Privacy notice

The short version

• What you put in your tools is yours. We don't look at it unless you give us temporary, read-only access.
• We never ask for or store bank logins, full account or card numbers, Social Security numbers or credit reports, and WageRouter doesn't connect to your bank.
• No advertising, no tracking, no selling or sharing your information.
• You can ask us to delete your account and everything in it at any time.

Who we are

WageRouter is a private online tool owned and operated by Improvenhance, LLC ("we"), a Texas limited liability company and financial counseling practice. We use it to serve our clients: accounts are created by invitation only. Contact: support@wagerouter.com.

What we keep

• Your account: name, email address, time zone, whether you've turned animations and sounds off, the tools you chose for your phone's tab bar, the cards you chose for your Home page and their order, and whether you've answered the sample data offer and which sample you loaded. Your password is stored only as a one-way hash (Argon2id), never as the password itself.
• Sign-in links: the links in invitation and password-reset emails are stored only in scrambled (hashed) form, work once, and expire (48 hours for an invitation, 1 hour for a reset).
• Two-factor sign-in, if you turn it on: which method you chose and when. For an authenticator app, the secret it shares with us, stored encrypted. Emailed codes and recovery codes are stored only in scrambled (hashed) form, and each works once.
• What you enter in your tools: for example notes, and later amounts, due dates and account nicknames. For any account we keep at most a nickname and the last four digits.
• PIP Profiles, if you use them: identities for job applications that are meant to be approximated, not your real details: one date of birth and US address, and for each profile a label, a purpose, a name, a phone number and an email address. Please don't enter your real ones there.
• Employment, if you use it: your work history as you enter it: employers, job titles, types of work, locations, dates and descriptions, and career gaps with their reasons. For each job, optionally, the industry, company size and employer type, and your pay: the rate, how it was set, how often you were paid and your usual hours.
• Education, if you use it: schools, credentials, fields of study, online courses (platform, instructor, website), locations and dates.
• References, if you use them: the name, relationship, job title, organization, phone number and email address of people who agreed to be your references, and which of your jobs and schools each one can speak to. This is information about other people: only add someone who has agreed to it.
• Credentials, if you use them: your certifications, degrees, diplomas and licenses: the title, category, issuer, issue and expiry dates, which of your schools each came from, and a copy of the document you upload (a PDF, JPEG or PNG, with its file name and size). A photo's hidden details, such as where and when it was taken and the phone that took it, are removed before it's stored; PDFs are kept as you upload them. The copy is encrypted by WageRouter before it's stored, and only you can open it (and support, while you have support access switched on). Please don't upload ID cards, bank statements or credit reports.
• Skillset Profiles, if you use them: groupings of your skills for a kind of job: a name, a description, an expertise, supporting and related skills, tools, and which of your jobs, schools, other skillsets and credentials each one is linked to. The job-title search that suggests skills runs on our own server; nothing you type is sent anywhere else.
• Application Profiles, if you use them: for each kind of job you apply for, a title, a note on its purpose, and which of your PIP profiles, skillsets, jobs, schools, references, documents and credentials it uses. It holds no new details of its own: it points at the records above.
• Supporting Documents, if you use them: transcripts, exam scores, letters of recommendation and other files you may attach to applications: a title, a category, and the file you upload (a PDF, JPEG or PNG, with its name and size), with a photo's hidden details removed and encrypted the same way as credentials. Letters may name other people; only upload ones you were given to use.
