Privacy Policy

FIRE Progress (“the service”) is operated by an individual developer (“we”, “us”). This policy explains what the service stores, why, and what you can do about it. It is written to be read, not to be survived.

The short version

• The service never connects to your bank or brokerage. You type your balances in yourself.
• There are no analytics scripts, no advertising, and no third-party trackers of any kind.
• We do not sell, rent, or share your data. There is no one to share it with.
• You can export everything as JSON, or delete your account and all of its data, at any time, from the settings page.

What we store

If you have an account:

• Your email address and a password hash. Passwords are hashed with Argon2 and are never stored or logged in readable form.
• The financial records you enter: accounts, holdings, certificates of deposit, balances, transactions, categories and recurring rules. This is your data — we treat it as yours and never repurpose it.
• Your settings: base currency, withdrawal rate, expected return, inflation rate, birth year, life expectancy and interface language.
• Session records: for each device you are signed in on, we store the sign-in time, the last-seen time, the IP address and the browser user-agent string. This exists so that youcan see your active sessions in settings and sign out a device you don’t recognise.
• Rate-limiting counters keyed by email address or IP address, used to slow down password-guessing. These expire automatically.

If you joined the waitlist without an account, we store only your email address, the date you submitted it, and the date we sent you an invite. Nothing else — no IP address, no referrer.

Cookies

Two cookies, both strictly necessary, neither used for tracking:

• A session cookie, set when you sign in. It contains a sealed session identifier and nothing else. It is HTTP-only and expires after 7 days.
• A language cookie, remembering whether you want English or Chinese.

There are no advertising, analytics, or cross-site cookies.

Who else touches the data

Running the service requires three infrastructure providers. Each processes data only to deliver its part of the service:

• Vercel — hosting and request logs.
• Neon — the PostgreSQL database where your records live.
• Resend — sending transactional email (address verification, password resets).

Market prices and exchange rates are fetched by our server from public third-party sources. Those requests contain ticker symbols and currency codes only — never your holdings, your balances, or anything identifying you.

Email we send you

Only transactional email: address verification and password resets. No newsletters, no product marketing. If you joined the waitlist, you get two: a confirmation when you sign up, and your invite when we send it. After that, nothing until you have an account.

How long we keep it

• Account data: until you delete your account.
• Sessions: 7 days, then purged automatically.
• Password-reset records: 30 days after use, kept as an audit trail of when a reset happened.
• Accounts that never verify their email address: deleted after 7 days, together with the address.

Deleting your account is immediate and irreversible. It removes every row belonging to you. There is no soft-delete and no recovery — export first if you want a copy.

Your choices

• Export: settings → export gives you a complete JSON file of your data.
• Correct: every stored value is editable in the app.
• Delete: settings → delete account, or email us.
• Waitlist removal: email us and your address is deleted.

Security

All traffic is HTTPS-only and HSTS-enforced. The application sends a strict Content Security Policy with a per-request nonce, sets anti-clickjacking and no-referrer headers, and rate-limits sign-in and password-reset attempts. Application pages are excluded from search engine indexing. No system is perfect; if you find a problem, please tell us at hello@fireprogress.com.

Children

The service is not directed at children and should not be used by anyone under 16.

Changes

If this policy changes, the date at the top changes with it. If a change materially affects how your data is handled, we will email account holders before it takes effect.

Contact

Questions, requests, or complaints: hello@fireprogress.com.