Default: nothing leaves your browser

The simulation engine is Python compiled to WebAssembly (via Pyodide) and runs entirely in your browser tab. Your inputs, the 10,000 simulated paths, the outcome bands and the ranking of what threatens your plan are all computed locally. Closing the tab discards everything except what you explicitly persist.

Local persistence uses your browser's localStorage. That's a per-origin store accessible only to JavaScript running on retiresafe.io. Clearing site data clears the saved inputs and runs.

When you sign in

Sign-in is magic-link only. We send a one-time login link to your email; you click it; Supabase Auth creates a session. There is no password to leak, reuse, or phish.

Once authenticated, the scenarios you choose to save are written to a Supabase Postgres database in the EU (eu-central-1), encrypted at rest by the underlying cloud provider. Every table enforces row-level security: a user's session token only grants access to rows where user_id = auth.uid(). Other users' rows are invisible at the database level, not just the application level.

What we store, and what we don't

• Stored: your email (Supabase Auth), saved scenarios (inputs JSON), saved runs (full result JSON), engine version, timestamps.
• Not stored: payment card data (handled by Stripe on Stripe's servers), unsaved scratch work, anonymous runs that never reach the save button.

Analytics

Page analytics use Umami, a privacy-respecting analytics service with no cookies, no cross-site identifiers, and EU hosting. To group one visit's actions it derives a rotating code from your IP address and browser, and stores nothing on your device. It tells us "how many people saw the pricing page this week," not "who you are." This one runs for everyone, because there is nothing stored on your device to consent to.

Google Analytics runs alongside it, and only for people who accept it. We use it to tell whether the adverts we pay for lead anywhere, which is something a cookieless tool cannot answer. It does set cookies and Google can connect what it sees here to your activity on other sites that use its advertising products, so it is switched off until you say otherwise and stays off if you decline. Until you accept, Google receives an anonymous note that a page was viewed, with no identifier and nothing written to your device. Cookie settings at the bottom of any page reverses either answer at any time. The cookies page names every cookie involved.

Error reporting uses Sentry for stack traces of JavaScript failures. Sentry sees which line of code failed and the page you were on. There is one exception: when a simulation run fails, that run's inputs are attached to the report so we can reproduce it, and Sentry may record a masked replay of the session, with all text and form values blanked out. The privacy policy sets out both in full.

What's not sold

We don't sell, share, broker, or trade any user data. There is no marketing partner, no co-registration, no analytics resold to a third-party data pipeline. Your inputs aren't training data for any AI model, ours or anyone else's.

Deletion

Account deletion is a two-stage process: a typed-DELETE confirmation kicks off a 30-day grace period; during that period you can cancel. After 30 days, every row tied to your account is hard-deleted from the database and the corresponding Supabase Auth user is removed.

You can also export everything we hold on you as JSON, before or instead of deletion.

Reporting a vulnerability

Email security@retiresafe.io rather than the contact form, so a report does not sit in a general inbox. We do not yet operate a formal bug-bounty programme.