We architect privacy. We don't promise it.
Most tools promise privacy. We built it in — and we're upfront about the one exception. Your data is encrypted on your own device before it's ever saved, and we only keep the encrypted version, which we can't unlock. The exception: when you run a projection, your browser sends just those numbers to our engine, it works out the answer, and discards them — never saved, never logged (details below).
What we CAN see
- Aggregate user count and engagement
- State-level geographic distribution
- Operational performance (errors, latency)
- Your email — needed for sign-in
- A home address you type into the home-value tool — sent to the US Census Bureau to estimate the value, and not stored encrypted
- A first-party cookie (random ID, no personal data) to count unique visitors — never any third-party or advertising cookies
- The financial figures you submit to run a projection — only for the moment of computation, never stored or logged (see below)
What we never store or read at rest
- Your salary or income
- Your balances or account references
- Your projections or personal inflation rate
- The financial amounts and assumptions inside your scenarios
What we WILL NEVER do
- Sell your data to anyone, ever
- Run ads or sponsored content
- Generate leads to financial advisors
- Reverse this architecture later
When your numbers leave your browser
One feature needs to do math on your actual figures: running a Monte Carlo projection (the readiness percentage and outcome bands). For it, your browser sends just the figures needed to our engine over an encrypted (TLS) connection. We compute the answer and discard the inputs in the same request — we never write them to a database, and we never log them. Everything we retain about you stays encrypted with your key.
This is the honest boundary of the design: your data is unreadable to us at rest, and untouched by us in transit except for the instant of the computation you asked for. We could have run this calculation in your browser too; today the Monte Carlo engine runs on our server for speed and consistency. If that boundary matters to you, the native desktop app on our roadmap will move it fully client-side. (If you'd rather drive everything from your own AI, you can connect an agent over MCP — it runs the same projections without our built-in tools.)
The honest tradeoff
Zero-knowledge encryption has a real cost: if you forget your password, your data is gone. We cannot reset it. We will encourage you to generate offline recovery keys during setup and to store them somewhere safe. This is the only honest version of the privacy promise — anything less means a backdoor we could be compelled to use.