Privacy
What pound.one receives when you use the website, API or assistant tools.
Updated 6 October 2026. This notice covers the pound.one service and its MCP plugin.
Calculator inputs
The service processes the amounts, years and options you send to produce a calculation. The MCP server does not retain tool arguments, results or error messages in its usage analytics. It does not request your name, email, financial account details or conversation history. Your assistant provider decides which tool arguments to send and handles your conversation under its own privacy policy.
Access records and usage counts
Requests produce access records containing the time, IP address, user agent, request method, path and query string, status, response time and referring URL when supplied. Calculator-page URLs include amounts and other inputs, so those values can appear in access records and in links you share. Avoid adding private information to URLs.
The private operations dashboard counts requests, tool calls, successes, errors, timings, referring sites and campaign tags. It groups client software and regions and uses daily salted address hashes for distinct-address counts. Recent requests and errors retain their raw addresses and user agents in bounded lists. These application counters and lists are kept in memory and reset when the process restarts; they are not a count of identified people.
Browser activity signals
Public pages run a small first-party JavaScript check to help separate browser use from crawler requests. When a page is visible, it sends the page path, whether the stylesheet has applied, and a random identifier for that one document. A click, tap, keypress or wheel action can send one additional interaction flag. The check does not send typed text, key values, pointer positions, form contents, query strings or browsing history. Calculator amounts already present in the page path can appear in the recent browser-activity list.
The identifier lives only in the page’s memory; it is not saved in cookies or browser storage. The server keeps bounded counts and page identifiers in memory until UTC midnight or a restart, plus the latest 20 browser-activity entries. Daily salted IP-address hashes estimate distinct callers who interacted; raw addresses and user agents are not retained in this separate browser-activity record. These signals are estimates, not identification or proof of a human visitor. The check skips browsers reporting automation, Do Not Track or Global Privacy Control.
Hosting and retention
Fly.io hosts the application and receives its access logs. Cloudflare handles traffic in front of it and provides cookieless traffic analytics. These providers process request data to deliver, secure and monitor the service. Infrastructure logs and analytics have retention separate from the application’s in-memory counters; restarting the application does not erase those provider records.
Cookies and sharing
The application and MCP server do not set cookies or use advertising trackers. Result links returned to assistants may contain utm_ campaign tags so we can count visits from those links. Third-party assistant services and websites have their own data practices.
Questions
See support for questions about the service or its handling of request data. When asking about an incident, share the approximate time and affected endpoint; do not send passwords, API keys or financial account details.