Privacy policy

Every calculator does its arithmetic in your browser. The values you type are not sent to us or to anyone else. Some calculators remember your last inputs in your browser's local storage so the page isn't blank when you come back.

The team tracker works the same way. It stores its records in these localStorage keys on your own computer:

• lc_team_v1: employees, leave periods, settings and the tracker's change log.
• lc_license_v1: your Pro licence key, if you activated one.
• lc_file_saved_v1: when you last saved a company file.
• lc_rated_…: a note that you already rated a page, so you aren't asked twice.

Files you create with Save file or Connect team file go straight to the folder you pick and never pass through us. If that folder syncs to OneDrive, Google Drive or Dropbox, that provider's privacy terms apply. To delete everything, clear site data for leavecalc.com and delete your saved files.

Two small things from these pages do reach our server. A star rating sends only the page and the number of stars, nothing that identifies you. If you buy a tracker licence, we keep the Stripe checkout session ID, your email and the key we issued, so we can resend it if you lose it.

When a company uses the hosted service, we store what is needed to run it:

• Your login. Account email and a hashed version of your password. We never store the password itself. If you turn on two-step sign-in, we also store an encrypted authenticator secret and hashed recovery codes. If you sign in or sign up with Google, we also store the verified email address Google gave us, Google's identifier for your account and, for a Google Workspace account, its domain. If you sign in or sign up with Microsoft, we store the email address and the identifiers (tenant and account) that Microsoft gave us and, for a work or school account whose domain Microsoft confirms, that domain. If your company uses SAML single sign-on, we store the email address your company's identity provider sends us as your sign-in email. It is the same email address as the account's, so nothing new is added to your profile; if the identity provider also sends a name, we use it only to create a viewer account for a person who has none.
• Company settings. Company name, US state, work schedule, pay schedule and holidays.
• Employees. Name, optional work email, department, hire date, hours per week, US state and who they report to.
• An HR system connection. If an owner connects BambooHR, we store its API key, encrypted, and the people we read from it: names, work emails, departments, job titles, dates and reporting lines. We only read. Nothing is written back to the HR system and pay is never read.
• A Slack connection. If an owner adds the Slack app, we store the name and identifier of the Slack workspace, the Slack access key (encrypted), and for each person we find in Slack their Slack user identifier, a keyed hash of the email address Slack confirmed for them (not the address itself) and the identifier of their direct message with the app. We do not keep Slack message history.
• Leave policies you set up, such as PTO and sick-leave accrual rules.
• Leave requests and balances. Dates, hours, leave type and any notes.
• Documents on requests. If an employer asks for them, the files its people attach to a time off request, such as a doctor's note: a PDF, JPG, PNG or HEIC file. We store the file itself (encrypted), its encrypted file name, its kind and size, who added it and when. See Documents and medical notes.
• FMLA case records. The dates of the request, the notices and the certification, the leave-year method, and a leave reason category only. We ask employers not to type diagnoses or any other medical details into notes and reasons. A medical certification or doctor's note that is attached as a document is described under Documents and medical notes.
• An audit log of changes: who changed what, and when. Owners can read it in the app (Settings > Activity log) and download it. It is kept for 7 years unless an owner chooses 10 years or for ever.
• Billing records from Stripe: plan, dates, amounts and Stripe ids. Never card numbers. If an owner asks to pay by invoice, also the legal name, billing address, accounts payable email, purchase order number and tax id they enter.
• Sign-in records. The IP address, browser and time of sign-ins and of failed sign-in attempts, kept for security.
• Support messages. What you write to us in the "Ask the developer" chat inside the app, and our replies.
• A usage log. Which screens of the app were opened and when, sign-ins, and technical error reports from your browser: the error text and the screen it happened on. It never contains what you type into forms. We use it only to help you and to fix problems, it stays on our own server, and we delete it after 90 days.

An employer can let its people attach a doctor's note or another document to a time off request (a PDF, JPG, PNG or HEIC file, up to 10 MB each and 5 per request). The employer chooses, for each leave type, whether a document is never asked for, optional, or required after a number of working days, and may hold approval until one is attached. A file is a medical record, so it is kept apart from the rest of the records. Documents are used for one purpose: to let the employer see the note that goes with the request. We do not share them with any other company.

• What is stored. The file, encrypted with a key of its own that comes from the server's secret, under a random name in a folder outside the part of the server that serves the website. The original file name is encrypted too. We also keep the kind of file, its size, who added it and when, in plain text. Pictures lose their location and camera details (JPG and PNG), and files are checked by their content, not their name. A PDF that contains a script or an embedded file is refused.
• Who can see it. The employee, the account owners, and managers that an owner allows to open medical documents (off by default). A manager limited to one department sees only that department, and never the documents of sick leave, FMLA, bereavement, jury duty or other protected leave. Other managers and viewers cannot open them. A file added through the public request link is marked unverified, and cannot be downloaded until an owner accepts it. We cannot promise that nobody at LeaveCalc could open a file: the key is on the server, so a person with access to the server could in principle open it. Access to the server is limited to the person who runs LeaveCalc, who does not use it to read customer data.
• Where they never show. Not in the calendar, Today, the weekly summary, the Slack app, the API or webhooks, or the connection for AI assistants. The only email is a reminder to the person who asked, which says to add a document and names the leave type and the dates.
• A record of every look. Opening the list of files, downloading and deleting are written to the activity log (who, when, which request), never with the file name. Only people who may open documents see those entries.
• No virus scanning. We have no virus scanner. So LeaveCalc never opens or shows an uploaded file: it only downloads, and the person who downloads it opens it in their own PDF reader or photo viewer. No file goes to a scanning service or to any other company.
• How long they are kept. The employer chooses: 1 year, 3 years (the default), 7 years, or until someone deletes them, counted from the last day of the request. Expired files are deleted automatically. The employer can delete one document, or every document of one person, at any time. Removing a person from the team does not delete their documents. Deleting the whole account deletes its documents.
• Backups. The nightly backup includes the documents (still encrypted). A deleted document stays in the backup copies made before it was deleted until they are replaced, within 14 days.

The employer decides whether to ask for documents, and is responsible for how it uses them. In the United States the FMLA (29 CFR 825.500(g)) and the ADA (42 U.S.C. 12112(d)) ask employers to keep medical certifications and medical information confidential and in files separate from the general personnel file; in the EU and the UK health data is special category data under Article 9 of the GDPR; in Canada PIPEDA asks for safeguards that match how sensitive the data is. LeaveCalc is built so an employer can meet those duties, but this page is general information, not legal advice.

The employer is in charge of its employees' data. In privacy-law terms, the employer is the controller: it decides what to enter, about whom, and why. LeaveCalc processes that data only to provide the service to that employer.

We never sell it. We never use it for advertising. We never use it to train AI models, ours or anyone else's.

If you are an employee and want to see, correct or delete records about you, ask your employer. They can do most of it directly in the app, and we help them with anything they can't. If you write to us instead, we will point you to your employer and help them respond.

The hosted service runs on a server we rent from netcup GmbH, a German hosting company, in its data centre in Manassas, Virginia, USA. Everything between your browser and that server travels over HTTPS. We take a backup every night and keep 14 copies on the same server, and each copy is checked with an integrity check. The database copies are not encrypted (the documents in them are, file by file), and there is no off-site copy. All the data is stored in Manassas, Virginia, USA, and nowhere else.

Our sub-processors, each for one job:

• netcup GmbH: hosting the server and the backups kept on it.
• Stripe: taking payments. Card details are entered on Stripe's own pages and handled under its own privacy policy. We see the ordinary merchant view: email, plan, amount, country, card brand and last four digits.
• Resend: sending the service's emails, such as weekly digests, reminders and account emails.
• Cloudflare: delivering mail addressed to contact@leavecalc.com to our inbox.

