Privacy policy

The free planner runs in your browser and sends us none of your numbers. If you subscribe, we hold your email address, your billing record and plans encrypted in your browser that we cannot read.

1. What never happens

• The figures you enter on this website stay in your browser. Saved plans reach us only as ciphertext. Your passphrase never leaves your browser.
• We connect to no bank or brokerage.
• Analytics carry no inputs, amounts or plan contents. Session recording is off.
• Website calculations do not send your figures to an AI service. Every calculation uses Dipperfield's own engine, including tools called through an AI assistant.
• We show no ads, sell no data, and send marketing email only if you ask for a reminder.

2. Data we touch

2.1 In your browser

Data

the planner inputs of a free run, held in the open page. A first-touch record in local storage: campaign tags, a ?via= referral code, the referring site, the landing page and when. PostHog's random identifier in a first-party cookie that lasts 365 days and in local storage.

Used to

run the planner and credit what brought a subscriber.

Kept

until you clear this site's data. A referral code counts for 60 days.

2.2 Your account

Data

your email address, when the account was created, and sign-in sessions stored as hashes. We count sign-in requests per IP address and per hashed email to stop abuse. When you ask for a sign-in link, we keep the app screen you were headed to and the first-touch record from 2.1 with that link, so it still works in another browser. Both are deleted when the link expires.

Used to

sign you in with an emailed link and tie your plans and subscription to you.

Who

Resend sends the email. Cloudflare stores the account in the United States.

Basis

performing the contract.

Kept

until you delete the account. A sign-in link lasts 15 minutes, a session 30 days, a request counter one hour.

2.3 Saved plans

Data

each plan as ciphertext, with what your browser needs to decrypt it and when it was saved.

Used to

give your plans back on any device where you sign in.

Who

Cloudflare stores them. Only your passphrase decrypts them; we cannot.

Kept

until you delete the plan or the account.

2.4 Reminders

Data

the address you enter in a reminder form, the year you asked, which reminder it was, and whether you confirmed.

Used to

once you confirm, send what that form offered. The year-end reminder is two emails, around November 20 and December 15. The IRMAA table email is one email, the day CMS publishes next year's IRMAA brackets.

Who

Resend sends them. Cloudflare stores the lists.

Basis

your consent. The link in each email removes you.

Kept

until you leave or January 31 of the next year. Unconfirmed addresses go after 7 days.

2.5 Billing

Data

your Stripe customer and subscription identifiers, status, price, renewal date and any unpaid invoice link. At checkout the first-touch record from 2.1 goes into the subscription at Stripe and our copy of it. We never see your card number.

Used to

charge the subscription, unlock saving, send the renewal reminder, and count which pages bring subscribers.

Who

Stripe takes the payment and sends receipts. Resend sends the renewal reminder.

Basis

performing the contract; our legitimate interest in knowing which pages bring subscribers.

Kept

our copy until you delete the account. Stripe keeps its records under its terms.

2.6 Analytics

Data

page views, time on page, scroll depth and named steps in the calculators, planner, sign-in and checkout. We also record page errors with their messages and stack traces. Events include the full page address with its query string, the referring page and campaign tags. Pages under /auth/, /invite/ and /api/ send no analytics. We filter their addresses, the sign-in token in /login addresses, and anything after # from PostHog's automatic page, referrer and page-history address fields. Error messages, stack traces and custom event details are outside this filter. PostHog receives your IP address and estimates your location from it. Our server adds billing events (subscription changes, refunds, account deletion, reminder confirmed) under an identifier that is never your email.

Used to

see whether the planner works and which pages lead to a subscription.

Basis

our legitimate interest in running and improving the product.

Kept

by PostHog under its terms. We keep no separate copy.

2.7 Request logs and backups

Request logs, including your IP address, are kept up to 7 days. The account store has 30 days of point-in-time recovery for disaster recovery only.

2.8 Tools connected to an AI assistant

If you connect an AI assistant to Dipperfield's tools, it sends the figures needed for your calculation to our server.

Data

the tool inputs, such as ages, income, account balances and the tax lines you choose.

Used to

compute the answer with Dipperfield's own calculation engine and return it to your assistant.

Who

Cloudflare runs the tools. Your assistant's provider handles your conversation, tool inputs and results under its own terms. For ChatGPT this is OpenAI; for Claude it is Anthropic.

Kept

we never store or log tool inputs or results. We count only the tool name, whether it worked and how long it took, for up to 7 days. Your assistant's provider has its own retention rules.

A planner link in the answer carries your figures after the #, which browsers never send to a server.

2.9 Support email

Data

what you write and your address.

Used to

answer you.

Kept

12 months after the thread closes.

3. Processors

• Stripe — payments, receipts, cancellation and refunds.
• Resend — sign-in, renewal and reminder emails.
• PostHog — analytics.
• Cloudflare — hosting, the account store and the calculation tools connected to AI assistants.

All are in the United States. Tool results also return to the assistant you connect, as described in section 2.8. EU and UK data reaches the United States under each processor's transfer safeguards.

4. Your rights

• Export: the planner saves your inputs as a JSON file, and the account page exports every saved plan, still encrypted.
• Delete: see Delete your account.
• If you are in the EU, the UK or another place with data-protection rights, you can ask us to show, correct, delete, restrict, export or stop using data about you. You can also complain to your local supervisory authority.
• Write to us from your account's email address; we answer within one month.

5. Children

Dipperfield is not directed at children. If a child has an account, write to us and we delete it.

6. Changes

If a change would affect what data we touch, we update this page and email account holders before it takes effect.

7. Contact

hi@dipperfield.com — WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA