Privacy Policy

1. Introduction

DIGITI LLC ("we," "us," or "our") operates the website Prosperics.com (the "Site"). We are committed to protecting your personal and financial information. This Privacy Policy explains how we collect, use, share, and protect your data.

This policy is designed to comply with the Gramm-Leach-Bliley Act (GLBA) for financial data, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR), and Canadian privacy laws (PIPEDA).

2. Information We Collect

We collect information in three ways: directly from you, from third parties (social login), and automatically.

2.1 Information You Provide (Active Collection)

• Anonymous Users: If you use our calculators without logging in, we process your inputs transiently to provide the calculation. We do not store this data on our servers after the session ends.
• Registered Users (Customers): If you create an account to save your scenarios, we collect:
  • Identity Information: Name, email address, and password.
  • Financial Profile Data: When you use our Financial Profile feature, we store:
    • Income details (gross/net income, tax rates, filing status)
    • Budget breakdown (monthly expenses by category, savings rate)
    • Debt information (loan balances, interest rates, payment amounts)
    • Housing details (rent or mortgage payments, property costs)
    • Financial assumptions (retirement age, inflation expectations, risk tolerance)
    • Geographic location (country and state/province for tax calculations)
  • Calculator Results: Saved scenarios from our mortgage, loan, retirement, stock, and rental calculators.
  • Property Information: When using our rent or property value estimation features, the addresses and property details you enter.
  • Automatic Saving in Guided Flows (added June 2026): If you are signed in (or signed out with a device-local profile on this device) and complete one of our guided "Simple mode" decision flows (for example, Can I afford this home?, budget, retirement, or car), the answers you entered may be saved to your Financial Profile automatically a few seconds after your verdict is shown, so your plan stays up to date without an extra step. A "Saved to your plan" notice with an Undo button appears every time this happens, and tapping Undo cancels the save before it is sent. Free guests without an account are never auto-saved to our servers — while you are signed out, any guided-flow saves stay encrypted on your device only.
  • Onboarding Money Snapshot (added June 2026): If you complete the optional "Money Finder" step during onboarding, we collect banded (range-only) answers about your finances — for example, a debt-balance range, a savings range, a monthly-contribution range, household size, and dependents — never exact dollar amounts at this step. These banded answers and the resulting estimate of how much our planning tools could be worth to you are stored with your goal-led plan in your Financial Profile, and you can skip the step entirely.

  Because you have a continuing relationship with us via your account, this data is treated as Non-public Personal Information (NPI) under GLBA.

• Subscription & Payment Information: If you subscribe to a paid plan:
  • Payment provider information (Stripe, PayPal, Apple Pay, Google Pay)
  • Subscription details (plan type, billing cycle, purchase platform)
  • Payment history and transaction records

  We do not store your full credit card number. Payment processing is handled by our third-party payment providers (Stripe and PayPal on the web; Apple App Store and Google Play in our mobile apps).

• Referral & Partner Program Information: If you participate in our referral, Creator, or Partner programs (see /creator-program), we collect:
  • The referral or creator code you share, and the codes you arrive through (so we can attribute signups and credit rewards)
  • Anti-fraud signals tied to a referral attempt — IP address, a one-way hash of the email address, attribution timestamps, and limited device signals — retained for fraud detection only
  • For Tier 3 (Partner) revenue share only: tax form status (W-9 or T4A), the masked last 4 digits of your payout bank account, and your Stripe Connect account ID. Stripe collects and stores the underlying tax-form data; we never receive your SSN or SIN.

  Anti-fraud signals are processed under our legitimate interest in preventing referral abuse (GDPR Art. 6(1)(f)). For Canadian residents, fraud-prevention processing falls under PIPEDA's exception for purposes that a reasonable person would consider appropriate. You may request access or deletion of these records via privacy@prosperics.com, subject to fraud-record retention obligations.

2.2 Information from Third Parties (Social Login)

If you choose to log in using Google, we collect your name, email address, and profile picture associated with that third-party account. We do not receive your password for those third-party sites.

2.3 Information Collected Automatically (Passive Collection)

When you access our Site or mobile app, we automatically collect:

• Device Identifiers: IP address, browser type, operating system, and device type.
• Usage Data: Pages visited, dwell time, calculator usage frequency, and feature interactions.
• Feature Usage Tracking: We track usage of premium features (such as rent estimates and stock lookups) to enforce subscription limits.
• Tracking Technologies: We use cookies and local storage to maintain your session and preference settings, and for analytics purposes (such as distinguishing unique visitors and tracking session activity). Analytics cookies are only set after you provide consent.
• Referral Attribution Cookie: If you arrive at our Site through a referral, Creator, or Partner link (for example, a URL containing ?ref=), we set a first-party, HTTP-only cookie named prosperics_ref for up to 60 days. The cookie stores the referral code, the creator handle (if any), the marketing campaign tags (UTM parameters), and your selected country and locale at first touch. We use it solely to attribute account signups to the correct referrer or partner so we can credit the right reward. The cookie does not contain your name, email, or any financial data and is not used for advertising. You can clear it from your browser settings at any time.
• Session Recording: On prosperics.com and in our iOS and Android apps we use session replay to diagnose bugs and improve the experience. (1) On prosperics.com only, Sentry Session Replay is enabled at a sampled rate for a small percentage of sessions; all text is masked by default and media is blocked, so financial inputs, calculation outputs, and PII are not captured. Sentry Session Replay is not enabled in the mobile apps. (2) PostHog Session Replay runs on web and mobile only if you have granted analytics consent (cookie banner on web; Settings → Privacy on mobile). On mobile, the PostHog SDK masks all on-screen text, all text inputs, and all images by default, and we additionally mask every sensitive surface — balances and other financial values on the dashboard, calculators, financial flow, and saved scenarios; goal names and progress amounts; AI Advisor chat content; multi-factor authentication codes (TOTP secret, backup codes, QR image); email echoes on auth screens; and saved-scenario titles. On web, financial inputs, simple-mode calculation outputs, and identity fields (name, email, MFA secrets) are masked. Advanced calculator outputs remain a follow-up. Both vendors process data in the United States. You can opt out of website session recording through your cookie preferences at any time. On mobile, turning off Usage Analytics in Settings → Privacy disables both event tracking and replay capture.
• IP Address Handling: Your IP address may be used transiently for approximate geolocation (country/region level) but is not stored by our analytics provider. IP address capture is disabled in our analytics configuration.
• Fraud Prevention and Platform Security (added June 2026): To keep automated and fraudulent signups off the platform, we process a small set of security signals when you register or sign in. (1) Registration on the website and in the mobile apps is protected by Cloudflare Turnstile, a privacy-preserving bot check; your browser or device solves a challenge and the resulting token (optionally with your IP address) is verified with Cloudflare. (2) We apply short-lived rate limits and signup-velocity checks keyed on your IP address and, in the mobile apps, the app-generated device install ID; these counters live in our rate-limiting infrastructure (Upstash Redis) and expire automatically within minutes to hours. (3) We compute a canonical form of your email address (for example, collapsing Gmail dot- and plus-variants) so the same mailbox cannot be reused for duplicate or self-referring accounts. (4) At signup we may compute a fraud-risk score from signals such as signup velocity, email patterns, and missing client signals; when the score is elevated we store the score and the contributing signal names with your account record, and accounts assessed as abusive may be quarantined (sessions revoked and referral rewards withheld) pending review. These signals are used solely for fraud prevention and platform security — never for advertising — and are processed under our legitimate interest in protecting the service (GDPR Art. 6(1)(f)); for Canadian residents this processing falls under PIPEDA's exception for purposes a reasonable person would consider appropriate. You may contact privacy@prosperics.com to request access, subject to fraud-record retention obligations and our need to not undermine the protection itself.
• Country Preference: We store your selected country (US or Canada) in local storage to maintain your calculator settings across sessions. This preference is stored only on your device.

2.4 Third-Party Data Sources

To provide our services, we may retrieve data from third-party sources:

• SEC EDGAR: Public company financial statements and filings for our Earnings Tracker.
• Stock Market Data Providers: Real-time and historical stock prices for our Stock Calculator.
• RentCast: Property value and rental estimates based on addresses you provide (requires subscription).
• FRED (Federal Reserve Economic Data): We use the FRED® API to retrieve economic data including:
  • Consumer Price Index (CPI) and inflation data from the U.S. Bureau of Labor Statistics
  • Mortgage rates from Freddie Mac
  • Interest rates and loan rates from the Board of Governors of the Federal Reserve System

  This product uses the FRED® API but is not endorsed or certified by the Federal Reserve Bank of St. Louis.

• Bank of Canada: Canadian interest rates, bond yields, and mortgage rate data via the Bank of Canada Valet API.
• Statistics Canada: Canadian inflation and CPI data via the Bank of Canada.
• U.S. Treasury: Treasury yield curve data for our Bonds Tracker.
• HUD (Department of Housing and Urban Development): Fair Market Rent data for rental calculations.

These third-party services have their own privacy policies. We only share the minimum data necessary to provide the requested service (e.g., an address for property estimation). No personal data is sent to economic data providers—we only request publicly available economic statistics.

2.5 Mobile Application

If you use our mobile app (iOS or Android), we additionally collect:

• Platform Information: Device type, operating system version, and app version.
• In-App Purchase Data: Transaction identifiers from Apple App Store or Google Play Store.
• Cross-Platform Sync: If logged in, your Financial Profile syncs between web and mobile.
• Biometric Authentication: If you enable biometric security (Face ID, Touch ID, or Fingerprint), authentication is handled entirely by your device's secure enclave. We do not collect, store, or have access to your biometric data. We only store your preference (enabled/disabled) locally on your device.
• Encrypted Subscription Cache (Mobile): To make the app start quickly even when offline, the mobile app keeps a small cache of your subscription entitlement (plan, expiry, source) on the device. This cache is encrypted with AES-256-GCM using a key stored in the operating system's secure enclave (iOS Keychain / Android Keystore). If the encryption key is unavailable, no plaintext subscription data is persisted.
• Android 13+ Push Permission: On Android 13 and later, the operating system asks for a separate permission before any app can send you push notifications. We will only ask you for that permission after you turn on a feature that needs push (for example, weekly check-in reminders or rate alerts). If you deny the system prompt, the corresponding in-app toggle will snap back off so you are not left consenting in the app while the OS is still blocking delivery.
• Anonymous Subscription Identifiers (Guest Purchases via In-App Purchase): When you subscribe to Prosperics Pro through the Apple App Store or Google Play Store without first creating an account, we generate a random device install ID — a UUID v4 stored in the operating system's secure enclave (iOS Keychain / Android Keystore) — and pair it with the receipt or original transaction identifier returned by Apple or Google. Together, this pair is what verifies your subscription on subsequent app opens. The device install ID is not a hardware identifier and not a tracking identifier: it is generated by the app, never sent to advertising networks, and is reset if you uninstall the app. We store the receipt and the device install ID in our IapAnonymousEntitlement table on our servers, keyed solely by the receipt — there is no name, email address, or financial data attached to the row. If you later restore the same subscription on additional devices (for example, an iPhone and an iPad sharing one Apple ID), each install ID is recorded in an IapAnonymousEntitlementDevice join row so all devices keep reading "subscribed" until the receipt expires. When you sign in and link your account, the row is promoted to your standard Subscription record under your user ID; the original anonymous row is left in place as audit history.
• Encrypted On-Device Storage for Guest Pro: When you use Prosperics Pro features (Saved Results, Financial Profile, Goals, Alerts, Prosperics AI) before creating an account, we keep the data on your device only, encrypted with AES-256-GCM using a key stored in the operating system's secure enclave (iOS Keychain / Android Keystore). This includes saved calculator scenarios, your Financial Profile inputs, Goals you create and check-in history, alert rules and watched-metric history (kept until the alert triggers or you delete it), monthly Financial Profile snapshots used to power your Dashboard trends, and AI conversation content (Prosperics AI history). When you sign in, this data is batch-imported into your account via idempotent endpoints and the local copies are deleted only after we receive a 200 OK confirmation. If you log out, all encrypted on-device data classes listed above are wiped from the device so that another person signing in on the same device does not inherit your data. As we roll the feature out, free guests on mobile may also build a Financial Profile without a subscription; it uses this same on-device encrypted storage, import-at-sign-in, and wipe-at-logout behavior.
• Free Guest Local Saves and Automatic Import at Sign-In (added June 2026): If you use the app or website without an account and without a subscription, you may save a limited number of calculator results (currently up to 3) directly on your device. These saves are encrypted on-device (on mobile with AES-256-GCM using a key in the operating system's secure enclave) and are never sent to our servers while you remain a guest. When you later create an account or sign in, any guest saves on the device — and any on-device Financial Profile you have built (guest Pro subscribers today and, as we roll the feature out, free guests on mobile) — are automatically imported into your account so you do not lose your work; the local copies are deleted after the import is confirmed. If you do not want guest data imported, delete the saved items before signing in.
• Push Notifications for Guest Pro: If you enable push notifications while subscribed but not signed in (for example, to receive a rate alert), we register your Expo push token under your anonymous entitlement (IapAnonymousPushToken table) so we can deliver the alert. The token is keyed only on the anonymous entitlement and never on a name, email, or other personal identifier. When you sign in and claim your entitlement, the token is mirrored to your standard PushToken table under your user ID and used for any future deliveries. Email-channel deliveries (alert emails, PDF report emails) are not available to guest subscribers because we do not have a verified email address until you sign in — alerts are delivered as push only and PDF reports are downloaded directly from the app.
• Subscription Account-Conflict Disclosure and Recovery Email (added May 2026): When you attempt to purchase, restore, or claim a Pro subscription whose Apple or Google receipt is already linked to a different Prosperics account, the app may show a redacted hint of the linked email address (for example, "linked to j****n@example.com") so you can recognise which of your accounts owns the subscription. The redaction is calibrated so a passive observer cannot reconstruct an email address from a screenshot, while a user who knows the local part can still recognise their own account. The redaction is not shown when Apple Family Sharing indicates the receipt-bearer is not the original purchaser. If you need to recover access to the account that owns a Pro subscription, you can tap "Email me a recovery link" in that same alert. We then send a single-use, time-limited sign-in link to the verified email address on file for the account that owns the receipt. The link expires after 30 minutes, may be used only once, and never reveals any information about the account to anyone other than its owner. To protect against scraping, each request to send a recovery email is rate-limited per device and per receipt, and we always return the same response whether or not an account is found — only the rightful owner's mailbox ever receives the email. We keep a short audit log of these requests for 90 days, containing only a hashed receipt identifier, a hashed source IP, and a coarse browser/app family ("iOS-App", "Android-App", "Web-Chrome", "Web-Safari", or "Other"); no raw IP, raw user agent, raw email address, or raw receipt identifier is stored. The audit log is used solely to detect abuse of the recovery channel.
• Over-the-Air JavaScript Bundle Delivery (added May 2026): The Prosperics mobile app uses Expo Updates (operated by Expo, Inc., as a sub-processor of EAS Update) to deliver small JavaScript and asset patches between full App Store / Play Store releases. On each cold start, the app contacts EAS Update with: the app's runtime version, the current update id, the user's device class (iOS / Android), and the channel name (production or beta). No personal data, account identifier, financial profile data, plan content, AI conversation, or saved-result data is sent to Expo as part of this check. Expo's privacy notice is available at https://expo.dev/privacy. We do not use Expo's Branch / EAS Insights modules.
• App Ad Conversion Measurement (added July 2026): To measure which of our own ads bring people to Prosperics, the mobile apps include two ad-measurement SDKs: Google Analytics for Firebase and Meta App Events. Both stay dormant until you grant analytics consent (Settings → Privacy → Usage Analytics), and on iOS neither receives your advertising identifier unless you also allow tracking at the App Tracking Transparency prompt. When enabled they receive four conversion signals only — the first time you open the app, account registration, trial start, and purchase (amount, currency, and plan name) — plus, once you sign in, your email address in hashed form. Google uses the hash for on-device conversion measurement, which performs the match on your device and returns only the aggregate result; Meta uses it for advanced matching. Neither receives your Financial Profile, calculator inputs, calculation results, goal names, AI conversations, or session replays. On iOS, measurement additionally runs through Apple's SKAdNetwork and Meta's Aggregated Event Measurement, both of which report conversions in aggregate rather than per person.

