Built around keeping your financial data private
Planning your retirement means gathering your most sensitive numbers in one place. Your financial workspace is encrypted on your device before it syncs to the cloud. The operator keeps some account and operational data to run the service, but not your encrypted workspace contents.
Encrypted before it leaves your device
Your financial workspace is encrypted on your device before it syncs to the cloud. What reaches the server is the encrypted version, so the operator's stored copy of your balances, income, and plans is not readable from server data alone.
- Encrypted on your device before it syncs, not just on the server
- Your key is protected by locked envelopes tied to how you sign in
- Intended to limit what a breach or the operator could read from stored workspace data
- Works the same whether you sign in with a passkey or a password
What the service keeps in readable form: your name, birthdate, and email; user, device, and sync identifiers; authentication and security records; IP address, user agent, and logs as applicable; and legal-acceptance evidence. Your encrypted financial workspace contents are not part of that. See the Privacy Notice.
Cloud synchronization is required and cannot be turned off. If you lose your recovery key, encrypted data will be unrecoverable.
Layered protection
On-device encryption is supported by additional application and account safeguards.
- Encrypted on your device
- Your financial workspace is encrypted on your device before it syncs, and stored encrypted in AWS. Your key is protected by locked envelopes tied to how you sign in, so it is not kept in readable form on the server.
- Passkey and password sign-in
- Sign in without a password using a passkey, or use a password if you prefer, with a required second step at sign-in for extra protection. Passwords known from past data breaches are turned away, automated guessing is blocked, and stale sessions are signed out for you.
- Application safeguards
- The app and supporting systems use protections against common online attacks, limited internal access, and activity logging.
- No advertising trackers
- No advertising trackers or analytics pixels, and your data is not sold. The hosting and security systems still process network and operational data to run the service, and this site remembers your theme and pricing-view choice in your browser.
- Export and deletion on request
- Export your full plan, and delete your live account and synced workspace data. Some legal-acceptance and backup records persist for a limited time under the Privacy Notice.
- Built and hosted in the U.S.
- Your data lives on U.S.-based cloud infrastructure (AWS), with access limited to what each part of the system needs.
Private by design
Your numbers, encrypted on your device from the first one you enter.