Privacy

Browser to Cloudflare to Nginx Proxy Manager to the app; the pay stub stays in the browser

What we store

A username you choose and an Argon2id hash of your password and recovery code.
Your pay-period numbers: hourly rate, hours and dollar amounts per earnings line, and the settings you pick (FERS tier, TSP election, filing status, YTD wages). Stored as one encrypted blob per account; the key lives outside the database.

What we never store

Your pay statement. The text or PDF you drop onto the import page is parsed by JavaScript in your browser; only the extracted numbers are sent.
Your name, email, SSN, employee ID, address, facility, or bank information. The parser discards those fields before anything is sent.
IP addresses or user agents. The app writes no access log; login throttling uses a salted hash that is deleted within an hour.

Deleting

"Delete my account" on the Account tab erases your rows immediately and compacts the database so the ciphertext doesn't linger. Accounts untouched for 180 days are purged automatically.

Who runs this

A controller, on a home server, for coworkers. It is not an FAA or NATCA system, and nothing here is official. Treat the output as an estimate to compare against the stub when the money lands.