2.6 Prosperics AI (AI Chat Feature)

When you use Prosperics AI, our AI-powered chat feature (available to Prosperics Pro subscribers), we process data as follows:

• Conversation Data: Your chat messages and the AI's responses are stored locally on your device (browser localStorage or mobile app storage) for conversation continuity. You can clear this history at any time.
• Third-Party AI Providers: To generate responses, your messages are sent to a third-party AI service provider. We currently use:
  • DeepSeek DeepSeek (our sole AI chat provider; as of June 2026 we no longer send any chat data to Anthropic)
• PII Redaction: Before sending your messages to external AI providers, we apply automatic redaction to remove or tokenize sensitive personally identifiable information (such as Social Security numbers, account numbers, and specific addresses) to protect your privacy.
• Financial Profile & Dashboard Context: If you have saved a Financial Profile, relevant data (income, location, filing status) may be included in the AI context to provide personalized responses. To answer dashboard-aware questions, we may also include an aggregated summary of your Financial Dashboard — for example, your computed financial health score and its sub-pillars (savings rate, debt-to-income ratio, housing-cost ratio, emergency-fund runway), your action queue, and headline KPIs including total net worth. We do not send any free-text you entered, document attachments, or raw transaction history. All of this context is subject to the same PII redaction process before transmission to external AI providers, and you can review or remove the underlying data at any time from your Financial Profile.
• Calculator Tools: When the AI performs calculations on your behalf (income tax, mortgage, retirement projections, etc.), these calculations are executed on our servers using deterministic code—not by the AI itself—to ensure accuracy.
• Cloud Sync (Optional): If you enable cloud sync for your conversations, your chat history is encrypted end-to-end (E2E) before being stored on our servers. We use AES-256-GCM encryption with PBKDF2 key derivation from your passphrase. Your passphrase never leaves your device, meaning we cannot decrypt or read your synced conversations.
• Encrypted Exports: When you export your chat history, it is encrypted with a password you provide. The export file can only be decrypted with the correct password.
• Optional Weekly AI Insight: If you turn on Weekly AI Insight (a retention feature, off by default), we send a pseudonymized summary of your numbers to the same AI provider that powers Prosperics AI to generate a one-paragraph summary. We do not send your name, email address, or any free-text entries. You can stop this processing at any time from Settings > Privacy > Retention preferences.
• AI Cost Ledger for Guest Pro: When you use Prosperics AI while subscribed but not signed in, we maintain a per-receipt message and cost counter (IapAnonymousAiUsage table) keyed solely on your anonymous entitlement and the calendar month. The ledger has two row types: one tracks how many AI messages have been sent under this receipt this month; the other tracks the cumulative third-party AI cost in millicents, capped at the same monthly cost ceiling that applies to authenticated Pro users. The ledger contains no message content, no name, no email, and no financial data — only the anonymous entitlement ID, the feature key, the year/month, and the counters. No conversation content is stored on our servers for guest Pro users: Prosperics AI conversations are end-to-end encrypted on your device only; cloud sync (and the existing ChatConversation/UserEncryptionKey tables) takes effect after sign-in.
• Calculator Prefill by the AI Advisor (added May 2026): When you have turned on "Weekly AI insight & advisor prefill" in Settings → Your Privacy Choices → AI insights (which also requires the prerequisite "AI insight processing" toggle), Prosperics AI may pre-fill the input fields of calculators it opens on your behalf using information you have already saved: your goal-led plan answers (goal, life stage, time horizon, blocker, income bracket, housing tenure, country) and a snapshot of your Financial Profile. The AI advisor never sees the raw amounts; it only receives the categorical fields it needs to fill in (for example, "income bracket" rather than "$84,200/yr") and a short audit envelope that lists the names of the fields it pre-filled so we can show you a clear "AI pre-filled these fields" badge above the calculator result. You can turn this off any time from the same Settings screen, and turning off the parent "AI insight processing" toggle disables both the weekly insight email and the prefill behaviour. Prefill is permanently disabled for the stock-valuation tool because we do not want any AI-derived input to influence a number that some users treat as investment advice.

Important: Prosperics AI is an educational tool designed to help you understand financial concepts and use our calculators through natural conversation. It is not a licensed financial advisor, investment advisor, or tax professional. AI responses should not be considered financial, investment, tax, or legal advice. Always consult with qualified professionals before making financial decisions.