• Incoming Wages, if you use it: each place you earn from: the employer and its details, your position and type of work, dates, and your pay as you enter it (rate, how it's set, how often, hours, usual tips, projects a month), notes, and which job in Employment it comes from. The monthly and yearly figures on the page are worked out from these each time and aren't stored.
• Bring in more, if you use it: the changes you try on your pay (more overtime or hours, more projects, a new rate at one of your jobs) and the pretend jobs you add (their kind of work, pay, and hours or gigs), kept until you clear them, so you can come back to them. They never change your wage sources. The figures are worked out from these, your wage sources, your paychecks and your bills each time, and aren't stored.
• Wage Router, if you use it: your routes, the accounts you give your take-home a job in: what each is for (emergency savings, card payoff, spending money, or one you name), an amount a month, a nickname for the account and, if you add them, its last 4 digits (never more of an account number), a short note if you write one (it can't hold five digits in a row, so no account or card number), and for emergency savings your goal in months of bills and what you've saved so far. The same details (a nickname, the last 4 digits, a note) for the account your bills are paid from, if you add it. WageRouter doesn't connect to your bank or move any money. The flow is worked out from these, your wage sources, your paychecks, your bills and, when you switch it on, your Bring in more what-if, each time, and isn't stored.
• Paychecks, if you use it: the paychecks you copy in, each with the wage source it's from: the pay date, gross and net pay, and if you add them the pay period, hours, hourly rates and year-to-date gross and net; and each line: what it is (for example Medicare, a 401(k) or a union dues line), its name as your paycheck prints it, and its amount. Long numbers in a line's name (seven digits or more, like an account or employee number) are replaced with dots before it's saved. No image of a paycheck is kept. The totals, the monthly take-home and whether a paycheck adds up are worked out each time and aren't stored. You can upload a paycheck (its PDF, or a picture of it) for the AI Assistant to read instead of typing it: you cover your private details on your phone first, and only a covered picture of it is sent; the PDF itself never leaves your phone. It's read once, in memory, and never stored by WageRouter; we keep what was read (the numbers and line names) until you save the paycheck or for a day at most, and each read's size and cost, like any AI request.
• Your benefits guides, if you upload one: for a job, your employer's benefits guide (a PDF you upload), and what was read from it: whether the job matches what you save for retirement and how much, whether it offers a health savings account and what the employer puts in it, its flexible spending accounts and commuter benefits, the insurance it offers through work (disability, life, accidental death and others: who pays for each, and its coverage in the guide's words), the plan year, and the page each is on. The whole guide is sent to the AI to be read (see Anthropic, below). A file that shows a Social Security number or a full account number, or isn't a benefits guide, is never kept. A clean one is kept, encrypted, with the name it was uploaded with and its size, for you to open, replace or delete; deleting it deletes what was read from it too, and so does deleting its job or your account. A reading you don't save is deleted, with its guide, within a day.
• Outgoing Wages, if you use it: your bills: what each is for, its name, who it's paid to, the amount, how often, whether it's required or flexible, a due date and notes. Never account numbers. The monthly totals are worked out each time and aren't stored.
• Job Search, if you use it: what you searched for (a job title or skill, a place, and how recent the jobs should be) and the jobs the search found (each job's title, employer, place, pay, description and where to apply), so you can read a job's description and see more results. They're deleted 24 hours after the search. "Search as" uses one of your Application Profiles' titles and the city and state from your PIP details, and keeps which profile you searched as with the search, for the same 24 hours.
