The short version
The figures you type into the calculator never leave your browser. Your income, fringe benefits, super contributions and investment losses are used by code running on your own device. They are not sent to us, not written to a cookie, not written to browser storage, and not shared with anyone, including Google. They are not put in the page address either, so they do not end up in your browser history or on screen where someone can read them over your shoulder. This site also publishes an API that other programs can call, which by its nature does receive a figure, but the calculator page does not use it, and never has. See the API and the MCP server below.
The one exception is the Share button, and only when you press it. It builds a link with your figures written into it, so that whoever opens the link sees the same calculation. The link is assembled on your device and copied to your clipboard (nothing is uploaded, and we never see it), but your income and balance are readable in the link itself, so treat it the way you would treat any other message containing your salary. If someone sends you one of these links, the calculator fills in the figures and then removes them from the address bar.
This site was built privacy-first, and it is paid for by advertising. The calculator was designed so your figures never have to leave your device, and they don't. The ads fund the hosting and the time spent building and maintaining the site, which is why it is free and asks you for nothing. The trade is that the page loads advertising code we did not write, so what it is for is set out below rather than buried.
What the page loads from other companies, and why
Opening this page loads code from Google and from our host, Cloudflare. None of it receives the figures you type into the calculator. Those are never sent anywhere, which is the point of the section above. What each one is for:
| What loads | Why it is there |
|---|---|
| Google AdSense | Chooses and displays the ads. This is what pays for the hosting and for the time spent building and maintaining the site. |
| Google ad-quality checks | Google's own checks for fake clicks and automated traffic. They come with AdSense and cannot be separated from it. |
| Google Analytics | Counts visits and which pages get read, so we know what is worth writing more of. This is what sets the cookies described below. |
| Cloudflare page-speed measurement | Measures how quickly pages load. Enabled by our host rather than written into the site. Cloudflare states it uses no cookies and does not fingerprint visitors. |
| Cloudflare bot check | Checks that a visitor is a real browser rather than an automated one. Also from our host, and served from this domain, so it can look like our own code. It is not. |
There is no account system, no sign-up, and no mailing list. Nothing you enter is stored on your device.
What we collect ourselves
Nothing. We operate no database, no server-side logging of our own, no contact form and no mailing list. The repayment calculation is performed by a script that makes no network request of any kind, so there is no path by which the numbers you enter could reach us even if we wanted them.
Because we hold no personal information, we have nothing of yours to sell, share or disclose. The Australian Privacy Act 1988 (Cth) governs this site.
Analytics
This site uses Google Analytics 4 (measurement ID G-453D9N6P9N). It records
aggregate usage (pages viewed, approximate location derived from IP address, device and
browser type, and how visitors arrived) and sets cookies in your browser to distinguish
one visit from another. It does not receive the figures you enter into the
calculator. We use it only to see which pages are worth writing more of.
One thing is recorded beyond the defaults. If you arrive from a named AI assistant (ChatGPT, Claude, Perplexity, Copilot, Gemini and a few others), the page sends Google Analytics an extra event naming which one. It is the referring website's address, which your browser already sends to Google Analytics on every page; the event only labels it so that this kind of visit can be counted separately from search traffic. Nothing about you or your calculation is added to it, and no event is sent when you arrive any other way.
- Read how Google uses data when you use our partners' sites or apps.
- You can block Google Analytics entirely with the Google Analytics opt-out browser add-on.
What our hosting provider sees
The site is served by Cloudflare Pages. Like any web host, Cloudflare's servers receive standard technical data when a page is requested: your IP address, browser type, and the pages you visit. This is processed by Cloudflare under its own privacy policy (cloudflare.com/privacypolicy) and is outside our control. We do not access or use this data.
The API and the MCP server
Separately from the calculator page, this site publishes a JSON API at
/api/v1/ and a Model Context Protocol server at /mcp, so that
other programs (and AI assistants) can calculate a repayment without a person
visiting the page. They are documented at hecscalculator.com/developers/.
These are the one part of this site where a figure is sent to a server. If you call the API yourself, or ask an AI assistant something that makes it call the API on your behalf, the income figure travels in that request and is processed on Cloudflare's network. This is inherent in what an API is, and it is why it is described here rather than left for you to discover.
What happens to it: the request is answered and forgotten. We run no database, no logging and no analytics on these endpoints, and we store nothing you send them. There is no account, no API key and nothing to attach a figure to. Cloudflare receives the same standard technical data described in the section above, under its own privacy policy. The endpoints set no cookies and read none.
None of this changes the calculator page. The calculator does not call this API and never has. Its figures are still computed entirely on your own device, exactly as described at the top of this page. If you are using the website rather than writing code, nothing here applies to you.
Advertising
This site serves third-party advertising through Google AdSense. Google, as a third-party vendor, may use cookies to serve ads based on your prior visits to this and other websites. Third parties may place and read cookies on your browser, or use web beacons or IP addresses, to collect information as a result of ad serving.
- You can opt out of personalised advertising at adssettings.google.com.
- See how Google uses data when you use our partners' sites or apps.
- See Google's privacy policy.
Children
There is no content on this site directed at children, and we do not knowingly seek out or identify child visitors. We collect nothing ourselves. The Google analytics and advertising tags described above treat every visitor the same way and are governed by Google's own policies.
Changes to this policy
If the site's data practices change, this page is updated with a new effective date before the change takes effect. The date at the top of this page is the date of the most recent change.
Support
For help with your HECS-HELP loan, repayment obligations, or the figures shown on this site, the Australian Taxation Office is the authoritative source: Study and training support loans (ATO).
This site publishes no contact address, because it operates no inbox and collects no personal information. There is no account to close and no record of you to request, correct or delete. The controls that do exist are the Google opt-out links above, which work without our involvement.