Privacy Policy

9to95 is a retirement projection calculator. With one subscription you will be able to use it in two ways: through your own AI assistant, which calls the calculator on your behalf, or in our own web app, which you operate yourself after signing in. This policy covers both, and the 9to95.com website. It explains what we collect, what we never store, where your plan lives, and who else is involved. "We" and "us" mean the company named at the end of this policy.

1. The short version

• We do not store your plan. Your scenario (ages, balances, income, spending, assumptions) is sent to the calculator, used to run a calculation, and then discarded. We do not store the results either.
• In the web app, your plan is kept in your own browser, on your own device, and in any file you choose to save. We do not hold a copy. If you clear your browser or lose the device, we cannot get it back.
• We do not write the contents of your requests to our logs.
• The only personal information we keep is your account record, a record that you agreed to automatic renewal, a count of how much you use the calculator each day, and a small amount of billing and support information, all listed in section 2.
• The web app sets one cookie, to keep you signed in. Nothing else is set. There are no advertising cookies and no third-party analytics or trackers anywhere on 9to95.
• When your subscription ends, your account is frozen and its record is deleted 90 days later.
• We do not sell your information, share it for advertising, or use it to train AI models.
• If you use 9to95 through an AI assistant, your conversation happens in that assistant. Its provider keeps its own copy under its own rules, which we do not control.

2. What we collect and keep

This is what we will collect and keep once subscriptions open.

Your account record.

• Your email address.
• How you sign in: a one-way hash of your password. We never store a password in readable form, and we never see it.
• The connections you have approved between your AI assistant and the calculator, and the hashed sign-in tokens that keep those connections working. We also keep the registration that your assistant's software sends when it connects, which describes that software (its name and the addresses it returns to), not you.
• Your plan (annual or monthly), your subscription status and your renewal date.
• The date you accepted our Terms and which version.

Your consent record. The law requires us to be able to show that you agreed to automatic renewal. We keep that proof as a separate record that contains only: the subscription identifier Paddle gave your subscription; the date and time you agreed; the plan and price you were shown; which version of the checkout disclosure and of the Terms you agreed to; the dates and types of the renewal and price-change notices we sent you; and the date your subscription ended. It does not contain your email address, your name or your sign-in details. It can be connected to you only through Paddle's billing records.

Access logs. For each call to the calculator, whether your assistant makes it or you make it from the web app, our server writes one short line: the time, your account identifier, the name of the tool or the area of the app that was used (taken from a fixed list, never from what you typed), whether the call succeeded, and how long it took. The line does not contain what was sent or what was returned: no scenario, no figure from it, no result, no page address and no IP address. We keep no copy of these lines ourselves. They are held by our hosting provider as described in section 7.

Usage counts. To apply the limits on the calculator described in our Terms, we keep, for each subscriber, the number of simulation trials run on the current day. The count is one number per subscriber per day. It contains nothing from your plan and no result. Each day's count is deleted the next day. While a long calculation is running, the server also holds a running count of its trials in memory, so that it can be charged to the day's allowance.

IP addresses. Our server holds the IP address of each connection in memory only, to limit abuse such as repeated failed sign-ins and to limit how often the demo can be called from one address. It is not written to a log or a file and is discarded when the server restarts.

The demo. The demo needs no account and no sign-in. It runs only the invented sample households that come with it and cannot accept figures of your own, so you give it no information about yourself. When the demo is used we record the same access-log items as for any other call (time, tool name, whether it succeeded, how long it took), with no account identifier because there is none. We do not ask demo visitors for a name or an email address. If you reach the demo through an AI assistant, section 4 applies to that conversation.

Billing information from Paddle. Paid orders are sold by Paddle, our reseller and merchant of record. Paddle collects your payment details and keeps them under its own privacy policy. We never receive your full card number. Paddle shows us your email address, the country and postal code you gave at checkout, what you bought, and whether payments succeeded, failed or were refunded.

Messages you send us. If you email us, we keep the message and our reply. Please do not send account numbers, balances or other financial details by email. We do not need them to help you.

The websites. The 9to95.com pages are plain pages. They set no cookies, run no scripts, and load nothing from any other company. The web app is different because it is an application: it runs our own scripts, sets the sign-in cookie described below, and keeps your plan in your browser's storage. Neither uses advertising cookies or third-party analytics. The address of the web app will be published here before subscriptions open.

The web app

Where your plan is kept. When you build a plan in the web app, it is saved in your browser's own storage (a database the browser keeps for our site) on the device you are using. It is not saved on our servers. Nobody at 9to95 can see it, copy it, restore it or delete it. The app also keeps in your browser the plans you have saved for comparison, which plan and screen you had open, and your display settings.

What is sent to us. Each time you ask for a calculation, the app sends the plan to the calculator. The calculator runs the numbers, sends the result back to your browser, and discards both. This is the same calculator, with the same rule, that an AI assistant calls. A long calculation may run in the background while you keep working. Its inputs and its result are then held in the server's memory until your browser collects the result, and for no longer than two minutes. They are then deleted. They are never written to a log or a file, and a server restart leaves nothing behind. If you type figures from a filed tax return into the screen that checks the calculator against a return, they are handled exactly like the plan: sent for the calculation and discarded.

