Worth Leaving
← CALCULATOR

Privacy

Last updated: October 4, 2026

This privacy page describes how Worth Leaving handles your data.

Phase 0: on-device calculation

In Phase 0 (the current version), the calculator's equity math runs entirely in your browser. When you enter your comp data (base salary, equity grants, vesting schedules, or offer details) the calculation itself happens on your device: nothing is sent to a server to compute your verdict. Using the calculator never creates an account. If the calculator is invite-only, you still need a link (or to ask for one) before you can run it. That gate is described under "Invite-only calculator" below.

The equity math runs in your browser. As you type, your scenario is saved automatically to your browser's local storage, so it survives a reload or a closed tab. Nothing about your scenario is written into this page's URL. See "Local storage" and "Shareable URLs" below.

Local storage

Every edit to your scenario is saved to your browser's local storage. That's what lets you close the tab and come back later without losing your numbers. It stays on your device. It is never sent to a server, but it also isn't cleared automatically when you close the tab. It persists until you clear it yourself: clear this site's data from your browser's settings.

Shareable URLs

Your scenario is no longer written into this page's address. The address bar and the "Copy link" button give you a clean link with no comp data in it, not even ranges.

Share links carry no comp data. No exact figures and no banded ranges.

Anyone you send the link to lands on the calculator. They do not see your comp, your ranges, or your scenario. Opening the link on another device or in a private window will not reload your numbers. Only this browser's local storage does that, described above.

Older links: until this change, the address bar and "Copy link" carried a summary with banded ranges (rounded ranges for current pay, the offer, and the gain, the kind of offer, and whether equity was involved). Links created before 2026-08-25 may be an older format that carries exact figures. Those links still exist wherever they were sent. When one is opened now, the page removes the value from the address bar. Nothing new generates them. Older values may also have been recorded in our hosting provider's standard request logs, which are kept for a short period, and not used by us for anything else, and in our site analytics, which our hosting provider keeps for at least 12 months and may keep longer. New visits no longer send the value to analytics.

Share cards

The share card text ("My net gain bands to $X a year...") is a separate thing from the link above, and it stays accurate: it shows banded ranges, never your exact numbers, and it's generated in your browser. The link copied alongside it carries no comp data. See "Shareable URLs" above.

Verdict counter

When your first result appears, the calculator sends one signal to our server. It says only what kind of equity you entered (public-company RSUs, private-company shares, options, or none) and whether an offer was in (none, just exploring, or in writing). We store that with the day it happened, and nothing else: no comp numbers, no company, no scenario, no exact time, no device. We only ever read the counts in groups of 5 or more. We use it to see which situations reach a result.

Rate limiting

To stop abuse of sign-ups, sign-in emails, invites, sharing, the advisor, and other site actions, we limit how often those can be repeated. We don't use that for anything else.

Our hosting provider keeps standard request logs, which include IP addresses, for a short period for security and operations.

Page analytics

Every page on this site, the calculator included, loads our hosting provider's analytics. It counts page views: which page, referrer, country, browser and device type. It is cookieless and does not fingerprint your device.

This is site measurement, not advertising, and none of it is sold or shared onward.

This site also loads our hosting provider's performance monitoring, which measures how pages load. It is not advertising, and it does not receive your comp data.

It records a few anonymous usage events (pages viewed, a calculator run started, a result viewed, a save or share attempt), with no cookies, no personal data and no amounts recorded. A session recording with all text and inputs hidden runs only if you allow it, and only then does your browser keep an id for this site.

Invite-only calculator

On deployments where the calculator is invite-only, / is locked until you hold a valid invite. The page you see says you need a link. Everyone inside has a link to pass on.

Asking to be let in

If you do not have a friend's link, the locked page can collect an "Ask for an invite" request.

What we collect: the email you typed, plus an optional note if the form includes one. We do not write that request into our database. We email the address and note to the founder through our email provider. Approval is a separate, deliberate act. Asking is not a mailing list. We do not send follow-ups from that request. If a spot opens, the invite lands in that inbox. Nothing else will.

The form only appears when invite-only is on and delivery is actually configured (our email provider can send to the founder inbox). If it isn't, the form is not shown, so an unconfigured deployment never collects an address it would drop.

Ask-to-be-let-in is rate limited. See "Rate limiting" above.

A waitlist request lives in the founder inbox after our email provider delivers it. There is no self-serve delete for that yet, and there is still no contact address on this page.

