Privacy Policy

This Policy applies to Personal Data Alpha Retire processes through the Service and in related communications. “Personal Data” means information that identifies, relates to, describes, or can reasonably be linked with an individual or household. It does not include information that has been aggregated or de-identified so it cannot reasonably identify you.

This Policy does not govern a third party’s independent practices. Third-party services, including account-connection and payment providers, have their own privacy policies and terms.

Depending on how you use the Service, we may collect the following categories:

Financial planning can reveal sensitive details even when they are not legal account credentials. Provide only the detail needed for your planning. Do not enter Social Security numbers, tax identification numbers, full financial-account numbers, payment-card numbers, government-ID copies, or bank or brokerage credentials into planning fields or messages.

We collect Personal Data from:

• You, when you create an account, build a plan, complete a survey, request content or beta access, or contact us.
• Your use of the Service, when our systems and providers generate authentication, page-usage, device, network, security, and operational records.
• Services you connect or authorize, such as a financial-data connection or payment provider.
• Other authorized users, when a plan owner, collaborator, or other person with authority provides information about you in a shared plan.

We may use Personal Data to:

• create, authenticate, secure, and administer accounts;
• save, calculate, display, sync, export, and share plans as you direct;
• provide connected-account, billing, communication, and support functions;
• personalize settings and provide requested features and content;
• operate, test, troubleshoot, analyze, and improve the Service;
• understand broad product usage and signup or campaign conversion;
• protect users, prevent fraud or abuse, and investigate security incidents;
• communicate about the Service, legal notices, support, and preferences;
• enforce our Terms and other agreements; and
• comply with law, legal process, and lawful governmental requests.

We will provide notice or obtain consent when required before using Personal Data for a materially different, unrelated, or incompatible purpose.

We may disclose Personal Data to the following categories of recipients:

• Service providers that support hosting, databases, authentication, email, customer support, security, analytics, account connections, and payment processing. Current product infrastructure may include Supabase, Plaid, Stripe, and communications providers, depending on the feature used.
• People and services you authorize, including users with whom you share a plan and third-party services you connect.
• Professional advisers and authorities when reasonably necessary to obtain advice, comply with law or legal process, protect rights and safety, investigate misuse, or enforce agreements.
• Transaction participants in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar business transaction, subject to appropriate safeguards.

Service providers may process Personal Data only for the services they provide to us and under their contractual and legal obligations. Their independent services remain governed by their own policies.

Plans are private by default. A plan owner may grant another user access and assign an available role, such as viewer or editor. Depending on that role, the other user may view or change Personal Data contained in the plan. The owner can review and revoke shared access through plan settings where that functionality is available.

Only share a plan with people you trust. Alpha Retire does not control what an authorized recipient does with information they lawfully access outside the Service. A person who enters information about another individual represents that they have authority to do so.

The Service uses browser storage and authentication technologies needed to keep you signed in, preserve signup progress and preferences, maintain a pending account-connection flow, and provide requested functionality. Disabling this storage may prevent parts of the Service from working.

Alpha Retire records daily page-view counts using a fixed set of route labels. Public and unauthenticated traffic is retained as aggregate counts. For authenticated application pages, counts may be associated with a random analytics identifier so usage can be analyzed by broad user segment. That identifier is separate from account, authentication, and contact identifiers, but it remains pseudonymous Personal Data.

This page analytics system does not store raw URLs, query strings, plan or scenario identifiers, page contents, or analytics cookies. It is best-effort reporting and is not used as billing, audit, or security evidence. We do not currently use third-party advertising cookies, cross-site behavioral advertising, or session-replay technology.

We may create aggregated, de-identified, or anonymized information by removing or changing information so it cannot reasonably identify you. We may use and disclose that information for lawful purposes, including product analysis, research, security, and improving the Service. We will not attempt to re-identify data that we maintain as de-identified except as permitted by law to test whether de-identification measures work.

We use technical, administrative, and organizational safeguards intended to protect Personal Data based on its nature and how it is processed. Alpha Retire uses Supabase for cloud authentication and data storage; stored cloud data is protected at the storage layer and network connections are protected with TLS. Access controls are designed to limit plan data to authorized users and operational personnel.

Alpha Retire is not a zero-knowledge service: authorized systems must be able to read plan data to load, calculate, edit, sync, support, and share a plan. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your credentials, devices, and account access.

We retain Personal Data for as long as reasonably necessary to provide the Service and for the purposes described in this Policy. Retention depends on the data’s nature, sensitivity, source, purpose, account status, operational needs, and applicable legal requirements.

We may retain information longer when needed for security, fraud prevention, legal compliance, dispute resolution, enforcing agreements, collecting amounts owed, or backup and disaster recovery. Deletion from backups and archives may take additional time. We may retain de-identified or aggregated information that no longer identifies you.

Depending on where you live and subject to legal exceptions, you may have the right to ask us to confirm whether we process your Personal Data and to request access, correction, deletion, or a portable copy. You may also withdraw consent where processing relies on consent, opt out of certain communications, or appeal a decision concerning a privacy request where required by law.

You can change plan information and sharing access through available product controls. To make another privacy request, email alpharetire@gmail.com with enough detail for us to understand the request. We may need to verify your identity and authority before acting. An authorized agent may submit a request when permitted by law, but we may require proof of authorization.

We will respond within the period required by applicable law. We may deny or limit a request when a legal exception applies and will explain the decision when required. We will not discriminate against you for exercising an applicable privacy right.

Residents of certain U.S. states may have additional rights concerning access, correction, deletion, portability, sensitive data, targeted advertising, and the sale or sharing of Personal Data. Whether a law applies can depend on residency, the nature of processing, and statutory thresholds and exceptions.

Alpha Retire does not currently sell Personal Data for money or use or disclose it for cross-context behavioral advertising. We therefore do not currently offer a separate “Do Not Sell or Share” control. If these practices change, we will update this Policy and provide required opt-out methods, including honoring legally recognized browser preference signals where applicable.

Financial and household information may be considered sensitive under some state laws. We process it to provide the Service you request, secure and improve that Service, and for other purposes permitted by law—not to infer characteristics for advertising. You may contact us to ask whether a specific state right applies or to appeal a privacy-request decision.

The Service is not directed to children under 18, and we do not knowingly collect Personal Data directly from a child under 18. If you believe a child has provided Personal Data to us, contact us so we can investigate and take appropriate action. A plan owner may enter limited information about dependents or other household members as part of an adult’s financial plan.

Alpha Retire and its service providers may process and store Personal Data in the United States and other countries where they operate. Those locations may have privacy laws that differ from the laws where you live. Where required, we will use appropriate safeguards for cross-border transfers.

We may update this Policy as the Service, our practices, or applicable requirements change. The revised Policy will state its effective date. If a change is material, we will provide reasonable notice through the Service, by email, or by another appropriate method before or when the change takes effect, as required by law.

Questions, comments, privacy requests, or appeals may be sent to alpharetire@gmail.com. Please do not include financial credentials, full account numbers, Social Security numbers, or other unnecessary sensitive information in an email.

Pre-launch legal detail: Alpha Retire’s formal operating-entity name and mailing address will be added when finalized.