Privacy
Last updated 2026-08-21
The short version
openSIF does not collect your payroll data. Not as a promise — there is no route on this server that accepts employee records. The salary file is built by JavaScript running inside your browser, from data that never leaves the device you typed it on.
What you type
Company details, employee names, civil ID and passport numbers, bank accounts and salary amounts are held in your browser's memory while you work, and saved to IndexedDB — a store inside your own browser profile — so an unfinished payroll survives a reload.
That storage belongs to your browser, on that device, for this site alone. It is not synchronised, not backed up by us, and not readable by us or anyone else. Clearing your browser's data for this site removes it, and the Erase everything stored locally button on the review step removes it immediately.
The file itself is assembled in memory and handed straight to your browser's download. It is not uploaded anywhere, at any point.
What the server sees
Loading a web page means your browser asking a server for it. Like any website, that request appears in the host's own server log — typically your IP address, the time, the page requested and your browser's user-agent string. We do not add to that log, join it to anything, or use it for analytics. It records that a page was served, not who you pay or what you pay them.
Counters
openSIF can be configured to count how often it is used. This is off in the
default configuration. When switched on it stores, per day: an event name from
a fixed list — wizard_started, employees_added,
file_generated — and a coarse size band such as 6-20.
It stores no IP address, no user agent, no session identifier, no employee data, and nothing derived from any amount. The result is a table of integers that cannot be traced back to a person or a company.
Cookies and other sites
openSIF sets no cookies. It uses localStorage for exactly one
thing: remembering whether you read English or Arabic.
There is no analytics service, no advertising, no tag manager and no content delivery network. Typefaces are served from this domain rather than a font host. The page is delivered with a Content-Security-Policy that forbids it from contacting any other server at all, which is why it still works with the network disconnected — disconnect and try it.
The one outbound link is Buy me a coffee on the success screen. Following it takes you to a third party with its own privacy policy. Nothing about your payroll goes with you.
Your rights
Because we hold no personal data about you, there is nothing for us to disclose, correct, export or delete on request. The data you entered is on your device and under your control, and the tool gives you a button to destroy it.
Changes
If this policy changes, the date at the top changes with it.
Contact
Sumon M. · musumon4u[at]gmail.com