What DunDunSee stores. Exactly where.

The three places data can go

Working memory: while you calculate, your entries and results are held in the open browser tab. Working memory is not a saved record in itself.

Session storage: five small records remember tutorial and interface progress in this tab. They may survive reloads or a restored browser session.

Local storage: one optional record can hold returning check-in details across visits. That can include salary, debt, calculated summaries and a dated array of categorised personal notes (including the original hope field migrated from earlier saved records). It stays on this browser unless you clear it.

The application does not create a DunDunSee account or submit financial calculations to a DunDunSee backend.

All six keys, exactly as used in the code

• dundunsee-brand-reveal-seen (session): opening animation viewed
• dundunsee-returning-checkin-user (session): returning-check-in flow
• dundunsee-intro-tutorial-offer-seen (session): tutorial offer shown
• dundunsee-tutorial-viewed-this-session (session): tutorial viewed
• dundunsee-user-session-v1 (session): tutorial, animation and first check-in flags
• dundunsee-checkin-memory-v1 (local): optional check-in history, financial summaries, preferences and categorised notes in the same saved record

For a live presence check without exposing their values, open DunDunSee, choose Info → Privacy → Check this browser. The check reads only whether each named record exists. It never displays, uploads or sends the stored values.

The Clear saved information button in Info now removes and verifies all six DunDunSee keys: the persistent check-in record and all five session flags in the current tab. It then restarts from the clean homepage, discarding working calculations. If deletion cannot be verified, the app reports a failure instead of claiming success.

It does not erase browser history, caches, downloads, copied links, third-party records or session storage in other open tabs. Another open DunDunSee tab could recreate shared local storage; close those tabs too if you want a comprehensive reset. Fresh visits can create new interface flags as you use the site. Browser settings can clear additional site data.

Exactly which services are contacted?

• Vercel: dundunsee.com delivers the site's pages, scripts, images and fonts. The host necessarily receives normal HTTP requests and may keep infrastructure logs.
• Cloudflare script: static.cloudflareinsights.com/beacon.min.js loads one site-analytics script per page.
• Cloudflare report endpoint: cloudflareinsights.com/cdn-cgi/rum receives page visits and performance reports. These can include the visited path, referring site, device/browser/OS and approximate country. Cloudflare says it does not log query strings or use tracking cookies for Web Analytics. Standard web requests can still reveal connection metadata to the receiving service.
• Monzo: only if you choose a support-payment link. Payment details are handled on the external Monzo Business page, not in DunDunSee.
• External guidance links: only when you choose to open GOV.UK, Acas, MoneyHelper or other linked sources.

A company-scheme link can contain ddsScheme, ddsWeeks and an optional ddsLabel in its visible URL. Anyone receiving the link, your browser history and the website host may see that URL. It does not include your private redundancy figures.

What we have limited, and what we cannot promise

There are no advertising pixels, custom analytics events, user-session recordings or application-set tracking cookies. We do not intentionally add financial inputs or check-in notes to analytics reports. The site's Content Security Policy allows Cloudflare's specific script path and reporting host, rather than a general allowance for outside scripts or connections.

The limitation: Cloudflare's JavaScript still executes within a page that may contain sensitive information. An external script can technically interact with the page, even with our restrictive security policy. We cannot honestly promise that any third-party script has zero risk. We keep the integration narrow and publish exactly what we have approved.

Browser extensions, content blockers, hosting infrastructure, cached assets or browser cookies are outside this six-key app inventory. This page is an account of the application source, not a guarantee about third-party systems.

Verify it yourself

On a desktop browser, open Developer Tools and find Application → Storage (or Firefox's Storage tab). Inspect Local Storage and Session Storage for this site's domain. The exact six app keys above are your reference, although some may not have been set yet.

Open Network, reload, and filter for cloudflareinsights or cdn-cgi/rum. You should see the Cloudflare script and its performance-report request unless your browser blocks them. You can inspect the site's Content Security Policy in the response headers. Do not share screenshots containing your saved financial values.

Read the machine-readable data inventory (JSON)