Privacy Policy
RetireLab is an educational retirement simulator. We collect the minimum data needed to operate the service and never sell it. This policy applies to retirelab.dev and the RetireLab API (api.retirelab.dev).
What we collect
Account email — When you sign up at retirelab.dev we store your email address in Supabase (our authentication provider). We use it only to send you transactional emails (sign-in links, receipts).
API usage logs — Each API call records which endpoint was called and a timestamp, linked to your API key. We use this to enforce your plan quota and to understand aggregate usage patterns. Logs are retained for 90 days.
Simulation inputs — Numbers you enter into the simulator (age, assets, spending) are processed in memory to run the Monte Carlo calculation and are not stored in our database. We do not retain your financial figures after the response is returned.
Payment info — Billing is handled by Stripe. RetireLab never sees or stores your card number. Stripe's privacy policy governs payment data.
Page analytics — Aggregate page-level analytics (page views, visitor counts, Core Web Vitals) are collected by Vercel Analytics. No personal identifiers, cookies, or cross-site tracking are used. Analytics data is processed by Vercel and does not link back to your account.
How we use your data
- ·To authenticate you and manage your account
- ·To enforce your plan's monthly simulation quota
- ·To send transactional emails (sign-in links, Stripe receipts)
- ·To understand aggregate product usage (no individual profiling)
- ·To investigate abuse or security incidents
What we don't do
- ✗Sell your data to third parties
- ✗Use your simulation inputs for advertising or profiling
- ✗Share your email with third parties except as required by law
- ✗Store your financial figures after a simulation response is returned
- ✗Build individual behavioral profiles
Where data is stored
User accounts and API usage logs are stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the United States.
The API server runs on Railway, also in the United States. The website is hosted on Vercel.
Payment data is stored by Stripe in accordance with PCI DSS standards.
Aggregate analytics are processed by Vercel Analytics (no personal data or cookies).
Your rights
You can delete your account and all associated data at any time by emailing privacy@retirelab.dev. We will process deletion requests within 30 days.
You can rotate your API key from your dashboard at any time.
Changes to this policy
We may update this policy when we add new features. Material changes will be announced by email to registered users. The effective date at the top of this page reflects the most recent revision.
Questions about this policy? privacy@retirelab.dev