Invite membership

If you are let in (you redeem a working invite link), we store invite membership in our database. Redeeming sets an invite membership cookie that lasts one year. It does not carry your comp data.

Clearing the cookie on your device drops access on that browser. The membership stays in our database until a signed-in delete path exists. There is none yet.

Signing in can claim that membership to your account, and signing in on a new device can restore the cookie if your identity already has a claimed membership. That restore path is how "Already have access? Sign in" works on the locked page.

Passing a link to a friend mints a new membership for them when they redeem it. It does not share your calculator run or your email.

Invite membership is not a marketplace profile. It does not show you to companies.

Sign in to get notified

The share panel has a "Sign in to get notified" field (sometimes described as Notify me). That is candidate acquisition, not a mailing list.

When you enter your email, consent, and sign in:

  1. We email you a sign-in link through our email provider to prove your inbox
  2. After you click that link, we save this calculator run privately as a candidate record
  3. That record includes your email and the scenario you ran (current package, offer, weights, ratings, leave date, haircut, filing status, locations)
  4. We do not show it to companies until you opt in (off by default). Recruiter browse cannot see it.
  5. The sign-in email is transactional. It is not an offer. It is just the link to prove your inbox.

The calculator run is your candidate record. It is stored in our database and is never visible to companies until you explicitly opt in. If you never opt in, companies cannot see it, and you are not browsable.

The field only appears when sign-in is configured. If it isn't, the field isn't shown at all.

Your calculator run stays private. We match offers against it, but we do not email you until there is something real to send. Creating this record does not enroll you in company browsing. That's a later opt-in.

Optional AI advisor

If you activate the optional AI advisor, you will see an explicit disclosure before any data leaves your browser. Activating the advisor sends your scenario data (current package, offer, vesting schedules, factor ratings) to an AI provider for conversational advice.

Important: advisor conversations may be retained by the AI provider. We cannot guarantee your data is not retained. If you require absolute confidentiality, do not use the advisor.

The advisor is opt-in. The core calculator works without it. If you don't activate the advisor, nothing about your scenario is sent to an AI provider.

Signing in

Signing in happens in three places: from the calculator (described above), to access your inbox (view pitches, accept/decline), or from the locked invite page to restore access you already have.

Sign-in is a one-time link. You type an email address, we send a link to it through our email provider, and opening that link signs you in. The link is valid for ten minutes and works once. There is no password, so there is none for us to store or leak.

When you sign in from the calculator, we create a calculator run (your candidate record) AFTER the link is verified, so your inbox is proven before we store anything. See "Sign in to get notified" above.

Calculator sign-in sets a temporary cookie that holds your scenario for ten minutes while the sign-in link is in flight, then clears it after you click the link. The session cookie lasts 30 days and is cleared when you sign out.

During the sign-in flow from the calculator, your scenario is held temporarily in a cookie between the moment you request the link and the moment you click it. That cookie expires in 10 minutes (same as the link) and is cleared immediately after sign-in succeeds. It never travels in the URL or the email body.

Sign-in requests are rate limited. That is what stops someone mailbombing an address with sign-in links.

Sign-in exists only on deployments configured for it. Where it isn't configured, every marketplace surface reports itself unavailable and no account can be created at all. The calculator still runs if you already hold a valid invite cookie, or if invite-only is off.

Two-sided marketplace (opt-in)

Worth Leaving includes an optional two-sided marketplace. A browsable profile is not live. /profile join is gated off. Signing in from the calculator creates a private calculator run (your candidate record), but does NOT make you browsable to companies. That's a separate opt-in. Calculator usage with sign-in stores your run privately for offer matching, but companies cannot see it until you opt in.

Calculator runs vs. marketplace profiles

A calculator run is created when you sign in from the calculator. It includes your email and scenario, and it is stored privately for offer matching. Companies cannot see calculator runs.

A marketplace profile (not yet implemented) would make you browsable to companies. That's a separate step beyond the calculator run, and the calculator does not create one.

If you create a marketplace profile (when it ships)

Marketplace profiles are not live yet. When that feature ships, profile creation will collect:

  • Self-asserted comp bands (never exact dollars)
  • Research areas and seniority tier
  • Optional headline and skills
  • The email address you signed in with

Your email is stored in our database. It is the address you signed in with, and it is what a reveal hands to a company if you accept a pitch.

Pitch notification email is not built yet. Today nothing is mailed to you when a pitch arrives, and you see pitches by signing in. When notifications do ship, they will carry no pitch content and no comp details, only that something is waiting for you, and this page will say so before they send.

Companies browsing profiles see:

  • Banded comp ranges
  • Research areas, seniority, skills
  • Never your name or email

Your identity is revealed only when you explicitly accept a pitch.

If you accept a pitch

If you accept a pitch, we share your name and email with that company so it can contact you.

If you decline a pitch

Declining removes the pitch. The company does not get its credit back. No identity is revealed, and no notification containing your profile data is sent to the company.

Data processors

  • Our database hosts marketplace profiles, pitches, company accounts, private calculator runs, and invite membership
  • our email provider sends sign-in links, and (when you ask to be let in) emails your address and optional note to the founder. It holds the email addresses it sends to. No comp data and no pitch content are ever put in an email.
  • an AI provider receives your scenario if, and only if, you activate the optional advisor
  • our hosting provider hosts the site, and runs the cookieless page-view analytics and performance measurement described above

What we don't collect

The calculator does not require an account. No device fingerprinting. No advertising, no ad networks, no third-party tracking cookies, nothing sold or shared onward. Page analytics are cookieless and described above.

Cookies this site may set:

  • a temporary cookie that holds your scenario temporarily during sign-in
  • the session cookie that lasts 30 days and is cleared when you sign out
  • the invite membership cookie that lasts one year

The calculator with no sign-in and no invite cookie sets none of those.

  • No background checks. No credit checks. No third-party identity append or enrichment. No FCRA-regulated data, ever.
  • Nothing on the calculator follows you between visits except your own local storage, plus the invite membership cookie if you redeemed an invite on this browser. What leaves your browser: the page-view ping (our hosting provider's analytics), the verdict counter, your email and optional note if you asked to be let in (our email provider, to the founder inbox, not stored in our database), your email and scenario if you sign in from the calculator (the sign-in link from our email provider, then the private calculator run stored in our database after you click it), the optional AI advisor (an AI provider, if you activate it), and limits on repeated actions. Your comp data and local storage stay on your device.

Employer names you enter in a blocklist are stored in your profile and are never shown to a company, including after you accept a pitch.

Calculator does NOT require marketplace

Using the calculator (entering your equity, comparing offers, getting a verdict) requires no marketplace opt-in. The calculator and the marketplace are separate features. If the calculator is invite-only, you need a link, or you can ask to be let in with an email. That email is not marketplace enrollment.

If you sign in from the calculator, we create a private calculator run (your candidate record) for offer matching, but that does not make you browsable to companies. That's a separate opt-in, and the calculator does not create it.

If you never sign in at all, the identifying things that can still exist on our side are: an invite waitlist email in the founder inbox if you asked to be let in, and invite membership if you redeemed a link. Page-view counts, the verdict counter, and limits on repeated actions are not tied to your account.

Contact

There is no contact address on this page yet, and rather than print a mailbox nobody reads, here is what that means in practice. What does leave your browser: a page-view ping (our hosting provider's analytics, cookieless, no comp data), a counter increment (carries nothing tying it to you), your email and optional note if you asked to be let in (our email provider to the founder inbox; not written to our database), your email and scenario if you signed in from the calculator (creates a private calculator run stored in our database, not browsable to companies), invite membership if you redeemed a link (stored in our database, plus the invite membership cookie), limits on repeated actions, and scenario data if you activated the optional AI advisor (an AI provider, data may be retained). Everything else is in your browser: clear this site's data from your browser settings, and it is gone.

If you only use the calculator without signing in, without asking to be let in, and without redeeming an invite, there is nothing on our side to ask us to delete: no account and no comp data on any server.

If you asked to be let in, that request is in the founder inbox. There is no self-serve delete for it yet.

If you redeemed an invite, membership lives in our database. Clearing the invite membership cookie drops access on that browser. The membership stays until a signed-in delete path exists.

If you signed in from the calculator, there is a calculator run stored (your candidate record). It is not shown to companies until you opt in. There is no self-serve delete for that run yet.

Marketplace profiles are not live (/profile join is gated off). When that feature ships, this page will say how delete works before that path stores data you cannot already clear yourself.

A contact address goes here before any feature ships that stores something you cannot already delete yourself. Invite waitlist mail, invite membership, and calculator runs are already in that gap.

This privacy page will be updated as features change. Material changes will be dated and noted at the top.