Your data stays yours.

Calcifir stores your plan data in your account so we can sync it across devices. We do not sell or mine your financial information. We share it only with the four companies named below, which run the service for us.

What we collect

• The plan data you enter (income, savings, accounts, etc.).
• Authentication credentials (email or OAuth identity).
• Aggregate, non-identifying usage telemetry — which pages people open and how fast they load, not what they typed. Two events are counted: a click on a guide’s sign-up link, and a finished sign-up.
• Error reports when something breaks, or when your browser reports that a page broke one of our security rules: the error message with every number removed, the kind of page it happened on, and your browser family (such as Safari). We keep them for 30 days.
• A copy of any plan you share by short link. The link works for 90 days and you can renew or revoke it in Settings › Account; the copy is deleted when you revoke it, or 30 days after it expires.

Who receives your data

• Supabase stores your account and your plans in full, the copy behind each share link, and the error reports above. It also sends the sign-in emails.
• Google, only if you choose “Continue with Google”, confirms your Google account and passes your email and basic profile to us.
• Stripe handles payment. It receives your email, your account id and the plan you chose. You type your card on Stripe’s own page, and it never reaches us.
• Vercel hosts the site and counts page views and page speed (Vercel Web Analytics and Speed Insights). It sees each request’s address, IP address and browser details in its hosting logs, which keep them for a short time. A share link holds the plan after the # in its address, which browsers never send to a server, so the plan does not appear in those logs. An older share link, one with ?scenario= in its address, carries the plan in the address itself, so opening one can put the plan in the logs; those links stop working after 30 April 2027.

Cookies and browser storage

• One cookie, calcifir_first_touch, lasts 30 days. It holds the first public page you visited and the name of the site that sent you, so we can tell which pages lead to sign-ups.
• Your browser also keeps a copy of your plans, saved simulation results, a few display preferences and your sign-in session. Signing out or deleting your account clears the plans from that browser.
• While you view a shared plan, your browser keeps a copy of it in the tab until you close the tab.
• No advertising or cross-site tracking cookies.

What we don’t do

• Sell your data to advertisers, brokers, or aggregators.
• Read your plan to push you toward specific funds, advisors, or products.
• Share your data with any third party not named on this page.

We’re finalizing the full legal language; this summary reflects how Calcifir works today.