• Resumes & Letters, if you use it: the cover letters you write (a title, a greeting, the letter and a closing) and which letter each Application Profile uses, kept until you delete them. A profile without a letter of its own gets a base letter, written from the profile each time it's shown and kept only if you edit and save it. A resume or letter PDF is made from your Application Profile each time you open or download it, and it isn't stored: it goes only where you download or share it. The Apply kit on a Job Tracker entry shows you your details ready to copy into an application form, including your street address and date of birth from your PIP details, and makes the resume and a letter addressed to that job; it keeps nothing new.
• AI Assistant, once you agree to it: every client has it, and it works only once you agree to its terms, in its settings or with a box on the first paycheck or benefits guide you upload. We keep when you agreed, and for each AI request its size and cost (the AI model, how many words it read and wrote, in the AI's units, and the amount), to count against your monthly allowance. We don't keep what was sent or answered in that record. When you check your fit for a job, we keep that check with the Job Tracker entry: the job's description as it was, a copy of what was sent to the AI, its answer (what the job asks for, and its questions), and your answers and notes. Skills you say you have become draft skillsets in Skillset Profiles, marked for you to review. When you write your tailored resume and letter and ask for changes, we keep, with the same entry, a copy of what was sent to the AI each time, each version it writes, and what you asked it to change; and when you edit them by hand, your own version (it isn't sent to the AI unless you then ask for a change). The tailored resume and letter PDFs are made from the latest version each time you open them and aren't stored. All of it is deleted with the entry.
• Job Tracker, if you use it: each application you log: the company, the position, where you found it, the posting's link, the place, its status (from saved to offer), the date you applied, which Application Profile you used, your notes, and the job's description. A job you open from Job Search with Apply with my kit is copied here, with the profile you searched as, and waits under "Preparing to apply" until you say you applied; it stays after the search is deleted, until you delete the entry. If you tap Fetch details, WageRouter's server opens the posting's link on that job site (only well-known job sites) to read the job's details into the form; the site sees our server, not you, and nothing is kept unless you save the entry.
• Sample data, if you load it: a copy of a complete example account (its records in the tools above, and its documents) is stored in your account like your own entries, marked Sample, until you delete it in Settings. The built-in sample (Clark Kent) is fictional. The other sample, when it's offered, is an example account of the owner's own: what the owner chose to share about themselves, never anything from another client's account. Your information is never used in a sample.
• Notifications and messages we send you inside the app.
• Our notes about our work with you: as your financial counseling practice, we may keep notes in WageRouter, for example what a session covered and what we agreed to do next. Only we can see them; they're never shown in your account. They're deleted with your account.
• An activity record: when something in your account changes, we record who made the change (you or us), in which tool, which fields changed and when, but never the old or new values. We also count which tools are used, to learn what's useful.
• Security records: failed sign-in attempts, counted for the email address they used and for the network (IP) address they came from, to stop password guessing. A record only lasts while it counts (a 15-minute window, and a 15-minute pause after too many failures), then it's deleted within minutes: never longer than about half an hour.
• Technical logs and error reports: which pages were requested and whether they worked. When a page fails, we note which kind of page it was (not its address) for 30 days, and send an error report to our error-monitoring service with personal and financial details removed before it leaves our server. Logs never include what you type into forms or your passwords.