Nobody else. Places you choose to send data to yourself, such as your own Slack workspace (with the Slack app or an incoming webhook), a Teams channel, a webhook, an AI assistant that an owner connects with an API token (what the assistant reads goes to the company that runs it, under the owner's agreement with that company), your company's own identity provider when its people sign in with SAML, or your own Google or Microsoft account when you sign in or sign up with it or an owner connects a Google or Outlook calendar, are your own recipients and not our sub-processors. Slack, Google and Microsoft are not our sub-processors: Slack app, Sign in with Google, Sign in with Microsoft, SAML single sign-on and Calendar connections say exactly what each receives. We run no advertising pixels, no session recording, no heatmaps and no data brokers, and we have never sold or rented data to anyone.

Analytics, on the public pages only

No third-party analytics runs inside the app. The app keeps only the first-party usage log described above, on our own server. Google Analytics 4 (measurement ID G-YSXFCZ6S9H) runs only on the public calculator and information pages. It tells us which pages get visited, roughly from where, on what kind of device, and from which referring site or search engine. Google receives your IP address as part of that, and sets cookies named _ga and _ga_<id> to recognise repeat visits.

We also send a few named events: calculate, add_to_calendar, begin_checkout (with the payment link clicked), tracker_cta_click, etsy_click, employer_bridge_click and signup_click (the last two mark clicks towards LeaveCalc for Employers on the public pages; Google Analytics does not run inside the app itself). They carry the page path and the link clicked, never the values you typed in. A tracking blocker stops all of it, and the site works exactly the same.

Account data is kept while the account exists.

When a paid plan lapses, the data is frozen, not deleted. US FMLA rules require employers to keep leave records for three years (29 CFR 825.500), and a missed payment should not cost you records you are legally required to have.

Documents attached to requests follow the time the employer chooses (3 years after the request ended unless it picks 1 year, 7 years or never), as described under Documents and medical notes.

You can export everything at any time from Reports > Exports > Download backup.

To delete the whole account, email contact@leavecalc.com from the account owner's address. We delete it within 30 days and confirm in writing. Backups that still contain it roll off: the copies on our server within 14 days, and that includes the documents. There are no other copies.

• Passwords are hashed with scrypt.
• Two-step sign-in with an authenticator app is available to everyone who signs in with a password, and an owner can require it for owners and managers. People can also sign in with Google or Microsoft, and an owner can require that for the whole company. A company on the Business or Enterprise plan can use SAML single sign-on with its own identity provider and require it for everyone.
• Session cookies are HttpOnly, so scripts on a page cannot read them.
• Every record belongs to one company and every request is checked against it, so one company cannot see another's data.
• Every change is written to the audit log, which owners can read in the app.
• Documents attached to requests are stored encrypted, apart from the website, and every view and download is logged.
• Logins and requests are rate limited.
• Backups are taken every night, and 14 copies are kept on the same server, each checked with an integrity check. The database copies are not encrypted (the documents in them are) and there is no off-site copy yet.

No hosted system is free of risk, and we won't pretend otherwise. If we learn of a breach affecting a customer's data, we notify that customer by email without undue delay, with what we know, so they can meet their own notification duties.

Your employer may give you a link for sending leave requests. That page asks you to pick your name from your employer's list, choose the dates, and optionally add a note and your email. It never shows balances or anyone else's data. What you send goes only to your employer, who decides on it.

Available now. The Google button is on the sign-in page, on the invitation page, on an employee's own page and on the sign-up page. It is optional: a password still works unless an owner chooses to require Google for the company. Sign in with Microsoft works the same way and is described in the next section. SAML single sign-on for companies is described after that. There is no SCIM.

What Google tells us. We ask Google for three things only: your sign-in itself (openid), your email address and your basic profile. Google tells us your verified email address and your name, and its identifier for your Google account (and, for a Google Workspace account, the domain). We keep the email address, the identifier and the domain with your account. We use the name only to create a viewer account when someone joins by their company's domain, or the owner account when someone signs up with Google. We never receive your Google password. Sign-in gives us no access to your Google mail, files, contacts or calendars.

What Google receives. LeaveCalc sends Google none of the company's records when you sign in or sign up. Google only learns that you signed in to, or signed up for, LeaveCalc.

