Privacy Policy

Overview

OutlastRetirement ("the App") is an educational retirement cash flow calculator designed to help individuals model their financial future. We are committed to your privacy. This policy describes how the App handles information, including the limited, anonymous analytics data described below.

Data We Do Not Collect

OutlastRetirement does not collect, store, transmit, or share any of your personal or financial planning information. Specifically, we do not collect:

• Names, email addresses, or contact information through the App. You can type names into your plan, such as a spouse, heirs, account labels, Life Plan notes or the short notes you write about a plan (“Your three answers”), but they stay on your device and are never transmitted. If you email us, we of course have your address; see If You Email Us below.
• Financial account numbers, balances, or transaction data
• Any of the retirement-plan inputs or results you enter into the App (ages, income, savings, spending, tax settings, simulation outputs, etc.)
• Social Security numbers or government identifiers
• Precise location data
• Device identifiers or advertising IDs
• Individually identifiable usage or behavioral data — see below for the limited, anonymous analytics we do use
• Crash reports or diagnostic data sent to us

How Your Data Is Stored

All information you enter into OutlastRetirement — including retirement ages, account balances, income figures, and spending assumptions — is stored exclusively on your device using the browser's local storage. This data:

• Is never sent anywhere by the App
• Is not backed up to any server operated by OutlastRetirement — there is no such server
• Is not accessible to the developer, because we never receive a copy of it
• Can be erased at any time with Erase everything on this device in Preferences → Your Data, which removes everything the App has stored in this browser once you confirm, or by clearing this site's data in your browser. Reset Plan to Defaults is different: it resets only the plan you have open and erases nothing else.

Moving Your Data Off Your Device

The App never moves your plan anywhere. You can, and these are the ways you can move it — each one something you do deliberately, none of them automatic, and none of them routed through us:

• Backup Everything downloads your plan as a file to your computer. What happens to that file afterwards is entirely up to you: where you keep it, whether you email it, whether you encrypt it. You can password-protect it on the way out if you want to.
• Save to a cloud folder writes that same file to a location you pick — typically a folder your own Dropbox, Google Drive, iCloud or OneDrive client already watches. Worth being precise about how this works: the App has no account with any of those providers, no sign-in, and no API key. It writes an ordinary file to a folder you chose; your own sync software is what carries it to the cloud, under whatever terms you already have with that provider. We are not in the path and never see it.
• Print / Save as PDF sends a report to your browser’s print dialog. Where it goes from there, a printer or a PDF file, is your choice.
• CSV exports, such as the Year by Year table or your holdings, download a spreadsheet file to your computer, the same way a backup does.
• Live Pricing (optional, off until you connect it) is the only feature that sends anything out while you use the App. It sends a bare ticker symbol — for example VTI — to a Google Sheet in your own Google account, and reads back a price. The Sheet’s script then looks the symbol up with Google Finance and Yahoo Finance from Google’s servers; those services see the symbol, not you. It never sends how many shares you own, which accounts hold them, what they cost you, or any dollar amount. The Sheet is yours; we have no access to it.

If you would rather none of that were possible, turning on Local-Only Mode (Preferences → Your Data) stops the App’s optional connections, Live Pricing and analytics included. Your browser still loads the App and checks for updates when you reload. It is enforced in the code at the point every request would be made, not by hiding buttons.

Premium Modules

The code for the Premium features — Detailed Holdings, Retirement Spending, Readiness in Full and Relocation & Residency — is kept separate from the rest of the App. It is not part of what your browser downloads from outlastretirement.com; it is fetched, one module at a time, from our own module server, premium.outlastretirement.com, and only when a valid Premium Access key is present and the first time you open the part of the App that uses it. The Demo Plan is the one exception: it shows a read-only Detailed Holdings view to visitors who have no key, so while Demo Mode is on and no valid key is present the App sends the module server a demo delivery key that is built into the App itself. It is the same for every visitor, it is not a Premium key (pasting it into Preferences unlocks nothing), it carries no address and nothing about you, and the server will hand it only the Detailed Holdings module. A Premium user in the demo uses their own key, as everywhere else.

