RetireRebel Privacy Policy

Effective Date: October 6, 2026 · Version 1.2

These services are provided by FlowGrowth LLC, doing business as RetireRebel (“RetireRebel,” “we,” “us,” or “our”).

RetireRebel builds financial tools for Gen Xers who want options, not a generic retirement script. This Privacy Policy explains what data we collect, how we use it, and how we protect it when you use the RetireRebel web application and services. We built RetireRebel to be privacy-forward: we collect what we need to run your roadmaps, and nothing more.

1. What We Collect

We collect and store only the minimal data required to deliver your planning experience:

• Account Information: Your email address, used for passwordless magic-link sign-in via Supabase Auth.
• Saved Roadmaps: Financial inputs you enter, including account balances, projected income, spending goals, state of residence, dates of birth, ages, and planning assumptions related to health or caregiving.
• Roadmap Snapshots: Actual balance entries you record over time to track progress.
• Billing: If you subscribe, we store your Stripe customer id, price, and subscription status. Card numbers are entered on Stripe Checkout and are not stored in RetireRebel.
• Usage Preferences: Cookie and analytics preferences you set in the browser, such as the analytics preference saved on the Cookie Settings page.

2. Processed, but Never Stored

• Uploaded Documents: Paystubs, tax forms, or account statements you upload are read in memory solely to extract inputs into your roadmap. They are deleted immediately after processing and are never written to disk or stored.

3. Sensitive Information

Certain inputs—such as caregiving planning, longevity assumptions, or health check-ins in The Next 30—may touch on health-adjacent or care-related details. Where these qualify as sensitive personal information under applicable state laws:

• We process them solely with your affirmative action and explicit direction to construct your financial roadmaps.
• We never use sensitive information for advertising, marketing, profiling, or data broker sales.
• Most entries in RetireRebel are styled as general mathematical planning assumptions rather than personal health records.
• What you enter in The Next 30 (goals, health check-ins, the people you list by relationship and coarse distance, with an optional city or state for each, commitments, and legacy readiness statuses) is stored with your roadmap. The city or state is never sent to Google with an Ask the Rebel question. It never asks for street addresses, beneficiary names, document contents, or passwords. Notes an earlier version kept only on your device move to your roadmap only if you choose to copy them.

4. Information About Others

If you enter financial or caregiving details regarding a parent, spouse, child, or other family member while modeling roadmaps, you represent and warrant that you have obtained all necessary permissions and authority to share their information with RetireRebel.

5. What We Do Not Do

• No Selling or Sharing: We do not sell, rent, or trade your personal data to third parties.
• No Ads: RetireRebel is an ad-free service.
• No Bank Aggregation: We do not connect to your bank accounts, ask for institution credentials, or perform live account linking.
• No Sensitive Identifiers: We do not collect or store Social Security numbers.

6. How We Use Your Data

We use your data strictly to:

• Authenticate your identity and support passwordless magic-link sign-in through Supabase Auth.
• Save reminder and communication preferences for email features that are still rolling out.
• Save, reload, and organize your retirement roadmaps and snapshots.
• Power our AI assistant features and roadmap extraction tools.
• Remember your browser-level cookie and analytics choices. Analytics collection is not currently loaded in the product.

7. AI Processing & Data Retention (Google Vertex AI)

When you use document extraction or ask questions via Ask the Rebel, the relevant inputs or queries are sent to Google Vertex AI (Gemini). Some questions, such as general questions about The Next 30, are answered inside RetireRebel without being sent to Google.

• Model Training: Google Vertex AI/Gemini processing is subject to the production Google Cloud configuration and commercial terms that RetireRebel uses. Founder/legal review must confirm the final disclosure before broader launch.
• RetireRebel Storage: Uploaded documents are processed in memory by RetireRebel and are not written to RetireRebel storage. We do not store your Ask the Rebel conversations; each question is answered from the roadmap data you already saved and is discarded after the response.
• Educational Purpose: AI outputs are strictly educational roadmaps for testing tradeoffs. They are not individualized financial, tax, or legal advice.

8. Subprocessors & Infrastructure

RetireRebel uses these core infrastructure providers. Final subprocessor, region, and Data Processing Agreement details should be confirmed by founder/legal review before broader launch:

• Netlify: Application hosting and runtime infrastructure.
• Supabase: Managed database, authentication, and session management.
• Google Vertex AI: AI document processing and conversational assistant.
• Stripe: Subscription checkout, tax, invoices, and the billing portal.

9. Data Retention, Deletion, and Backups

• Roadmaps and Inputs: Retained as long as your account remains active, or until you delete specific roadmaps.
• Account Deletion: You can delete your account and all associated saved roadmaps at any time via in-app account settings. Deletion permanently purges your records from our live database.
• Backups: Residual data may persist in encrypted system backups for up to 30 days before automated rotation permanently overwrites it.
• Uploaded Files: Erased immediately after in-memory parsing.

10. Security

• Encryption: Production traffic should run over HTTPS/TLS, and saved application data is stored in Supabase-managed infrastructure. Final production encryption specifics should be verified before broader launch.
• Access Control: Database records are protected using Supabase Row-Level Security (RLS), ensuring only your authenticated account can read or write your data.
• Passwordless Auth: We use short-lived email magic links to eliminate password-based security risks.

11. State Privacy Rights (California, Connecticut, and US States)

If you reside in states with comprehensive privacy laws (e.g., CCPA/CPRA, Connecticut Data Privacy Act), you have specific rights regarding your personal information:

• Right to Know / Access: Request details on the data we hold about you.
• Right to Delete: Delete your personal data using our in-app delete-my-data flow or by contacting us.
• Right to Correct: Update inaccurate personal data directly in your account settings.
• Right to Data Portability: Export your roadmap inputs and snapshots in a structured JSON/CSV format using the in-app export tool.
• Opt-Out of Sharing / GPC: We do not sell personal data. RetireRebel currently stores an analytics preference locally in your browser, and the Cookie Settings page detects Global Privacy Control (GPC) so analytics remains off when a future analytics loader is added.
• Non-Discrimination: We will never discriminate against you for exercising your privacy rights.
• Request Handling & Verification: We verify requests by requiring you to submit them while authenticated into your account or via the email address associated with your account. We respond to verified requests within 45 days (extendable by up to 45 additional days when reasonably necessary).
• Right to Appeal: If we decline a privacy request, you may submit an appeal by replying directly to our privacy team.

12. Cookies

We use strictly necessary functional cookies for sign-in and session management. The Cookie Settings page also stores an analytics preference in your browser, but analytics scripts are not currently loaded in the product. For complete details, see our Cookie Policy.

13. Data Breach Notification

In the event of a security incident that compromises your unencrypted personal data, RetireRebel will notify affected users and relevant regulatory authorities in accordance with applicable state and federal laws without unreasonable delay.

14. Children’s Privacy

RetireRebel is an adult retirement-planning application designed exclusively for individuals aged 18 and older. We do not knowingly collect or solicit data from children under 18.

15. Geographic Scope

RetireRebel is intended for users located within the United States. Final production data-region disclosures should be confirmed against the live Netlify, Supabase, and Google Cloud configuration before broader launch.

16. Changes to This Policy

We may update this policy periodically. We will notify you of material changes by posting the updated version in the app and updating the effective date.

17. Contact

For privacy questions or to exercise your legal rights, email us at: privacy@retirerebel.com.