Signing up. A person whose Google address is verified, and who has no LeaveCalc account and no invitation waiting, can create a new company with Google. Google confirms the address, then you name the company and become its owner. Nothing is created until you do that, and the confirmation lasts 15 minutes and works once. Signing up never puts you into an existing company: if a company lets people at your domain ask to join, you are told, and you can create your own company or ask that company's owner for an invitation.

Signing in. Signing in with Google does not create an account. To sign in you need a LeaveCalc account first, an invitation sent to the same address, or an owner who has switched on “people with an address at this domain can ask to join as viewers” for your Google Workspace domain and approves your request. An employee can open their own page with Google when the verified address is the work address on file.

What we do with it. We use what Google tells us only to sign you in or create your account, to match you to your account and to show which Google account is connected. We do not sell it, use it for advertising, use it to train machine learning or AI models, or share it with anyone. LeaveCalc's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect. In LeaveCalc, open Settings > Account and disconnect Google. You can also remove LeaveCalc at myaccount.google.com/permissions. Questions: contact@leavecalc.com.

Available now. The Microsoft button is next to the Google button: on the sign-in page, on the invitation page, on an employee's own page and on the sign-up page. It is optional: a password still works unless an owner chooses to require Google or Microsoft sign-in for the company. Work or school accounts (Microsoft 365) and personal Microsoft accounts both work. SAML single sign-on for companies is described in the next section. There is no SCIM.

What Microsoft tells us. We ask Microsoft for three things only: your sign-in itself (openid), your email address and your basic profile. Microsoft tells us your email address and your name, and its identifiers for your account (the tenant, which is your organisation, and the account itself). We trust the email address only when Microsoft confirms that the owner of its domain has been verified; otherwise we treat it only as a suggestion, and nobody is signed in, linked or signed up by it. In that case you sign in with your password once and connect Microsoft in Settings > Account. We keep the email address, the identifiers and, for a work or school account whose domain Microsoft confirms, the domain with your account. We use the name only to create a viewer account when someone joins by their company's domain, or the owner account when someone signs up with Microsoft. We never receive your Microsoft password, and we keep no Microsoft token after you sign in. Sign-in gives us no access to your Microsoft mail, files, contacts or calendars.

What Microsoft receives. LeaveCalc sends Microsoft none of the company's records when you sign in or sign up. Microsoft only learns that you signed in to, or signed up for, LeaveCalc. Microsoft is not our sub-processor: you choose to use your own Microsoft account.

Signing up and signing in. The rules are the same as for Google. A person whose Microsoft address is confirmed, and who has no LeaveCalc account and no invitation waiting, can create a new company with Microsoft, and it never puts you into an existing company. Signing in does not create an account: you need a LeaveCalc account first, an invitation sent to the same address, or an owner who has switched on “people with an address at this domain can ask to join as viewers” for a Microsoft 365 domain that Microsoft confirms and that the owner proved by signing in with Microsoft, and who approves your request. A personal Microsoft account never proves a domain.

What we do with it. We use what Microsoft tells us only to sign you in or create your account, to match you to your account and to show which Microsoft account is connected. We do not sell it, use it for advertising, use it to train machine learning or AI models, or share it with anyone.

Your organisation's rules. The LeaveCalc app on Microsoft's side does not have a verified publisher yet, so Microsoft shows it as unverified. Some organisations' administrators block people from agreeing to unverified apps. If that happens to you, your IT administrator has to approve LeaveCalc before you can connect. We cannot do that for you.

How to disconnect. In LeaveCalc, open Settings > Account and disconnect Microsoft. You can also remove LeaveCalc at myapps.microsoft.com (work or school account) or account.live.com/consent/Manage (personal account). Questions: contact@leavecalc.com.

Available now. An owner sets it up in Settings > Account, and a company on its free trial can try it. People choose “Sign in with your company” on the sign-in page and sign in at the company's identity provider, which is Okta, Microsoft Entra ID, Google Workspace or another provider that supports SAML 2.0. A sign-in must start at LeaveCalc. The company's identity provider is chosen and run by the company, so it is not our sub-processor, and the setup guide for IT administrators is at leavecalc.com/developers/saml/.