Files you save. You can save your plan to a file on your own device and open it again later, on this device or another. That file is yours. It is not sent to us when you save it. It is not encrypted. Anyone who has the file can read your plan, so keep it somewhere safe.

Reports. If you ask for a PDF or spreadsheet report, the server builds the file in a temporary folder, sends it to your browser, and deletes its copy at once, whether or not the send succeeded. We do not keep reports, and we cannot send you one again later. Run it again if you need it.

Sign-in session. When you sign in, the app sets one cookie, named __Host-retire_web, that keeps you signed in. It holds a random session token and nothing else: no name, no email address, no plan data. It is marked Secure, HttpOnly and SameSite, which means it travels only over encrypted connections, cannot be read by scripts, and is not sent when another website links to ours. A session lasts at most 12 hours and ends after 2 hours without use, or when you sign out. Our server stores only a keyed hash of the token. During the sign-in step itself the sign-in form sets one more short-lived cookie that protects the form against forged submissions; it is removed when you sign in. These cookies are strictly necessary to provide a service you have asked for, so no cookie consent is requested and no banner is shown. We will add a consent step if we ever add a cookie that is not strictly necessary.

No trackers. The web app runs our own scripts only. Its security policy, enforced by your browser, allows no script, font, image or connection from any other company. It loads no advertising, no third-party analytics, no session recording and no social media code. It does not track you across other websites, and no other company collects information about you through the app. Because we do not track visitors over time or across other sites, there is nothing for a "Do Not Track" or similar browser signal to switch off, and we do not change our behaviour in response to one.

If you lose the browser copy. Your plan is deleted from your browser if you clear your browsing data, use a private or incognito window, remove the browser, or lose or reset the device. Some browsers also remove a website's stored data by themselves after a period in which you have not visited it. We cannot restore a plan in any of these cases. Save your plan to a file if you want to be sure of keeping it.

Shared computers. The plan stays in the browser after you sign out, so that it is there when you come back. On a computer other people use, delete the plan from the app before you leave, and sign out.

When your account ends. Deleting your account record does not reach into your browser. A plan saved in your browser, or in a file, stays there until you delete it.

3. What we never store

• Your scenario, in whole or in part: names, dates of birth, balances, income, spending, Social Security estimates, assumptions. In the web app it is kept in your browser, not by us.
• Any projection or simulation result, beyond the time needed to calculate it and hand it to you.
• The content of requests or responses in logs, error reports or analytics.
• Your conversation with your assistant. We never receive it. We receive only the tool requests your assistant chooses to send.
• Bank, brokerage or other financial account credentials or connections. The Service does not link to financial accounts.

Because we do not keep your scenario or results, we cannot send them to you, restore them, or delete them later. They exist on our systems only while a calculation runs, while its result waits to be delivered to you, and while a report you asked for is being built and sent.

4. Your AI assistant and its provider

If you use 9to95 through an AI assistant that you chose, such as Gemini, Claude or ChatGPT, everything you type to your assistant, the scenario it writes, and the results we send back all pass through your assistant and may be stored by its provider, according to the settings and terms of your account with that provider. The provider decides for itself how that information is used and how long it is kept. It is not our service provider and we do not control it.

If you want to limit what is kept about your plan, look at your assistant provider's privacy settings and data controls. Deleting a conversation, or turning off history or model training where the provider offers that, is done there and not with us.

When you use the web app there is no assistant in between. What you enter goes only to our calculator.

5. How we use what we keep

• To create and secure your account and sign you in.
• To check that you have an active subscription and to apply the usage limits described in our Terms.
• To send account messages: receipts and confirmations, renewal reminders, notices of price or terms changes, security notices and replies to your questions.
• To keep the Service running, investigate faults and prevent abuse.
• To meet legal obligations and to establish or defend legal claims.

We send product news or marketing email only if you have asked for it, and every such email has an unsubscribe link and our postal address. Account messages are not marketing and are sent while you have an account. We do not use what we keep to profile you, to make automated decisions about you, or to train any AI model.

6. Who we share information with

We do not sell personal information, and we do not share it for advertising. We disclose it only to:

• Paddle (Paddle.com Market Limited and its affiliates, including Paddle.com Inc. for buyers in the United States), which sells subscriptions as merchant of record, takes payment, handles sales tax, refunds and billing support, runs the customer portal where you cancel or change your card, and uses its own privacy policy for the information it collects. Paddle becomes involved only when subscriptions open.
• Our hosting provider, Fly.io (Fly.io, Inc.), which runs the server the calculator and the web app operate on, in the United States. Fly handles your connection to the calculator and holds our server's access-log lines, as section 7 describes.
• Cloudflare (Cloudflare, Inc.), which serves the 9to95.com website pages and, in doing so, processes the requests your browser makes for them, including your IP address, under its own privacy policy.
• Our email provider, which will deliver our email and host our support mailbox. The company will be named here before subscriptions open.
• Authorities or other parties when the law requires it, for example in response to a valid subpoena or court order, or when needed to protect the Service or its users from fraud or attack. Because we do not store scenarios or results, we have none to produce.
• A successor, if the business is sold or reorganized. The successor must honor this policy for information collected under it.