Here is exactly what happens, and the code enforcing it is in the App’s published source:

• The App sends the module server one thing: your Premium Access key, so the server can check it is valid and unexpired. It is sent as a request header, never in a web address. The key carries the email address it was issued to (see "If You Email Us" below), so that address is inside what the server receives; the server checks the key's signature and expiry and keeps no record of its own; Vercel, which hosts it, keeps the same short-lived request logs it keeps for every page (below). Nothing from your plan or your holdings is sent — the server delivers code to your browser; your data never travels the other way.
• The server answers with a signed module. The App verifies the signature against a public key built into the App before running a single line of it, so what you run is what we published, not something altered on the way.
• A module may later fetch a few supporting files from the same server without a key: third-party code it loads only when needed, such as the PDF reader that Detailed Holdings uses when you import a brokerage statement, the chart library, and the Live Pricing script you copy into Google Sheets. None of it is Premium code. The files are not signed themselves, but since October 19, 2026 the signed module carries a fingerprint of each one and the App runs a file only if it matches, so an altered file is refused. They are fetched the way any web page fetches a file, so the server (and Vercel’s request logs, below) sees that a browser asked for that file and nothing else — not your key, and never the statement or anything in it, which is read entirely on your device.
• Premium modules run under the same rules as the rest of the App. They do not store anything outside the App’s own data on your device, and they make no network connections of their own — with the one exception already described above, Live Pricing to your own Google Sheet, which only the Detailed Holdings module uses and only when you have connected it.
• Local-Only Mode stops this connection too. While it is on, no Premium module is fetched, and a Premium part of the App that has not been loaded yet shows a note saying so instead. A module that was already loaded in the current session keeps working: once Detailed Holdings, Retirement Spending, Readiness in Full and Relocation & Residency have each been opened once, you can turn Local-Only Mode on and carry on using all four with no further connection until you reload the page.
• If your key has lapsed, Premium parts of the App lock, but your holdings and everything else you entered stay on your device, readable and restorable from a backup, exactly as before.

Which version of each Premium module is loaded is shown in Preferences. The App itself is open source (github.com/jabone/outlastretirement, under the GNU Affero General Public License); the Premium modules are a separate work and are not.

What Our Host Sees

The App’s pages and code are served by our hosting provider, Vercel Inc. When your browser asks for a page, Vercel’s servers receive your IP address and browser type, as any web server does, and keep short-lived request logs (the address asked for, the response, and in some views the IP address) that we can see in Vercel’s dashboard for a short time. We don’t export, analyze or keep them, we send them nowhere else, and nothing you type into the App is part of those requests.

Anonymous Usage Analytics

These analytics are off by default. The App sends no usage data at all unless you turn on "Anonymous Usage Analytics" in Preferences → Your Data. If you never turn it on, this whole section does not apply to you and nothing described here is ever sent.

When you switch it on, the App uses Vercel Web Analytics, a privacy-focused service from our hosting provider, Vercel Inc., to understand overall traffic. It then sends the following anonymous, aggregate technical information to Vercel's servers on each visit:

• Which part of the App was opened, as the tab name only (for example, Scenarios): no sub-page, no search or link parameters, and nothing after the address
• The site you came from, if any. That site decides how much of its address your browser passes on; most, including search engines, pass on only their domain. Moving between our own pages passes on only our domain.
• Approximate location (country/region, derived from network address — not precise GPS location)
• Device type, operating system, and browser (e.g. "Mobile, iOS, Safari")
• Timestamp of the visit

This is the same category of information a web server logs by default — it does not include anything you type into the App. None of your names, ages, balances, income, spending, tax settings, or simulation results are ever included in this data, because the App never sends that information anywhere (see "How Your Data Is Stored" above).