Our third-party AI provider has its own privacy policy and data retention practices. We recommend reviewing:

• DeepSeek Privacy Policy: deepseek.com/privacy

2.7 Retention Features (Optional)

We offer a set of optional features designed to help you stay on track with your financial goals. These features are off by default. You can turn each one on or off at any time in Settings > Privacy > Retention preferences:

• Engagement Nudges: In-app and push reminders when your weekly check-in is due. We use only your own data to decide whether to remind you. No ad targeting.
• Plan Impact Alerts: We compare your saved plan against public market data (interest rates, CPI) and notify you when a change would affect your plan.
• Weekly AI Insight: A short weekly summary of your numbers is sent to our AI provider to produce a personalized one-paragraph insight. We remove personal identifiers before the summary leaves our servers and do not send any free-text you entered. Turning this off stops all LLM processing for the weekly insight.
• Widget Amounts: If you add one of our home- or lock-screen widgets, turning this on shows amounts without requiring you to unlock your device.
• Life Event Timeline: Lets us keep a private list of life changes you log (new job, move, family). We never share this with third parties.
• Scenario Watches, Watchlists & Earnings Watch (added June 2026): When you turn on a plan-impact alert, a scenario watch, or an earnings/ticker watch, we store on our servers the metric or stock ticker symbol you chose to watch, your alert thresholds and delivery preferences, and — for scenario watches — a snapshot of the calculator inputs that make up the watched scenario, so we can re-run the scenario when market data changes and tell you whether the verdict still holds. Ticker watchlist entries consist of your account ID and the symbol only. This data is kept while the watch is active and is deleted when you remove the watch or delete your account. Earnings-filing dates we check against are public SEC data and are stored per symbol, not per user.
• Rate & Plan Alerts (Guest Pro): When you create a rate or plan alert while subscribed but not signed in, we store the alert rule, the metric you are watching, and any delivery history in three entitlement-scoped tables (IapAnonymousWatchedInput, IapAnonymousPushToken, and IapAnonymousAlertDelivery). All three are keyed solely on your anonymous entitlement; they do not contain a name, an email address, or any financial data. Email delivery is not available for guest subscribers because we do not have a verified email address until you sign in — guest alerts are push-only. When you sign in, alerts that are still armed or recently triggered are ported onto your standard alerts table (WatchedInput) under your user ID via the claimAnonymousAlerts step in /api/mobile/iap/claim, and any Expo push tokens registered under the entitlement are mirrored to the standard PushToken table; the original anonymous rows remain as audit history with status "claimed".
• Home- and Lock-Screen Widget Data (added May 2026): When you add a Prosperics home-screen or lock-screen widget, the app writes a small snapshot to a system-protected container that the widget extension reads on a schedule. On iOS this is an App Group container shared between the app and the widget extension; on Android it is an encrypted shared-preferences file. The snapshot contains the name and percentage to goal for the goal you have chosen to pin, plus the public macro indicators (United States or Canadian CPI inflation rate and the 30-year mortgage rate). Dollar amounts and balances are not written to the lock-screen widget by default. If you opt in via Settings → Your Privacy Choices → Widget lock-screen amounts (the widgetLockScreenAmounts retention flag), formatted progress amounts may also be written so the widget can render them while the device is locked; you can turn this off any time. The widget extension never makes network calls; it only reads the local container that the main app refreshes.

We keep an audit record of every change you make to these settings, including the exact text we showed you at the time, so we can prove the version of consent you gave. You can request a copy by emailing privacy@prosperics.com.

2.8 Future Personalized Affiliate Product Recommendations (Disclosed in Advance)

We are evaluating a future feature that may use information you have provided to Prosperics — your saved Financial Profile, the calculators and goals you use, and your stated country and region — to suggest third-party financial products (for example, mortgage lenders, debt-consolidation services, insurance providers, or investment platforms). When this feature launches, we may receive a referral commission if you sign up for a recommended product through our link.

Until this feature is enabled in your version of the Site or app, no recommendation logic runs and no data is sent to affiliate partners. We are publishing this disclosure now so you have notice before any change in processing.

Consent and Control Before Activation

• When we activate the feature, you will receive a clear in-app and on-Site disclosure plus a per-feature consent prompt before any matching takes place.
• You will be able to decline the feature entirely from Settings → Privacy → Affiliate recommendations, in which case no recommendation logic will run on your data.
• Every recommended product will carry a clear "Sponsored" or "Affiliate offer" label and a disclosure that we may earn a commission if you sign up.
• You may withdraw your consent at any time. After withdrawal we will stop generating new recommendations from your data.

What We Will and Will Not Share With Affiliate Partners

• We will not share your name, email address, raw income or debt amounts, specific calculation inputs, transaction history, document attachments, or any free-text you have entered.
• We may share derived signals (for example, "interested in fixed-rate mortgages, US, household income band: middle-income") and a one-way pseudonymous identifier so the affiliate can attribute a signup back to us for commission purposes.
• You may request a copy of the exact signals associated with your account before the feature activates by emailing privacy@prosperics.com.

Conflict of Interest Disclosure: Because we receive a commission when you sign up for an affiliate product, we have a financial incentive that may not always align with your individual interests. Recommendations are not financial advice. We will continue to mark recommended products as "Sponsored" and disclose the commission arrangement at the point of recommendation.

We disclose this practice in advance to satisfy GDPR Article 6(1)(a) (consent) for any future recommendation processing, the CCPA / CPRA "Sharing" disclosure requirements for cross-context behavioral profiling, and PIPEDA Principle 4.2 (Identifying Purposes).