Our service providers may use the information only to provide their service to us. Your AI assistant's provider is not our service provider; section 4 explains its role.

7. How long we keep it

These are the periods that will apply from the day subscriptions open.

• Account record: while you have a subscription. When your subscription ends, your account is frozen: it cannot be used and we do nothing with it except hold it. We delete the account record, including your email address, sign-in details and assistant connections, 90 days after the day your access ended. If you ask us to delete it sooner, we will do so within 30 days of your request.
• Consent record: three years after your subscription ends, because the law requires us to be able to show that you agreed to automatic renewal. It contains only the items listed in section 2 and no email address, so it stays after the account record is deleted.
• Access logs: our hosting provider, Fly.io, keeps our server's log lines for 7 days and then deletes them. We keep no copy and send them nowhere else. If we ever export log lines to investigate a fault or an attack, we delete the export within 90 days. In no case does a log line outlive your account record. Fly also keeps aggregate traffic counts (numbers of requests and response times, not individual requests) for about 15 days.
• Usage counts: each day's count is deleted the next day. Any count still held is deleted with your account record.
• Calculations in progress: inputs and results of a background calculation are held in memory for at most two minutes after it finishes, and are deleted as soon as your browser collects the result.
• Reports: deleted from our server as soon as they have been sent to you.
• Plans in the web app: we never have them. They stay in your browser, or in files you save, until you delete them.
• IP addresses: held in our server's memory for rate limiting only, and discarded on restart. Our hosting provider may record the IP address of each connection in its own network systems; we cannot see those records, do not copy them, and do not control how long Fly keeps them.
• Support email: 24 months after the conversation ends. If you wrote to us, your messages and the address you wrote from stay in our support mailbox for that time, even after your account record is deleted. Ask us and we will delete them sooner.
• Billing records: Paddle keeps transaction records for as long as tax and financial law requires.
• Scenarios and results: not kept at all.

8. Security

We keep as little as possible, which is the strongest protection we can offer. Beyond that: every connection to the Service is encrypted in transit; passwords are stored only as one-way hashes, and sign-in tokens and session tokens only as keyed hashes, so a copy of our sign-in store cannot be used to sign in; the web app runs under a strict browser security policy that allows no outside script; sign-in attempts are rate-limited; and access to the systems that run the Service is limited to the people who operate it. We review these safeguards when the Service changes.

No system is perfectly secure. If a security breach affects your personal information, we will notify you as the law requires, including under New York's breach notification law.

9. Your choices and rights

Whatever state you live in, you may ask us to:

• tell you what personal information we hold about you, where it came from, what we use it for and whom we have disclosed it to, and give you a copy in a portable form;
• correct it;
• delete your account and the information tied to it.

Email privacy@9to95.com from the address on your account. That is how we verify that the request is yours; we will not ask you for more than that unless we cannot match the address. You may also have someone make the request for you if they show us that you authorised them. We will answer within 30 days. We will not treat you differently, charge you more or give you less for making a request. If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you why. If you disagree with our answer, reply and ask us to review it; a different person will look at it and reply within 30 days, and we will tell you how to complain to your state's attorney general if you are still not satisfied.

For California residents. The California Consumer Privacy Act gives you the rights above by name: to know, to access, to correct, to delete, to data portability, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for using them. We give every one of them to everyone, as described above. In the terms the Act uses, the categories of personal information we will collect are: identifiers (your email address and account identifier); account sign-in credentials, which the Act treats as sensitive personal information and which we use only to sign you in; commercial information (your subscription and its history); and internet activity (the access-log lines and usage counts described in section 2). We collect them from you and from Paddle. We disclose them only to the service providers named in section 6, for the purposes in section 5. We do not sell personal information and we do not share it for cross-context behavioral advertising, we have not done so, and we will not do so, so there is nothing to opt out of and no "Do Not Sell or Share" link is needed. We do not use or disclose sensitive personal information for any purpose other than signing you in, so there is nothing to limit. We do not sell or share the personal information of anyone under 16.

For payment information held by Paddle, you can also contact Paddle at https://paddle.net.

10. Children

The Service is for adults. You must be at least 18 to have an account. We do not knowingly collect personal information from anyone under 18, and never from children under 13. If you believe a child has given us information, email privacy@9to95.com and we will delete it.

11. Where we operate

The Service is operated from the United States, our servers are in the United States, and the Service is offered only to people who live in the United States. If you use it from another country, your information is processed in the United States, and we do not offer the protections that the laws of other countries may require of businesses that market to their residents.

12. Changes to this policy

If we change this policy, we will post the new version here with a new effective date and keep the previous version available on request. If a change is material, for example if we ever began to store scenarios, or added a cookie that is not strictly necessary, we will email you at least 30 days before it takes effect, and we will not apply it to you without that notice. If you do not agree to a material change, you may cancel, and our Terms say what refund you get.

13. Contact

9to95 LLC, a New York limited liability company now being formed
privacy@9to95.com

Our business mailing address will be published on this page before subscriptions open.