The service uses no cookies or persistent device identifiers and cannot identify you individually or link your visits across other apps or websites. Visitors are distinguished only by a one-way hash of the incoming request, which is automatically discarded after 24 hours. For Vercel's own technical documentation on exactly what is collected, see their Web Analytics privacy policy. Turning the setting back off stops all of it immediately, and turning on the App's Local-Only Mode overrides the setting entirely — while that is on, no analytics are sent.

The App's fonts are bundled into the App itself rather than loaded from a third party, so opening the App reveals nothing to any font host. OutlastRetirement does not use any advertising networks, third-party trackers, or data-sharing services beyond the optional Web Analytics described above.

If You Email Us

Premium access is arranged by email — today it is invite-only, and if that changes we will say so here — so emailing us is the one point where we hold something about you. We think you should know exactly what that is.

• What we have: your email address, and whatever you choose to write to us. Nothing more — we do not ask for your name, and there is no form that collects anything else. If we send you a Premium key, we also keep a one-line record of it — the address, the key’s serial number and its expiry date — in a file on our own computer, not on any server, so that a key can be canceled or replaced if you ask.
• Where it sits: a Google Workspace mailbox for outlastretirement.com. Google hosts it as our email provider, under its Google Workspace terms. Mail sent to our earlier address, outlastretirement@gmail.com, is forwarded there, and anything sent to that address before October 2026 stays in that Gmail mailbox, which Google hosts under its own terms.
• How long: indefinitely. We keep correspondence in the mailbox and do not delete it on a schedule. Ask us to delete yours and we will.
• What we use it for: replying to you, and sending Premium enable instructions. We do not add you to a mailing list, and we do not sell, rent, or share your address.

It is never linked to your plan. This is not a promise about our intentions — it is how the App is built. The App never sends us your plan data, so we do not have it to link anything to. The Premium access key we send you carries four things: the email address we sent it to, the fact that Premium is enabled, when it expires, and (from October 18, 2026) a random serial number, so that one key can be canceled without canceling anyone else’s. Nothing else — no name, no device, no plan data. The address is there so that a key says whose it is: the App shows it under Preferences › Premium Access, and a key that turns up where it should not can be traced to the address it was issued to. The key is checked by the Premium module server when a module is fetched (see "Premium Modules" above), so that server sees the address inside your key on each fetch, and nothing else about you; it keeps no record of those fetches. Nothing in the App sends us anything, so we still cannot tell who is using it or how.

Payment: Premium is free while it is invite-only. There is no checkout, no price, and no payment processor, so we hold no payment or card information whatsoever. If that ever changes, this policy will be updated before any payment is taken, not after.

Your Choices

Your plan data is yours in the most literal sense: it is on your device, and you can export it with Backup Everything, or erase it with Erase everything on this device, at any time from Preferences → Your Data. We have no copy to hand over or delete.

For anything you have emailed us, write to the address at the bottom of this page and we will tell you what correspondence we hold from you, or delete it. We will not ask you to prove anything beyond replying from the address in question.

No Account Required

OutlastRetirement requires no account creation, login, or registration. You can use the full functionality of the App without providing any identifying information.

Children's Privacy

OutlastRetirement is for adults. As the Terms of Use say, you must be at least 18 to use it. We do not knowingly collect any information from anyone under 18.

Changes to This Policy

If we ever change this privacy policy in a material way — for example, adding or removing a third-party service, or changing what data it collects — we will update the effective date above and note the changes in the App's release notes.

Update, October 19, 2026: Our contact addresses moved to our own domain. Questions about this policy go to privacy@outlastretirement.com, Premium access to support@outlastretirement.com, and everything else to hello@outlastretirement.com. They all reach the same Google Workspace mailbox, which replaces the Gmail mailbox described in "If You Email Us"; mail to the old address is forwarded. Nothing about what the App collects or sends changed.