Clarification on App-Activity Surfaces (May 2026):

When this future feature launches, the "information you have provided to Prosperics" referenced above is intended to include the Goals you create, the metrics you set up Alerts for, the health-score pillars and headline KPIs visible on your Financial Dashboard, and the aggregated monthly snapshots that power your Dashboard trends — in addition to your saved Financial Profile and calculator usage already disclosed. We are calling this out explicitly so the existing consent paragraph above unambiguously covers these surfaces if and when matching is enabled. No recommendation logic runs on this data today, no derived signals are computed from these surfaces, and the conditions under which we could ever do so (explicit consent before any matching, conflict-of-interest disclosure at the point of recommendation, the right to decline the feature entirely from Settings → Privacy → Affiliate recommendations) are unchanged.

2.9 Surveys and Customer Research (added September 2026)

From time to time we ask for your opinion. There are three kinds of research contact, and all of them are voluntary — you can skip, dismiss, or stop at any point with no effect on your account or subscription.

• Short in-app surveys: After certain moments in the product (for example, viewing a calculation result or finishing the quick start) we may show a one- or two-question prompt asking what you were trying to do and whether it worked. These prompts are delivered by PostHog, appear only if you have granted analytics consent (cookie banner on web; Settings → Privacy → Usage Analytics on mobile), and are shown at most once per prompt and no more than once every seven days across all prompts. We currently show them only to users in the United States and Canada, excluding Quebec.
• Invited surveys by email: If you created an account, we may email you — from a clearly identified Prosperics or research address — an invitation to a longer questionnaire hosted on prosperics.com and PostHog. The invitation link contains an identifier for your account so we can (a) send any thank-you gift card we offered and (b) read your answers alongside how you used the app or site, to understand what worked and what did not. We do not use that identifier to name you in any report. Every research email tells you how to stop further research email (reply STOP or use the link in the footer), and stopping applies to the whole research series.
• Paid interviews: We may invite some users to a 30-minute video or phone conversation. Participation is voluntary, scheduled through a booking page, and compensated with a gift card of a published amount. Notes or recordings are kept only until they have been coded into anonymized research records, then deleted.
• What we collect and how it is stored: Survey answers — including any free text you type — are stored by PostHog (our analytics processor, United States) and processed under this policy, and in an anonymized research database we keep. Free-text answers are user-provided content: please do not include account numbers, passwords, or exact dollar amounts; we ask this on every open question, and we do not need that detail to act on your feedback. Answers you give may be quoted in internal research documents, attributed only to a participant number. Gift cards are sent through Tremendous (our payment processor, United States), which receives only the email address needed to deliver the card and keeps its own transaction record; we keep the transaction records needed for bookkeeping and tax for seven years and remove the delivery address from our research records within 90 days of payment.
• How we use it: To understand what people come to Prosperics to do, why some stop using it, and what to build, fix, or remove. Research answers are never used for advertising, never sold, and never shared with ad networks or affiliate partners. What you say in a survey or interview does not change any payment we offered.
• Your choices and rights: You can decline any in-app prompt, ignore any invitation, or reply STOP to end research email. Survey answers are personal information tied to your PostHog profile and are covered by the same access, correction, and deletion rights described in Section 6, including deletion through Account Settings, which also removes your data from PostHog. You may also exercise these rights, or ask us to remove a specific survey answer, by emailing privacy@prosperics.com. Please note: Because PostHog cannot delete a single event on its own, if you ask us to remove a specific survey answer, we will remove it from our internal research records and, if you wish, delete your entire PostHog analytics profile.

Legal basis: consent (in-app prompts are gated on your analytics consent and each questionnaire opens with a consent statement) and our legitimate interest in improving the Services (GDPR Art. 6(1)(f); PIPEDA Principle 4.3). Gift cards may be taxable income to you; you are responsible for any tax.

3. How We Use Your Information

We process your data for the following lawful purposes:

• Service Provision: To perform the financial calculations you request, maintain your user account, and sync your Financial Profile across devices. (GDPR Basis: Performance of Contract)
• Financial Profile Features: To pre-populate calculator inputs, provide personalized affordability insights, and generate integrated financial reports based on your saved data. (GDPR Basis: Performance of Contract)
• Third-Party API Requests: To fetch property valuations, rent estimates, stock data, and SEC filings on your behalf when you use those features. (GDPR Basis: Performance of Contract)
• AI-Powered Features (Prosperics AI): To process your chat messages through third-party AI providers, generate conversational responses, and execute financial calculations based on your requests. PII is redacted before transmission to external providers. (GDPR Basis: Performance of Contract / Consent)
• Subscription Management: To process payments, manage subscription tiers, enforce usage limits, and sync subscription status across platforms. (GDPR Basis: Performance of Contract)
• Security: To authenticate your identity via password or Multi-Factor Authentication (MFA), and protect against unauthorized access. (GDPR Basis: Legitimate Interest)
• Advertising & Optimization: We use Google Analytics and PostHog to understand site traffic and user behavior patterns, and advertising partners (Google AdSense on web, Google AdMob on mobile) to display relevant advertisements. PostHog helps us analyze how users interact with our calculators and features (clicks, page flows, and masked session replays on web and mobile when you consent) to improve the product experience. On mobile, replay frames mask all text, inputs, and images by default plus per-view masking on financial amounts, goal names, AI chat, MFA codes, email echoes, and saved-scenario titles. We may use information about your calculator usage (such as which calculators you use and general financial interest categories) to serve you more relevant advertisements. In the mobile apps, free-tier users may also choose to watch an optional rewarded ad (served by Google AdMob) to temporarily unlock a capped feature; when you do, we record the grant against your usage counters (feature key, count, and month) so we can honor it — grants are capped per month and no additional personal data is shared with the ad network beyond the standard AdMob ad request. We do not share your raw financial data (specific income amounts, debt balances, or calculation results) with advertisers or analytics providers. (GDPR Basis: Consent)
• Product Improvement & Experimentation: We may use feature flags and controlled experiments (A/B testing) to test improvements to our calculators, user interface, and features. These experiments use anonymized usage data to evaluate which version performs better. No financial data is used in experiment targeting. Experiment participation is determined automatically and does not require additional data collection beyond what is described above. (GDPR Basis: Legitimate Interest)
• Communications: By creating an account, you are automatically subscribed to receive marketing emails (promotions and special offers), product update emails (new features and improvements), and push notifications on your mobile devices. You may opt out of any or all of these at any time by adjusting your Communication Preferences in your account settings, or by clicking the unsubscribe link included in every email we send. Push notification permissions can also be managed through your device settings. We honor all opt-out requests promptly in compliance with CAN-SPAM (United States), CASL (Canada), and GDPR (European Union). (GDPR Basis: Legitimate Interest / Consent)
• Personalized Affiliate Product Recommendations (Future Feature, Off by Default): When this future feature launches, we may use your Financial Profile data, calculator usage, goal types, and country / region to suggest third-party financial products (mortgages, loans, insurance, investments) for which we may earn a referral commission. This processing requires your explicit consent and is described in §2.8. (GDPR Basis: Consent)

