Privacy Policy

1. What we collect

• Your account. An email address, a company name if you give one, and a password. The password is stored only as a one way hash and cannot be read back by us or by anybody else.
• What you put into the tools. Retirements you record in your ledger, portfolios you build, and figures you enter to run an estimate.
• What the tools produced for you. A short history of reports you generated, so you can find one again.
• Anything you send us. Support tickets, feature requests, and enquiries from the contact form, including the name and email you attach to them.
• Questions you ask the site assistant. Each question and answer, the time, the page it was asked from, your IP address, the country that address belongs to, and your browser type. If you are signed in, the conversation is linked to your account.
• Analytics, if you accept them. Pages viewed, approximate location from your IP address, device and browser type, and the site or search that referred you.

We do not run identity verification and we do not ask for financial account details. Subscriptions are paid through Paddle.com Market Ltd, our merchant of record, which handles your card details under its own privacy policy. We never see or store them.

2. How long it is kept

• Report history: thirty days. It is deleted automatically after that. You can delete any of it yourself at any time, and doing so removes it immediately rather than marking it hidden.
• Your ledger and your account: until you ask. These stay while your account exists, because deleting them without being asked would lose your records.
• Support tickets and feature requests: until resolved, then kept while the account exists. A request you sent a year ago is shown back to you with its status, which is only possible if it is still there.
• Site assistant conversations: ninety days. They are deleted automatically ninety days after the last message, and kept so we can improve the answers and stop misuse. Ask us and we will delete yours sooner.

3. Who can see it

Your records are visible to your own account and to nobody else's. Each account can read only its own ledger, its own history, and its own tickets. That separation is enforced on the server rather than by hiding things in the interface.

Site administrators can see support tickets and feature requests, because somebody has to answer them, and they can see account details for support purposes. They can also read conversations with the site assistant.

To write an answer, the site assistant sends your question and the last few messages of the conversation to Google's Gemini service, which processes them under Google's terms. Your IP address is not sent. The country shown for an address comes from DB-IP's IP to Country Lite database (CC BY 4.0, db-ip.com), held on our own server, so no address is sent to a lookup service.

We do not sell your data, we do not share it with advertisers, and we do not transfer it to any registry, broker or exchange. We could not initiate a retirement or a transfer on your behalf even if you asked, because the product has no connection to any registry that would allow it.

4. Data security

Traffic between your browser and this site is encrypted in transit. Account passwords are stored only as one way hashes and are never recoverable in readable form. Credentials for the services we read data from are held outside the application code and are not exposed to the site. Access to stored records is restricted to named accounts, and each account can read only its own data.

We hold no third party security certification and do not claim one. If that changes, this page will say so and name the certification and its date.

5. Cookies and analytics

We use a small number of cookies. They fall into two groups:

• Strictly necessary: a session cookie that keeps you signed in and secures form submissions. This is required for the site to work and is not used for tracking.
• Analytics: Google Analytics 4 helps us understand which pages are read and how people find us. It records pages viewed, approximate location derived from IP address, device and browser type, and the site or search that referred you.

Analytics cookies are only set if you accept them. On your first visit a consent banner appears, managed by Iubenda, and you can change or withdraw your choice at any time by reopening it from that banner. Declining does not limit any part of this site.

We do not run analytics inside the client dashboard or the admin area, and we do not use advertising or cross-site tracking cookies. We do not sell or share analytics data with third parties beyond Google in its role as our analytics provider.

The full cookie policy, including each individual cookie and its retention period, is published at our cookie policy.

6. What you can ask for

Whatever framework applies where you live, the practical position here is the same. Email us and we will do the following.

• A copy of your data. Everything held against your account, in a readable format. Most of it you can already export yourself from inside the tools.
• A correction. Anything wrong in your account details, fixed.
• Deletion. Your account and everything attached to it, removed. This is not reversible and we will say so before doing it.
• Withdrawal of analytics consent. Available at any time from the consent banner, without contacting us at all.

We aim to answer within thirty days. There is no charge and you do not need to give a reason.

7. Changes to this policy

If this changes in a way that affects what we collect or how long we keep it, the date at the top changes and the change is described rather than folded silently into the text.

8. Contact

Questions about this policy, or a request under section 6: