What happens when you run a plan

Your plan is calculated on our servers, not on your device. While you fill in the calculator and when you press Run, your plan's numbers are sent over an encrypted connection to our calculation servers in Belgium, run by Google Cloud on our behalf. They work out your results and hand them back to your browser.

We don't keep your inputs. They exist only in the queue that passes your plan to a server and in that server's memory, until your plan is calculated, and then they are gone. Your results wait in our database in Frankfurt until your browser collects them, and are deleted 10 minutes after that, and never kept longer than an hour. If you don't have an account, nothing ties a run to you: we keep no identifier on your device, and the scrambled form of your internet address we use to stop abuse is kept for a day and never stored next to a run.

Before a full run starts, Cloudflare Turnstile checks, usually invisibly, that a person is asking and not a script. It never sees your plan.

Your browser also keeps your latest inputs and results in its own storage (localStorage), so they are still there when you come back. That store is readable only by pages on retiresafe.io, and clearing site data clears it.

When you sign in

You sign in with a one-time link we email you, or with your Google account. Either way Supabase Auth creates the session, and there is no RetireSafe password to leak, reuse, or phish.

Before an email sign-in link goes out, Cloudflare Turnstile checks that a person is asking, not a script. The contact form has the same check. It reads your IP address and technical details of your browser, and tells us only yes or no. It never sees your plan.

Once authenticated, the scenarios you choose to save are written to a Supabase Postgres database in the EU (eu-central-1), encrypted at rest by the underlying cloud provider. Every table enforces row-level security: a user's session token only grants access to rows where user_id = auth.uid(). Other users' rows are invisible at the database level, not just the application level.

What we store, and what we don't

• Stored: your email (Supabase Auth), saved scenarios (inputs JSON), saved runs (full result JSON), engine version, timestamps.
• Kept for under an hour: the results of a run, until your browser collects them. The inputs of a run are not stored at all.
• Not stored: payment card data (handled by Stripe on Stripe's servers), and any plan you don't save.

Analytics

Page analytics use Umami, a privacy-respecting analytics service with no cookies, no cross-site identifiers, and EU hosting. To group one visit's actions it derives a rotating code from your IP address and browser, and stores nothing on your device. It tells us "how many people saw the pricing page this week," not "who you are." This one runs for everyone, because there is nothing stored on your device to consent to.

Google Analytics runs alongside it, and only for people who accept it. We use it to tell whether the adverts we pay for lead anywhere, which is something a cookieless tool cannot answer. It does set cookies and Google can connect what it sees here to your activity on other sites that use its advertising products, so it is switched off until you say otherwise and stays off if you decline. Until you accept, Google receives an anonymous note that a page was viewed, with no identifier and nothing written to your device. Cookie settings at the bottom of any page reverses either answer at any time. The cookies page names every cookie involved.

Error reporting uses Sentry for stack traces of JavaScript failures. Sentry sees which line of code failed and the page you were on. There is one exception: when a simulation run fails, that run's inputs are attached to the report so we can reproduce it, and Sentry may record a masked replay of the session, with all text and form values blanked out. Our calculation servers report their own failures to Sentry too, with which line failed and none of your plan. Sentry deletes every report, inputs included, after at most 90 days. The privacy policy sets out both in full.

What's not sold

We don't sell, share, broker, or trade any user data. There is no marketing partner, no co-registration, no analytics resold to a third-party data pipeline. Your inputs aren't training data for any AI model, ours or anyone else's.

Deletion

Account deletion is a two-stage process: a typed-DELETE confirmation kicks off a 30-day grace period; during that period you can cancel. After 30 days, every row tied to your account is hard-deleted from the database and the corresponding Supabase Auth user is removed.

You can also export everything we hold on you as JSON, before or instead of deletion.

Reporting a vulnerability

Email security@retiresafe.io rather than the contact form, so a report does not sit in a general inbox. We do not yet operate a formal bug-bounty programme.