4. Data Sharing and Disclosure ("Sale" and "Sharing")

We do not sell your personal financial data for monetary consideration. However, under California law (CCPA/CPRA) the term "sharing" includes cross-context behavioral advertising. When you use our free tier and have granted advertising consent (via our web cookie banner, or via Apple App Tracking Transparency on iOS and Google's User Messaging Platform on Android), we allow Google AdSense, Ezoic (web), and Google AdMob (mobile) to receive your cookie or advertising identifier together with your IP address to show relevant ads. California residents may opt out of this sharing at any time using the "Do Not Sell or Share My Personal Information" link in our footer. Your raw financial data (income, debt amounts, and specific calculation inputs) is never shared with advertisers. We share data with the following categories of service providers to operate our Services:

5. Data Security and Retention

5.1 Security Measures

• Encryption: We employ industry-standard TLS encryption to protect data in transit and encrypt sensitive data at rest.
• Multi-Factor Authentication (MFA): We offer optional MFA using authenticator apps. When enabled, we store your MFA secret and backup codes securely.
• Password Security: Passwords are hashed using industry-standard algorithms. We never store plaintext passwords.
• Session Management: Sessions expire after periods of inactivity and can be revoked at any time.

You are responsible for maintaining the confidentiality of your login credentials and MFA recovery codes.

5.2 Data Retention

• Anonymous Users: Calculator inputs are processed locally or deleted immediately after the calculation is returned.
• Registered Users: We retain your data while your account is active:
  • Financial Profile data (income, debt, housing, assumptions) is retained until you delete it or your account.
  • Saved calculation results are retained until you delete them or your account.
  • Payment history is retained for 7 years for tax and audit purposes.
  • Usage tracking data is retained for the current billing period. Session recordings are retained for up to 3 months and then automatically deleted. Product analytics data (page views, feature interactions, and any in-app survey answers) is held by our analytics processor, PostHog, for up to 7 years under its plan retention. We delete your analytics profile, its events, and its recordings when you delete your account, and you can request deletion at any time (see Section 6).
  • Operational logs are purged on a schedule by an automated retention job: security audit logs are deleted after 90 days, email delivery logs after 180 days, and calculator visit logs after 180 days.
• Inactive Accounts: To comply with GLBA regulations, we send a warning email after 18 months of inactivity and securely dispose of customer information after two years of inactivity.
• Account Deletion: You may request deletion of your account and all associated data at any time through your Account Settings or by contacting us. Account deletion also removes your data from our third-party analytics processors (PostHog).

6. Your Rights (Jurisdiction-Specific)

6.1 United States: California Residents (CCPA/CPRA)

• Right to Know & Delete: You may request to know what data we have collected and request its deletion.
• Right to Opt-Out of "Sharing": Because we use advertising partners to show personalized ads (including interest-based signals derived from calculator usage), this counts as "Sharing" for cross-context behavioral advertising. You have the right to opt-out of this sharing.

  How to exercise: Click the "Do Not Sell or Share My Personal Information" link on our website footer, or adjust your ad preferences in your account settings.

• Right to Limit Use of Sensitive Personal Information: You may limit our use of your account login credentials (SPI) to only what is necessary to perform our services.
• Right to Opt Out of Affiliate-Recommendation Profiling: You may decline our future affiliate-recommendation feature entirely from Settings → Privacy → Affiliate recommendations. No data is sent to affiliate partners unless you opt in. See §2.8.

6.2 United States: Federal (GLBA)

As a registered user, you are our "Customer." We provide this notice to explain our data practices. We do not share your Non-public Personal Information (NPI) with non-affiliated third parties for their own marketing purposes, except as described regarding ad networks above.

6.3 European Economic Area (EEA) & UK (GDPR)

• Consent: We request your explicit consent before loading advertising cookies (Google AdSense). You may withdraw this consent at any time.
• Rights: You have the right to Access, Rectification, Erasure, and Portability of your data.

