Privacy

Nothing typed into a calculator is transmitted. The balance, the rate, the term, the payment, the dates and any extra payments are read by a script running on your own device, the amortization schedule is built there, and the result is written straight back into the page. There is no server of ours to receive any of it. The site is a folder of static files on a content delivery network: no account, no sign-in and no database. The host that serves those files logs the requests for them, as every web server does — but a request carries only the page address, and the numbers you type are in the fragment, which is never part of it. There is no record of a calculation kept anywhere, here or elsewhere.

The Copy link button is the one exception, and you decide where it goes. It writes your inputs into the address bar as a query string — /?p=20000&r=6&n=60&mode=payment — so that a scenario can be bookmarked or sent to someone. The link carries amounts, a rate, a term, a mode and a start date, and nothing else. In the planner, the labels you give each debt are not encoded at all; the balances, rates and minimums travel by position. Sending that link is your action, not the site's.

The page address reported to measurement is the origin and the path, never the query string. A page opened with a scenario in it reports https://loan-payoff-calculator.com/ and stops there. That is a deliberate setting rather than the default, and the built pages are tested for the default form before they ship, because sending the whole address would put a visitor's balance and rate into an analytics property.

This site carries advertising served through Google, and advertising uses cookies. Google's ad script loads in the head of every page here, this one included. The ad units themselves sit below the content on the pages that carry them; no page on this site places an ad above a calculator's result.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or to other sites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. Those cookies are set and read by Google on its own domains, not by this site, and Google's handling of them is governed by Google's own policies.

You can opt out of personalized advertising at any time. All three routes are off-site, and all three work today:

The same slots still fill; the ads in them are chosen without that browsing history. Nothing you calculate here feeds any of it either way. The numbers you type are kept in the part of the address after the # symbol, which browsers never send to any server — not to this site's host, not in a referrer, and not in an ad request. The page address an advertiser sees is the page, never the scenario. This site has no lender relationships, no offers and no affiliate links, and nothing advertised here is recommended by it.

Ads can also appear when advertising storage is denied outright — by a regional default, by Global Privacy Control or by your own choice in the footer. What changes in that state is that they are selected without advertising cookies and without personalization.

Google Analytics 4 records page views and four coarse actions. These four are the entire list of events the site sends — not a summary of a longer one:

The only parameters any of them carries are the calculator mode — payment, months, minimum, bi-weekly, snowball, avalanche or both — and the path of the page, such as /mortgage-payoff-calculator. No balance, no rate, no term, no payment, no date, no amount, ever.

Enhanced measurement is switched off on the property, every flag. That is the GA4 feature which otherwise adds scrolls, outbound clicks, site search, video engagement and form interactions on its own, without anything being written in the page. It was turned off at the property's creation and confirmed by reading the settings back, because the response to a settings write cannot distinguish a flag that is off from one that was never sent.

Event data retention is 14 months, the longer of the two periods GA4 offers, after which event-level rows expire. Google states that Analytics 4 does not log or store individual IP addresses; the address that necessarily arrives with any request over the internet is used to derive a coarse location and then discarded.

In the EEA, the United Kingdom and Switzerland, measurement and advertising storage are denied when the page loads and stay denied until you consent. That default is queued before any Google tag runs, which is the part that does the work: a default applied after a tag has already written a cookie changes nothing about the cookie.

Everywhere else, measurement and Google's three advertising signals — storage, user data and personalization — are all on from the first page load, and the Privacy choices link in the footer turns them off at any time. It is in the footer of every page, including this one. Choosing “Keep it private” denies measurement and all three advertising signals — storage, user data and personalization — immediately, and again on every later visit in that browser. Choosing “Allow measurement” grants measurement alone and does not grant advertising storage, because that is not what the button asks for.

The site honors Global Privacy Control. If your browser sends the GPC signal and you have made no choice here, measurement and the three advertising signals are all denied before any tag runs, with no action from you — that is treated as an opt-out of any sale, sharing or targeted advertising. A choice made in Privacy choices takes precedence from then on, in both directions: it is the later and more specific decision, and it is reversible at any time from the same place.

This site does not respond to browser “Do Not Track” signals, because no common standard for interpreting them has been established. Global Privacy Control is a different signal with an agreed meaning, and it is honored as described above.

The only thing this site stores is your consent choice. It is a single entry in local storage, under the key lpc:consent:v1, whose value is the word granted or the word denied. There is no identifier, no visit counter, no saved scenario and no remembered balance. Where local storage is unavailable — some private windows refuse it — the choice applies to that page load and is gone afterward, which is the correct outcome rather than a fault.

Google's tags set their own cookies, and only where consent allows it. With measurement allowed, Google Analytics sets its _ga cookies so that repeat page views can be told apart. With advertising storage allowed, Google's advertising cookies are set by Google. Denying either — through Privacy choices, through GPC, or through the regional default — stops the corresponding cookies from being written at all, rather than writing them and disregarding them afterward. The Google tag still loads, since a script tag in the page cannot be un-run, but in that state it sets no cookie and carries no identifier.

If you live in the United States, you may ask what is held about you and ask for it to be deleted or corrected, and you may opt out of any sale, sharing or targeted advertising. Global Privacy Control is honored on this site, and the Privacy choices link in the footer of every page is the always-available opt-out. We will never treat you differently for making a request — no feature is withheld, no page is degraded, and nothing here is priced at all.

If the UK or EU GDPR applies to you, you may ask for access to your data and a copy of it, have it corrected or deleted, have processing restricted while a dispute is resolved, receive it in a portable form, and withdraw consent at any time. Withdrawing is as easy as giving — the same footer link, the same two buttons — and does not affect what was done beforehand. In the EEA, the United Kingdom and Switzerland nothing is measured until you consent in the first place.

Write to support@zwstudiollc.com to use any of these. A reply comes within one month, extendable by two for a complex request, and it costs nothing. Because there is no account and no server of ours to hold anything, the usual answer is that there is nothing to produce — and where that is so it will be said plainly, rather than asking for more identifying information than the request needs.

You may complain to a data protection authority at any time: in the United Kingdom the Information Commissioner’s Office, in the European Economic Area the authority for the country where you live or work, and in Switzerland the Federal Data Protection and Information Commissioner. We would rather you told us first, so it can be put right.

This site is not directed to children under 13, carries nothing aimed at them, and knowingly collects nothing from them. It collects no personal information from anyone: there is no field that asks who you are, no sign-in, and no input whose contents are transmitted. If you believe otherwise, write to the address below and say what you have seen.

This site is operated by ZW Studio LLC, a limited liability company formed in the State of New Jersey, United States. Privacy questions go to support@zwstudiollc.com, which is also the address on the contact page.

That includes a request to know or delete personal information held about you. The honest answer in advance is that there is none to produce: the calculations run in your browser, the events described above carry a mode and a page path, and the one thing stored on your device is the consent entry, which you can clear yourself. How the arithmetic works is set out on the methodology page, and who builds the site is on the about page.

This page carries no “last updated” date on purpose. A build date is not a legal claim. A policy that describes the code currently deployed is either accurate or it is not, and when the code changes this page changes in the same deploy.