What your identity provider sends us. A signed message that holds the person's email address, as the name ID or in one attribute the owner names, and sometimes a name (a display name, or a given name and a surname). It may also carry the time limit of the person's session. We ignore everything else in it. The email address has to be at an email domain that the company proved by adding a DNS record, and is matched to a person of that company only: an address that belongs to an account at another LeaveCalc company is refused, never linked or merged.

What we keep. The email address becomes the person's sign-in email, the same as for a password account. If the owner has switched on viewer accounts for new people from a domain, a person with no account gets a read only viewer account with that email address and the name the provider sent. For everyone else we do not store the name. A one-time sign-in ticket that holds the email address and the name is deleted within 15 minutes of use. To stop an assertion from being replayed we keep a hash of its identifier, not the message. We do not keep the response, the assertion or the identity provider's password, which we never see. The owner's choice of provider, its public signing certificates, the proved domains and the switches are kept with the company's settings. Each setting change, sign-in and failed sign-in is written to the activity log, with a short reason but never the message.

What the identity provider receives. The provider learns that a person is signing in to LeaveCalc. LeaveCalc sends it none of the company's records.

Sessions and requiring it. A session made by SAML lasts 12 hours at most. An owner can require SAML for everyone, and then passwords and Google or Microsoft sign-in stop working for that company. Owners keep an emailed one-time code so that a wrong setting cannot lock them out. What this does not cover is listed in the security overview. We use what the provider sends only to sign people in and to match them to their accounts. We do not sell it, use it for advertising, use it to train machine learning or AI models, or share it with anyone.

How to stop. An owner removes the identity provider or switches SAML off in Settings > Account, and people use their password again. Questions: contact@leavecalc.com.

Available now. An owner of a company account can add the Slack app in Settings > Integrations by choosing Add to Slack and approving the permissions on the Slack screen. Any Slack workspace can install it. It is not listed in the Slack Marketplace. The Microsoft Teams app is built but not switched on, so it is not available. Slack is your own workspace and your own choice, so Slack is not our sub-processor, as with an incoming webhook.

What people can do. They type /timeoff to ask for time off, see their balances, see who is out and see their own requests. People who decide a request get a direct message with Approve and Deny buttons. The app has an App Home tab, and an owner can choose a channel for a daily post of who is out.

What Slack receives. Names, dates, quantities and the balances shown to the person who asked. An approver’s message shows the person’s name, the leave type, the dates, the balance after and the note the person typed, if any. The lists of who is out, and the daily post, show names, dates and the leave type, except that sick, FMLA and protected leave read “Away”. Pay and FMLA case details are not sent. Slack keeps what we send it under its own terms, and the owner decides who is in the workspace and the channel.

What Slack tells us. We ask for the permissions chat:write, commands, im:write, users:read, users:read.email and channels:read. We read the workspace member list and the email address that Slack confirms for each member, only to match people to the team list; a person is found only through a confirmed address. We keep the workspace name and identifier, the access key (encrypted), and for each person found the Slack user identifier, a keyed hash of the confirmed email address (not the address itself) and the identifier of the direct message. We do not keep Slack message history. We use this only to run the app, and we do not sell it, use it for advertising or use it to train machine learning or AI models.

How to disconnect. An owner opens Settings > Integrations and chooses Disconnect. We then delete the access key, tell Slack to withdraw it, and stop posting; the time off records are not changed. A Slack workspace admin can also remove the app in Slack. Questions: contact@leavecalc.com.

Calendar feed (available now). In the app, Calendar > Subscribe gives a secret calendar link that you can add to Google Calendar, Outlook or Apple Calendar. It is a read only feed of approved time off and holidays, and anyone who has the link can read it, so keep it private. An owner can make a new link at any time, and the old one then stops working. The feed is served by LeaveCalc itself: using it sends nothing to Google or Microsoft, and it needs no Google or Microsoft account.

Google Calendar connection (available now). An owner of a company account can connect a Google account in Settings > Calendar. LeaveCalc then creates one new calendar in that account, named "Time off - " and the company name, and keeps it up to date. Nothing is connected unless an owner chooses to and approves the permission on the Google screen. Google is not our sub-processor: the owner connects their own Google account.

