How your loan data is handled

Your loan data never leaves your browser

The simulation runs entirely client-side. Your loans, income, household details, and results are stored in your browser's localStorage under the key bracketsight.loans.scenario.v1 — on your device, under your control — and nowhere else. There are no accounts, no server-side database, and no transmission of your financial details to us or anyone. Clearing your browser storage erases everything.

Which storage keys does this tool write?

Two, and both are readable in your browser's developer tools if you want to check. bracketsight.loans.scenario.v1 holds the scenario currently in the form and is rewritten on every change. bracketsight.pins.v1 holds the scenarios you pin for comparison, capped at 6. One further key is read but never written: atlas.scenario.v1, the name this tool used before the five calculators moved onto one domain, so a scenario saved under the old name is not lost. The next change writes it back under the current key.

Every key is namespaced and versioned on purpose. Namespaced, because five tools now share one browser origin and must not read each other's state. Versioned, because a stored shape that changes should orphan old data rather than misread it — a wrong scenario is worse than no scenario.

Share links

The address bar carries your scenario after the # — in the URL fragment, which browsers never send to a server. Copy the address and the recipient's browser re-runs the same simulation; the balances and income in it reached no server on the way. Anyone with the link can read those inputs, so share it as you would the numbers themselves.

The fragment rather than a query string is the whole point. A query string travels to the server in the request line and lands in ordinary web-server logs; a fragment is stripped by the browser before the request is sent. “Your loan data never leaves your browser” has to be true in the network tab, not only in the copy on this page. Links minted with a ?s= query parameter before that change still decode, so nobody's saved link broke.

What exactly is in a share link?

Everything you typed into the three steps, and nothing else: each loan's balance, interest rate, type and first disbursement date; your AGI, filing status, family size and dependents claimed; and your PSLF answer with any prior qualifying payment count. It is compacted into a positional format and base64url-encoded, which makes the link shorter — it is not encryption, and it is not meant to be. Treat the link as the private thing.

The format carries a version number. A link produced by a future version of the tool decodes to nothing and the form falls back to the example borrower, rather than decoding into numbers that are subtly not yours. The fragment is rewritten on a short delay after you stop typing, so a burst of keystrokes leaves one history entry rather than forty.

What is not held anywhere?

There is no account, so there is no email address, name, password or profile. The tool never asks for a Social Security number, a servicer login, a loan account number or a date of birth, and no field exists to type one into. It does not connect to StudentAid.gov or to any servicer, so it cannot retrieve your real balances and cannot send anything to them either.

This is structural rather than a policy. The calculation engine has zero dependencies and makes no network calls of any kind, so there is no endpoint that could receive a balance even by mistake. There is no database in this version of the site for anything to be written to.

Future document upload

A planned feature will read a StudentAid.gov summary you upload. When it ships, files will be processed in memory and never written to disk, object storage, or logs — the privacy promise is part of the product, and it is enforced in code.

Two further constraints are already designed and will ship with it. The extracted loan table is always shown to you for confirmation before anything is simulated — at every confidence level, with no “looks right, skip this” path — so a misread balance is caught by you rather than acted on. And no figure read out of a document is ever presented as a result: the confirmed table is fed to the same deterministic engine that runs when you type the numbers in by hand. Nothing about the feature is live today, and this page will say so on the day it is.

Analytics

If we add analytics, they will measure page performance and feature use only. Your AGI, balances, and results are never sent to an analytics provider — at most, coarse bucketed ranges. No advertising identifiers are attached to tool inputs.

No advertising runs on this site today and no ad network script is loaded on any page. When advertising is switched on, one thing will not change: an ad network cannot receive what you type here, because it never leaves your browser and there is nothing to hand over. No ad slot sits inside the tool, where it could be mistaken for part of a result. The site privacy policy sets out the advertising position in full.

How do I have my data removed?

Clear your browser's site data for this domain, and it is gone — there is no server copy to restore it from, and nothing was ever sent to be deleted. If you shared a scenario link, delete the message containing it; the numbers live in the link itself, not in an account we could close. Questions to info@bracketsight.com.