What we never collect

Bank or card logins, full account or card numbers, Social Security numbers or other government ID numbers, copies of ID cards, and credit reports. WageRouter does not connect to banks (for example through Plaid).

Cookies and your device

One cookie, which keeps you signed in. If you use two-factor sign-in, a second one lasts the few minutes between your password and your code, and only remembers that your password was right. They're required for the app to work, and they aren't used for tracking. We use no analytics, advertising or social-media cookies. If you install WageRouter on your phone, it keeps a copy of the app's own files (styles, icons, fonts) so it opens quickly; your information is never stored there.

Email

WageRouter emails you only about your account: your invitation, password resets, a notice whenever two-factor sign-in changes (so you'd hear about a change you didn't make) and, if you choose email codes, your sign-in codes. Replies reach us at support@wagerouter.com.

Who can see your information

• You. Each account's data is kept separate, and the app is tested so that one client can never see another's.
• Us, for running your account. We see your account details (name, email, time zone, when you joined and last signed in, whether two-factor sign-in is on), the activity record above and which tools you use. We don't see what you enter in your tools. If you lose your phone or email, we can turn two-factor sign-in off for you once we've confirmed it's you; you'll be told when we do. To send one message to several clients at once, we may put your account in a group (a label of our own, such as a workshop you attend); group names aren't shown to clients, and we keep them neutral. We also keep test accounts of our own, to see WageRouter as a client does; we can switch into those, never into yours. If we ever ask to use an account as a test account, its Account page asks whoever is signed in to confirm or decline, and declining changes nothing.
• Us, with support access, only if you allow it. A switch at the top of the Help & support page gives us temporary, read-only access to your tools so we can help with something specific. It switches off on its own after 24 hours, you can switch it off at any time, and we switch it off as soon as your question is answered (you get a notification when we do). When you switch it on, our support mailbox gets an email saying that a client did; it doesn't name you or include anything from your tools. Every page we view is recorded in a log you can see.
• Our service providers, each handling information only to provide its service to us:
  • Fly.io runs our servers and database in the United States (Dallas, Texas). Everything you enter is stored there.
  • Namecheap (Private Email) sends our account emails, so it handles your name, email address and those messages.
  • Sentry receives error reports, with personal and financial details removed, stored in the United States.
  • JSearch, OpenWeb Ninja's job listings service (which we reach either directly or through its marketplace, RapidAPI), finds the jobs for Job Search. It receives only what you search for: a job title, a place and how recent the jobs should be. The search comes from our servers, so it never receives your name, email address or anything about your device.
  • Anthropic makes Claude, the AI behind the AI Assistant. When you use the AI Assistant, Anthropic receives the job posting and your application profile's records: your jobs and their descriptions, skillsets, schools and credentials; and, when it writes your tailored resume and letter, your answers to its questions (with your notes) and the changes you ask for; when you upload a paycheck, the covered copy of it (whatever you left uncovered is in it, so cover your name and numbers); and, when you upload a benefits guide, the whole guide as you upload it (so upload your employer's guide, not a page with your personal details). It never receives your name, phone, email, address, date of birth or your references from your records. Anthropic doesn't use what it receives to train its AI, and deletes it within 30 days, unless its safety checks flag a request (then it can keep it for up to 2 years) or the law requires keeping it.
  • Tigris (Fly.io's file storage) stores the documents and benefits guides you upload, and our nightly backups. Each file and each backup is encrypted by WageRouter before it's sent, with keys Tigris never has, so Tigris can't read them.
• When the law requires it, for example a valid court order.

We will list any new service provider here before it handles your information.

How long we keep it

As long as your account is open. When you ask us to close it, we delete your account and everything in it, including its activity record and our notes about our work with you.

Job Search keeps your searches and the jobs they found for 24 hours, then deletes them.

Backups. Every night we make an encrypted backup of WageRouter, including uploaded documents, so that your information can be recovered after a mistake or a failure. We keep a backup from each of the last 30 days and one from each of the last 12 months, and delete older ones. Something you delete, or a closed account, stays in the backups made before it was deleted until they expire: at most about a year. We use backups only to restore WageRouter and to check that restoring works, never to look at anyone's information.

Once a month we also keep a copy of the latest backup on an encrypted drive that we hold ourselves, so that WageRouter can be restored even if our hosting provider failed. Those copies are deleted after a year too. The same monthly check restores the backup on our own computer into a temporary database held only in memory, counts what's in it without opening any records, and erases it straight away.

Your choices

You can see and change your details in Account and Settings, and give or cancel support access on the Help & support page. To get a copy of your data, correct something you can't change yourself, or delete your account, email support@wagerouter.com.

Security

Every connection is encrypted (HTTPS), and the database is stored on an encrypted disk. Backups are encrypted before they leave our servers: the database backups with a key kept offline, away from any server, and the documents with the same key that protects them in the app. Passwords are hashed and common ones are refused, sessions can be ended on every device at once, and repeated failed sign-ins (for one email address, or from one network) are blocked for 15 minutes. You can turn on two-factor sign-in on your Account page, so that a code from your email or an authenticator app is needed as well as your password. Our own admin account can't reach the admin pages without it.

Adults only

WageRouter is for adults. We don't knowingly create accounts for anyone under 18.

Changes

If this notice changes in a way that matters, we'll tell you in the app before it takes effect.