Terms and privacy
Effective October 19, 2026 · Beta
TwentySix is an independent tool for checking Foreign Service pay, tracking leave and planning retirement. It was built by a federal employee on personal time. It is not a product of, or endorsed by, the U.S. Department of State or any other part of the U.S. government.
Terms of usePrivacy noticeWhat's collectedHow long it's keptYour choicesContact
Terms of use
Estimates, not official determinations
TwentySix compares what your Earnings and Leave Statement (LES) shows with what published pay rules suggest you should have been paid. It also estimates leave balances and retirement income. These are estimates. They can be wrong because of how the app reads your LES, the information you enter, pay-rule changes, or mistakes in the app. Nothing in TwentySix is financial, tax, legal or HR advice.
Before you act on a result, including filing a pay claim or making a retirement decision, check it with your payroll office, HR or a qualified adviser. If TwentySix says you were overpaid or underpaid, treat that as a reason to ask, not as proof.
Beta
TwentySix is in beta. Features may change, break or be removed, and the service may be paused or ended. It's free during the beta. If paid plans are offered later, they'll be described clearly before anyone is charged, and nothing you already use will be charged without your agreement.
Your account and your data
- Accounts are optional. You're responsible for keeping your password safe and for keeping backups. Download an encrypted backup under Data.
- Your saved data is encrypted with your password. If you reset a forgotten password, the copy saved with the old password can't be opened. Your devices keep their own copies and can save them again under the new password.
- Use a personal device. Don't put TwentySix on a shared or government computer, and follow your agency's rules for handling pay records.
Acceptable use
Don't try to break into, overload or reverse the encryption of the service or other people's accounts. Don't upload anything you don't have the right to use. Accounts used to abuse the service may be removed.
No warranty and limited liability
TwentySix is provided "as is," without warranties of any kind, including accuracy, availability and fitness for a particular purpose. To the fullest extent the law allows, the people behind TwentySix aren't liable for losses that result from using it or relying on its estimates, including lost pay, benefits, data or opportunities. If a paid plan exists in the future, total liability won't exceed what you paid in the previous 12 months.
Changes
These terms may change as TwentySix develops. The effective date above will change, and material changes will be noted in the app. Continuing to use TwentySix after a change means you accept it.
Privacy notice
TwentySix is built to know as little about you as possible. There's no advertising, no third-party analytics or tracking code, and no selling or sharing of data for marketing.
What's collected
| What | Where it lives | Who can read it |
|---|---|---|
| Your pay, leave, travel and retirement numbers. When you upload an LES or timesheet, it's read in your browser and then discarded. Only the numbers are kept. The reader skips names, SSNs, employee IDs, addresses and bank details. | Your browser's storage on your device | Only you, on that device |
| Account (optional): your email, a password managed by Supabase Auth, and an encrypted copy of your data with a random salt, the device type that last saved it, a version number and save times | Supabase (database and sign-in provider) | The encrypted copy can only be opened with your password, in your browser. The TwentySix admin can see account emails, sign-up and sign-in times, and when and how much data was saved, but not its contents. |
| Anonymous usage and error reports (can be turned off): a random install ID, the app version, your job type, device and browser type, whether you're signed in, the screen you're on, and scrubbed error messages (emails, dollar amounts and long numbers are removed in your browser before sending). For LES files, the report says only whether the file was read, which stage failed or which fields came back empty, never the values. | Supabase | The TwentySix admin. Install IDs aren't linked to accounts. |
| Feedback you send: your message, an optional reply email, the install ID, app version, device type and screen. Device diagnostics are attached only if you tick the box, and never include pay figures. Please leave out personal details. | Supabase | The TwentySix admin |
| Password reset requests: a one-way hash of the email and of the network address, used to stop abuse. Reset codes are sent by an email delivery provider (Resend or Brevo), which receives your email address and the message. | Supabase and the email provider | The TwentySix admin sees counts only |
Other services involved
- Hosting. The app's files are served from a Perplexity-hosted website, which receives normal web request information such as your IP address.
- Fonts. Fonts load from Fontshare, which also receives normal web request information.
- Pay rates. The public pay-rate list is checked weekly against official sources and served from Supabase. Reading it sends nothing about you.
How long it's kept
- Data on your device stays until you delete it, under Data → Delete all data, or clear this site's browser data.
- Your account and its encrypted copy stay until you delete the account under Data.
- Usage and error reports are deleted after 13 months.
- Password reset logs are deleted after 30 days.
- Feedback is kept until it's dealt with. Finished items are deleted after a year.
Your choices
- Use TwentySix without an account, so nothing about your pay leaves your device.
- Turn off anonymous usage and error reports under Data.
- Delete your account and its saved copy under Data → Your account → Delete account. This can't be undone.
- Ask to have feedback you sent deleted. Include roughly when you sent it.
Security
Account data is encrypted in your browser with AES-256-GCM. The key is made from your password with PBKDF2-SHA256 (600,000 rounds), and the password itself is never stored by TwentySix. Data on your device is in normal browser storage, which isn't encrypted, so protect your device with a passcode. No system is perfectly secure. If a breach affecting your account is found, account holders will be told by email.
Children
TwentySix is meant for adult federal employees and isn't directed at children.
Contact
Open TwentySix and choose Send feedback, in the top bar or at the bottom of any screen. Add a reply email if you'd like an answer.
TwentySix is an independent tool, not a product of or endorsed by the U.S. Department of State. Estimates only; your payroll and retirement offices make official determinations.