6.4 Canada

• Access & Correction: You have the right to request access to your personal information and request corrections if it is inaccurate.
• Withdrawal of Consent: You may withdraw your consent to the collection and use of your information, subject to legal or contractual restrictions and reasonable notice.

6.5 Right of Access — Data Export Completeness (added May 2026)

When you request a copy of your personal information through Settings → Privacy → Download my data (web) or our /api/user/export-data endpoint, the resulting JSON file contains:

• Your account profile (name, email, account creation date, last login, MFA enabled flag).
• Your subscription record (plan, status, payment provider, billing period, cancel-at-period-end flag, pricing).
• Your saved calculator scenarios and the calculator type each one belongs to.
• Your payment history (provider, amount in account currency, status, description, date).
• Your usage statistics (feature key, count, month/year period).
• Your Financial Profile (cash flow, debt stack, housing, assumptions, registered accounts, student loans, self-employment, savings, and US retirement balances) and your saved goal-led plan from the activation wizard.
• Your consent history (every privacy-policy, terms-of-service, marketing, and retention-flag accept-or-withdraw event with the version, the locale, the source surface, and the hash of the exact copy shown on screen).
• Your retention preferences (Engagement Nudges, Plan Impact Alerts, Weekly AI Insight, Widget Amounts, Life-Event Timeline, AI advisor prefill) and the most recent retention-consent version you acknowledged.
• Your communication preferences (marketing emails, product updates, push notifications, chat history, chat sync), your Do-Not-Sell-or-Share state, your country / language / timezone preference, and your registration source.
• A summary of any in-app-purchase entitlements that have been linked to your account (the platform, product id, claimed-at timestamp, and the masked original transaction id) so you can see which receipts our system associates with you.

Categories we deliberately do not include in the export: third-party data we do not control (for example, raw advertising-identifier history held by Google AdMob, AdSense, or Ezoic), encrypted chat blobs where we do not hold the decryption key (cloud-synced AI conversations use end-to-end encryption — your passphrase never leaves your device), and internal security or fraud-prevention signals where disclosure would undermine the protection itself. To request a copy of these third-party categories you can contact the respective provider directly using the links in §4.

7. Advertising Partner Disclosures

On prosperics.com we work with Google AdSense and Ezoic to serve ads. On our mobile apps we use Google AdMob. These partners and their upstream vendors may use cookies, mobile advertising identifiers, and similar technologies to serve ads based on your prior visits to this website or other websites and apps. Ezoic is an IAB TCF and Google-certified consent management and ad mediation partner; a full list of Ezoic's sub-vendors is available inside its consent dialog. You can opt out of personalized advertising from Google by visiting Google's Ads Settings, from Ezoic via the "Your Privacy Choices" link in the footer, and on mobile by adjusting App Tracking Transparency (iOS) or Google's Ads privacy settings (Android).

Rewarded Ads (Mobile, added June 2026): In the mobile apps, free-tier users may occasionally be offered an optional rewarded ad at the moment a usage cap is reached (for example, stock lookups or PDF exports). Watching the ad to completion grants a temporary extra use of that feature. Rewarded ads are entirely optional, served by Google AdMob under the same consent settings as other ads, and capped per month. Declining the ad never removes functionality you already have, and Pro subscribers never see rewarded ads. We record only the grant itself (feature key, count, month) to honor the unlock.

App Campaign Measurement (Mobile, added July 2026): Separately from the ads we display, we measure how the ads we buy on Google and Meta to promote Prosperics actually perform. Our iOS and Android apps include Google Analytics for Firebase and the Meta App Events SDK for this purpose only. Both stay dormant until you grant analytics consent, and on iOS they receive no advertising identifier unless you allow tracking at the App Tracking Transparency prompt. You can withdraw consent at any time in Settings → Privacy → Usage Analytics, revoke tracking in iOS Settings → Privacy & Security → Tracking, reset or delete your advertising ID in Android Settings → Privacy → Ads, or use the "Do Not Sell or Share My Personal Information" link in our website footer.

Regional note: in the European Economic Area, the United Kingdom, and Switzerland, Google's on-device conversion measurement operates in its email-based form only — the event-data variant is not active in those regions — and all ad-measurement collection remains gated behind your explicit consent.

Children's Privacy (COPPA)

Prosperics is intended for adults aged 18 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13, and our Services are not designed to solicit such information. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at contact@prosperics.com and we will promptly delete that information and any associated account.

For users aged 13 to 17, we permit account creation only with the involvement of a parent or legal guardian, as set out in our Terms of Service. We do not knowingly use personal information of minors for targeted advertising or cross-context behavioral advertising ("sharing" under CPRA). If we learn that we have collected personal information from a minor in a manner inconsistent with applicable law, we will take appropriate steps to delete that information.

8. Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring or successor entity. The successor will be bound by the terms of this Privacy Policy with respect to your data.

We will notify you via email or prominent notice on our Services at least 30 days before any material change to how your personal information is handled as a result of such a transaction.

This provision is made in accordance with CCPA business transaction exceptions (Cal. Civ. Code § 1798.140(ad)(2)(A)), PIPEDA Principle 4.3.6 (business transactions), and GDPR Article 6(1)(f) (legitimate interest).

9. Contact Us

For privacy-related inquiries, or to exercise your rights to access, delete, or opt-out, please contact us at: