• on the province comparison page, which provinces you compare (names only) with your salary as a range, and, if you answer, whether you are planning to move, might, or are just curious;
• if you use “find the salary” to work back from a take-home amount, the monthly take-home you asked for, as a range (such as “$4k–$5k”) — never the amount;
• whether you ticked “I support a spouse or common-law partner” (yes or no) — never your spouse’s income;
• how long it took from opening the page to your first result, as a range (under 10 seconds, 10–30, 30–90, over 90), and how many times you changed the form before a result, as a range (1–3, 4–10, 11–30, over 30) — never timestamps, keystrokes or where you clicked;
• whether you were signed in (yes/no — never which account), and if you reopen a saved calculation and change it, the direction and rough size of the change and how long ago the original was saved — never the amounts;
• the hour and weekday on your own clock, and the time-zone name your browser reports (such as “America/Toronto”), which we use to check the map, not to place you;
• whether this device has recorded a calculation before — a single yes/no flag stored on the device, not an identifier;
• on the calculator other websites embed (our “widget”): the domain of the website it is embedded on — never the page, and never the visitor’s own address. The widget stores nothing in the browser, so it records no “before” flag;
• your approximate location, described in section 3.

Records from one visit are grouped by a random temporary identifier that is discarded when you leave and is never reused. These records contain no names, no account identifiers, no IP addresses and no device fingerprints, and are not linked back to you.

Opting out. Open any page of this site with ?notelemetry=1 added to the address and this browser will record nothing from then on — no calculation records and no page-view counting (?notelemetry=0 turns it back on). The calculator works identically either way. The choice is stored in this browser for this site, so it does not follow you to other browsers or into our calculator where another website embeds it; a website that embeds it can switch recording off for all its visitors by adding &notelemetry=1 to the widget’s address. The iPhone app has its own switch (section 6).

There are three levels, and only the first happens without you doing anything.

1. From your connection. Our hosting provider tells our server the country, region and city your connection appears to come from, and an approximate point for that connection, which is usually somewhere in that city. We keep that point rounded to about 11 km. Your IP address is not stored — not in these records, not in logs we keep. This is city-level and it is the same whether or not you answer anything below.
2. Your postal-code prefix, if you type it. Under the result you may enter the first three characters of your postal code (a “forward sortation area”, an area of a few thousand households). In return you see where that income sits among the people who file taxes in that area, from Canada Revenue Agency statistics. We keep the three characters only. A full six-character postal code, which identifies about fifteen households, is never accepted. The prefix is remembered on your device so you are not asked again, and it is then included with each later calculation you make in this browser; press “Change” to replace it, or clear your browser’s site data to remove it and stop that.
3. Your device location, if you press “Use my location”. This is off until you press the button, and your browser then asks you as well. The position is rounded on your device before anything is sent: to two decimal places (about 1 km) in urban areas, and to one decimal place (about 11 km) in rural areas, where a 1 km square could be a single home. It is also matched, on your device, to the nearest postal-code prefix. What reaches us is that rounded point and that prefix — never the precise reading, and never more than once per calculation. Declining changes nothing about the calculator, and typing the prefix is always available instead.

Why we ask, stated plainly. Neighbourhood-level answers let us publish and license aggregated statistics — for example, how many people in a given postal-code area calculated pay in a given income range this quarter — to organisations that have a use for them, including researchers, journalists, and real-estate or financial companies. Every figure we publish or license is a count for an area of thousands of households and is withheld unless at least twenty people are behind it. Licensees receive statistics, never records; their agreements prohibit attempting to identify anyone and prohibit reselling the data. We do not sell, rent or share personal information.

Quebec residents. The postal-code and device-location options in levels 2 and 3 are off until you turn them on. The connection-based location in level 1 is always on: it is city-level, rounded to about 11 km, and stored with no name, account, IP address or other identifier. This section is our notice about the location functions. A French version of this policy is at /fr/confidentialite.

Cookies only if you sign in. Signing in sets a cookie named cp_session that keeps you signed in for 30 days. While you sign in with Google or Apple, a second cookie (cp_oauth or cp_apple) carries the sign-in request for up to ten minutes and is then removed. They are essential to that feature, are not used for tracking or advertising, and are not set unless you sign in. We use no advertising or third-party tracking cookies, which is why this site has no cookie banner.

Local storage on your device holds your language choice, your calculator settings when signed out, the calculations and timesheet entries you save while signed out, the industry you last compared against, the telemetry opt-out flag, the remembered postal-code prefix, which of the optional questions you have already answered (so you are not asked twice; not your answers) and the “has calculated before” flag, plus three entries for page-view counting (below): a session number for the tab (_av_sid), a “visited before” flag (_av_seen) and an off switch (_av_off). The tab’s session storage also holds the page your visit started on, and is cleared when you close the tab. None of it identifies you, it stays on your device, and clearing your browser’s site data removes all of it. The calculator other websites embed stores nothing.

