Privacy Policy

The short version

We aim to collect as little as possible. Your portfolio is encrypted in your browser before it leaves your device, so your holdings are never readable by us or anyone else. We do not sell data, we do not show you targeted financial ads, and you can delete your account whenever you like.

Data you provide

• Account email and password — your email address and a hashed password are handled by our authentication provider to manage sign-in. Your password is never stored in plain text.
• Optional recovery phone — if you add one, only a one-way hash of the number is stored, so the number itself cannot be recovered from our data.
• Portfolio data — assets, liabilities, income and spending are encrypted client-side before storage. Without your password or recovery code, neither we nor anyone else can read them.
• Recovery code — you receive a recovery code at first login; it is the only other way to unlock your encrypted data besides your password.

Data we collect automatically

Like most websites, our hosting infrastructure records basic technical and security information — for example, your IP address, browser and device type, and the pages you request. This is used to keep the service secure, diagnose faults and understand aggregate traffic. We also set cookies that are needed to keep you signed in.

We use Google Analytics 4 to understand which pages and tools are actually useful. It sets first-party cookies (named _ga and _ga_<property>) and records details such as the page you visited, how you arrived, an approximate location derived from your IP address, and your browser and device type. We use the standard configuration, do not upload customer lists, and never link analytics to your account or your portfolio. Google processes this data on our behalf; see Google's privacy policy.

Analytics is off until you allow it. On your first visit we ask before loading Google Analytics; choosing “Decline” — or simply closing the page — loads nothing and sets no analytics cookie. You can change your mind at any time with the button below, or by blocking third-party scripts or installing Google's Analytics opt-out browser add-on. Every tool on this site works normally without analytics.

Change analytics choice

Data the AI assistant uses

When you use the AI assistant, a summary of your portfolio and plan is sent to a server-side AI model to generate each reply. It is processed to answer your question and is not stored as a readable copy of your portfolio. In local development you can connect your own server instead, so no portfolio summary leaves your machine at all.

Advisors directory

Advisors provide their own listing details — name, firm, credentials, specialties, contact information and profile photo. This information is shown publicly in the directory because that is its purpose. Advisors can request changes or removal by emailing fireretirementplanning@gmail.com.

Portfolio sharing with advisors

You can request a connection with an advisor listed in the directory. If the advisor accepts, you can choose to share your plan, projections and a generated PDF report with them. A share is only ever sent to the specific advisor you requested, only while that connection stays accepted, and you can revoke it at any time.

Encrypted sharing. Once your advisor has enabled encryption, shares are end-to-end encrypted: the share is sealed in your browser with the advisor's public key (RSA-OAEP-2048 wrapping an AES-256-GCM key), and only that advisor — holding the matching private key, which is itself wrapped by their own password-derived key — can decrypt it. In this mode the stored copy is ciphertext, and our administrators cannot read your holdings, projections or report even with direct database access. A re-share also clears any earlier readable copy at rest.

Plaintext fallback. Until an advisor has enabled encryption, a share falls back to being stored in readable form, protected by database permissions so only that advisor's account can query it. On that path a database-level compromise or an operator with direct database access could read the shared content. You will be told when a share is sent in this mode, and the advisor can turn on encrypted sharing at any time by opening their advisor dashboard once. If you need the stronger guarantee, confirm your advisor has enabled encryption before sharing.

In both modes our administrators only ever need connection metadata — who shared with whom and when. On the encrypted path they cannot see the shared content at all.

Your choices

• Delete your account — remove your account and its data at any time from the app settings.
• Data access — ask us what data we hold about you and how it is used.
• Contact us — questions about this policy go to fireretirementplanning@gmail.com.

Changes to this policy

If we change how we handle data, we will update this page and revise the date below. Significant changes will be called out so you can decide whether to keep using the service.

Last updated: October 2026.