RetireFlow - Privacy Policy

RetireFlow - Privacy Policy (last updated Sep 2026)

Overview

RetireFlow is designed with a privacy-first architecture. By default, your financial planning data stays on your device. RandFact Works Inc. ("RandFact", "we", "us", or "our"), the developer and operator of RetireFlow, does not operate a server for your planning data, does not collect your personal financial information, and does not sell your personal data. Limited third-party transmissions occur only as described in this policy.

This Privacy Policy describes what the RetireFlow mobile application ("App") stores locally, what limited information is transmitted when you choose to use optional features, and how third-party service providers handle their respective data.

1. Data Stored Locally on Your Device

Outside optional third-party features you choose to use, financial planning data you enter is stored locally on your device using device storage such as AsyncStorage / NSUserDefaults. RandFact does not have access to this locally stored planning data.

Information stored locally may include:

First name and last name, entered at first launch for legal acceptance record-keeping.
Date of birth.
Residency, jurisdiction, household, retirement, and planning profile inputs.
Financial planning inputs, including income, benefits, balances, asset allocations, goals, spending assumptions, tax assumptions, currency settings, and other projection assumptions.
App settings and preferences, including display mode, interface state, sensitivity settings, and related configuration.
Legal acceptance timestamp, version, and local legal acceptance records.
Generated planning outputs, where applicable, including deterministic projection results, Monte Carlo results and percentiles, sensitivity results, backsolver results, cash-flow details, rule-based planning notices, and potential cross-border reporting indicators.
Saved scenarios, up to five slots. Saved scenarios include the scenario name, save timestamp, app and tax-data versions, input snapshots, and may include saved deterministic, simulation, rule-based planning notice, potential reporting indicator, and backsolver outputs.

No Cloud Sync: Because RetireFlow stores planning data locally, RandFact cannot recover your data if the App is deleted, your device is lost, or local storage is cleared. You are responsible for any manual backups.

Secure Device Storage: If you enable optional AI Observations and provide your own API key, the API key is stored in your device's secure OS keystore (iOS Keychain / Android Keystore), not in plain local storage. Secure OS storage behavior can vary by platform and may persist according to the operating system's rules.

2. Optional AI Features

AI Observations are optional and user-enabled. If you enable the feature and provide your own API key, the App transmits data directly from your device to the AI provider you select, such as Google Gemini, OpenAI, or Anthropic. RandFact does not proxy, store, inspect, or have access to these transmissions.

Information sent to the AI provider may include:

A masked projection summary designed to omit direct identifiers, including residency, integer ages computed from dates of birth (primary, spouse, and retirement), rounded dollar aggregates, asset allocation percentages, decade-level projection snapshots, Monte Carlo percentiles, sensitivity analysis results, backsolver results, scenario comparison data, and planning assumptions.
Your typed chat messages, subject to the App's message-length limits.
Conversation context needed for the AI provider to respond during the current chat session.

The AI payload is designed not to include your name or birthdate. You should avoid typing personally identifiable information, account numbers, confidential tax details, or other sensitive personal information into the AI chat.

Data transmitted to AI providers is governed by the privacy policies and terms of service of the provider you select, not by RandFact or RetireFlow. You are responsible for any API costs charged by your AI provider. You may disable AI features at any time in the App's Settings screen.

Provider privacy policies:

3. No Analytics, Advertising, Or Crash Reporting

RetireFlow does not include third-party analytics, advertising SDKs, telemetry SDKs, or crash-reporting SDKs such as Firebase, Sentry, Amplitude, or Mixpanel. RandFact does not receive usage statistics, diagnostic reports, or planning behavior analytics from the App.

5. Data Retention

Your locally stored data remains on your device until you delete the App, clear its storage, reset App data where supported, or manually delete saved scenarios.

Saved scenarios remain on your device until you delete them or clear the App's local storage.

AI chat history is held in device memory for the current app session and is not written to persistent RetireFlow storage. Reopening the AI chat during the same app session may reuse the current in-memory conversation if the underlying projection data has not changed.

No planning data is retained on any server operated by RandFact.

6. Children’s Privacy

RetireFlow is designed for adults planning for retirement. The App does not knowingly collect information from children under the age of 13.

7. Changes to This Policy

RandFact may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the App following an update constitutes acceptance of the revised policy.

8. Contact

For privacy-related questions or concerns, please refer to the support contact information listed in the RetireFlow App Store listing.

This Privacy Policy applies to the RetireFlow iOS application.

Page updated

Report abuse