Page-view counting. Two cookieless counters run on this site. The first is ours, served from avowd-analytics.qharbert.workers.dev — a Cloudflare Worker on our own account, shared with our sister site Avowd. For each page it records the address (including anything after a “?”), the address of the page that linked here, your browser window’s size and language, how far down you scrolled, and, when you click a link to another website, an email address or a phone number, where that link goes and its text; it groups one tab’s pages by a random session number and notes whether this browser has visited before. It also records the approximate location of your connection as our host reports it (country, region, city, time zone and a point rounded to about 11 km) and your device type, browser and operating-system family — never the full browser signature. The second is Cloudflare Web Analytics, our hosting provider’s page-view counter. Neither sets a cookie or stores an IP address. Neither runs when you have opted out, on the calculator other websites embed, or on report pages — whose address carries the key to your report. We do not use Google Analytics or any advertising network.

Hosting. The site runs on Cloudflare, which processes every request to deliver it and protect it from abuse; Cloudflare may keep short-lived connection logs under its own privacy policy. Our own database never receives your IP address.

An account is optional; every calculator feature works without one. You can sign in with Google, with Apple, or with a one-time link we email you. With Google or Apple we receive the name, email address and profile picture that provider shares; with an emailed link, only your email address. We store your saved calculations, timesheets and settings so they follow you across devices. Sign-in providers see that you signed in to our site under their own policies.

Emails to account holders. When you create an account we send one welcome email about the account. Tax-change emails, which tell you when new CRA rates change your take-home pay, are off until you turn them on in the account menu; we record when you turned them on. Every such email has a one-click unsubscribe. Sign-in links and receipts are sent because you ask for them and are not affected by unsubscribing.

If you buy a report, payment is taken by Stripe on Stripe’s page; we never see your card number. We keep the purchase record (product, amount, date, the email Stripe gives us, and the province and income range the report was about) because tax law requires a seller to keep sales records — currently for six years. The report itself is built from what you entered for it — your salary and the two provinces, or the two job offers — which is sent to us to create the payment and is held by Stripe with that payment, so the report can be rebuilt whenever you open its link. Our own records keep only the income range. See the Refund Policy.

Deleting your account. Open the account menu on this site, or the history drawer in the app, and choose “Delete Account”. Your account, saved calculations, timesheets and settings are removed immediately and permanently. Purchase records are kept with your name and email stripped. The anonymous statistics in sections 2 and 3 are unaffected — they carry nothing that could be traced to you in the first place.

The CanPay Insights app asks for no location permission and no contacts, camera or microphone access. It asks for photo-library access only when you save a report image. It records the same anonymous statistics as the website (section 2), placed at city level from the connection (section 3, level 1); the postal-code and device-location options in section 3 exist on the website only. From version 1.2.4 the app has a “Share anonymous usage data” switch under your results; turn it off and the app sends none of these statistics, and no survey answers. The choice is kept on your device.

• Service providers that process data on our behalf: Cloudflare (hosting, database, email delivery and both page-view counters), Stripe (payments), Google and Apple (sign-in). Each acts under its own privacy commitments and receives only what its function needs.
• Licensees of aggregated statistics, as described in section 3 — statistics only, never records, under agreements that prohibit re-identification and resale.
• The public, through the open datasets on our data page, which contain the same aggregated statistics with small groups withheld.
• Authorities, where the law requires it.

Data is processed in Canada and the United States, where our providers operate.

• Anonymous calculation records: kept indefinitely, because they are the dataset and contain nothing that identifies you.
• Account data: until you delete the account.
• Purchase records: six years after the tax year of the sale, then deleted.
• Emails you send us: as long as needed to answer, then archived or deleted.

You may ask what personal information we hold about you, ask us to correct it, withdraw consent, or ask for deletion. Because the statistical records carry no identity, requests about them cannot be matched to a person — but the opt-out in section 2 stops any further recording from your browser, and “Change” or clearing site data removes a stored postal-code prefix.

Person in charge of personal information (privacy officer): Qi Zhang, info@canpayinsights.ca. We answer within 30 days.

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d’accès à l’information (cai.gouv.qc.ca).

The Service is not directed at children under 13, and we do not knowingly collect their information.

We change this page when what we collect changes, and we say so on the changelog. This version (September 25, 2026) collects nothing new. It rewrites section 1 so that it no longer contradicts section 2 about the work pattern, describes what the embedded widget sends, and completes the list of what is kept in your browser (section 4).

Questions and requests: info@canpayinsights.ca. CanPay Insights is operated by Qi Zhang (Avowd), Vancouver, British Columbia, Canada.