Outlook / Microsoft 365 connection (available now). An owner of a company account can connect an Outlook or Microsoft 365 account (work, school or personal) in Settings > Calendar. LeaveCalc then creates one new calendar in that account, named "Time off - " and the company name, and keeps it up to date. Nothing is connected unless an owner chooses to and approves the permission on the Microsoft screen. Microsoft is not our sub-processor: the owner connects their own Microsoft account.

What is sent. For each approved request (and, only if the owner chooses, each request waiting for approval or each company holiday) LeaveCalc writes one all-day event into that calendar: the employee's name or initials, the type of leave and the dates, as far as the owner's privacy choice for that connection allows. The owner can show the name and leave type, the name only, initials only, or no names at all. Sick leave and FMLA leave are never named by type. Nothing else about the employee, no balance, no note and no reason is sent. The event goes to the owner's own Google or Microsoft account, and only there. Google or Microsoft receives it and holds it under the owner's own account and its terms. The owner decides who the calendar is shared with.

What LeaveCalc can see. LeaveCalc asks Google only for the permission to create its own secondary calendar and to manage events on it (calendar.app.created), and for your account email address so it can show you which account is connected. It cannot read your other calendars. It reads back only the events in the calendar it created, to keep them correct. Events you add to that calendar by hand are left alone.

What LeaveCalc can see with Outlook. LeaveCalc asks Microsoft for the Calendars.ReadWrite permission, to stay connected (offline_access), and for your sign-in, email address and basic profile (openid, email and User.Read), so it can show you which account is connected. Microsoft's own consent screen words the calendar permission as full access to your calendars, because Microsoft has no narrower permission for this. The limit is in how LeaveCalc works, not in the permission: LeaveCalc creates its own calendar, and every call it makes is to that calendar only. It does not read or change your other calendars. The LeaveCalc app on Microsoft's side does not have a verified publisher yet, so Microsoft shows it as unverified, and some organisations' administrators block people from agreeing to unverified apps. If that happens, your IT administrator has to approve LeaveCalc before you can connect.

Where it is kept. The sign-in tokens that let LeaveCalc update the calendar (Google or Microsoft) are stored encrypted on our server in the United States. They are used only to update that calendar. They are never shown, logged or shared.

What we do not do. We do not sell this data, use it for advertising, use it to train machine learning or AI models, or transfer it to anyone except to provide the calendar feature you asked for, for security (for example investigating abuse), to follow the law, or as part of a sale of the business with your consent. Our people do not read it unless you ask us to look at a specific problem, it is needed for security, or the law requires it.

Google's rules. LeaveCalc's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API user data and developer policy, including the Limited Use requirements.

How to disconnect. In LeaveCalc, an owner opens Settings, Calendar and chooses Disconnect. LeaveCalc then deletes its copy of the tokens and, for Google, withdraws its access at Google. The owner chooses whether LeaveCalc also deletes the calendar it created; if not, the calendar stays as it is and stops updating. You can also remove LeaveCalc yourself at any time at myaccount.google.com/permissions. For Outlook, LeaveCalc cannot withdraw its access at Microsoft itself: it deletes its copy of the tokens, and you can remove LeaveCalc at myapps.microsoft.com (work or school account) or account.live.com/consent/Manage (personal account). If you ask us to close the company account, we delete the tokens too. Questions: contact@leavecalc.com.

The app sets one cookie that keeps you logged in: the session cookie. If you turn on two-step sign-in and choose to remember a device, it sets a second cookie for 30 days that does that. There are no third-party cookies in the app. The public pages set only the Google Analytics cookies described above.

The calculators and the tracker use local storage, described earlier. Local storage is not a cookie and is never sent to any server; it sits on your disk until you clear it.

LeaveCalc is not a healthcare provider or a health plan. FMLA records held by an employer are employment records, not HIPAA records. That doesn't make them less sensitive, and it is exactly why we ask employers to record only a leave reason category in the case records, never a diagnosis or medical detail. A document that an employer asks for, such as a doctor's note, is the one place where medical detail can be held, and only because the employer chose to ask for it.