Update, October 18, 2026: Two things the "Premium Modules" section did not say, and one addition to what a Premium Access key carries: a key issued from this date on also carries a random serial number, so that a single key can be canceled; the module server keeps a list of canceled serials and nothing else, and the record of which serial went to which address is kept by us off the server, with the email you sent. First, the Demo Plan sends the module server a demo delivery key built into the App — the same for every visitor, not a Premium key, carrying nothing about you — so that visitors without a key can see the read-only Detailed Holdings view. Second, a loaded module fetches a few third-party supporting files (the PDF reader used for statement import, the chart library, the Live Pricing script) from the module server without a key, as any page fetches a script. Neither sends anything about you or your plan; both were always happening and had not been disclosed, so the effective date above has moved.

Update, October 17, 2026: Two sentences said that our host's request data is something we "don't receive or keep" and that the module server "keeps no record of the request". More precisely: Vercel keeps short-lived request logs for every request to the site and the module server, which we can see in its dashboard for a short time and do not export, analyze or keep. Nothing about what the App sends has changed.

Update, October 16, 2026: The Premium module server is now in use for all four Premium areas, and the "Premium Modules" section now describes what happens rather than what would. One change to what a Premium Access key carries: a key issued from this date on includes the email address it was sent to, so a key says whose it is. Keys issued before this date carry no address and keep working. "If You Email Us" says what the key holds now; nothing else about what the App sends has changed.

Update, October 14, 2026: Added the "Premium Modules" section. The App now has a separate loader for Premium code; today it still loads that code from outlastretirement.com, and the section explains what will change when our module server takes over (the Premium Access key is sent to it, nothing else) and how Local-Only Mode applies. The Live Pricing settings in Preferences now appear only when a Premium key is present, since only Detailed Holdings uses them. Nothing about what the App sends has changed yet.

Update, September 30, 2026: This policy now says what our host receives when it serves a page (your IP address and browser type, which we don't receive or keep), that the Live Pricing Sheet looks symbols up with Google Finance and Yahoo Finance, that printing and CSV exports are also ways you can move your data, and how Erase everything on this device differs from Reset Plan to Defaults. It also no longer says there is nowhere in the App to enter names: there is, and those names stay on your device. The age line now matches the Terms of Use (18). Nothing about what the App sends changed.

Update, September 28, 2026: An independent check found that, for people who had opted in, analytics sent the full address of each page view, including the tab and sub-page and any link parameters, and the full address of the page you came from. None of it was plan data, but it was more than this policy described. The App now sends only the tab name, never link parameters, and every page tells your browser to pass on only our domain as the referring site. The list above was updated to match, and the Local-Only Mode description was corrected: it stops the App’s optional connections, not every network request.

Update, September 12, 2026: The App was renamed from CashFlowEngine to OutlastRetirement and the contact address changed. More importantly, this policy previously stated that we do not collect email addresses, full stop. That was wrong: Premium access is arranged by email, so we hold the address of anyone who writes to us. The new "If You Email Us" section describes exactly what we have, where it sits, and how long we keep it. The storage section has also been rewritten: it said your data "never leaves your device" without qualification, which read as a promise the App could not keep once you use Backup, save to a synced folder, or connect Live Pricing. The App still sends nothing — but you can move your data, and the new "Moving Your Data Off Your Device" section says exactly what each of those does. Nothing about the App's own behavior changed — it collects no more and no less than before — but a data flow that was always happening had not been disclosed, so the effective date above has moved.

Update, September 8, 2026: Anonymous Vercel Web Analytics is now OFF by default and only runs if you opt in (Preferences → Your Data). The Vercel Speed Insights performance-metrics service was removed entirely and is no longer used. App fonts were moved in-app so nothing is fetched from a third-party font host.

Update, July 21, 2026: This policy was revised to accurately disclose the anonymous Vercel Web Analytics and Speed Insights services described above, which were already in use but had not previously been disclosed here. Nothing about what these services collect changed; only this policy's description of it did.

Contact

If you have any questions about this privacy policy, please contact us at:
privacy@outlastretirement.com