Privacy Architecture

"Your numbers never leave your device" is a claim you should not have to take on faith. This page describes the actual architecture, so anyone technical can verify it — open your browser's network tab and watch while you use the planner.

Where computation happens

The entire engine is JavaScript delivered to your browser and executed there, on your own machine. There is no server-side calculation, no API that receives your inputs, and no backend database anywhere in the product. The site's static-file host (named in the Privacy Policy) serves the application files; it cannot see what you type, because what you type is never sent.

The browser itself enforces this: the site ships a security policy — visible in the response headers — that blocks scripts from sending data anywhere except this site's own origin and the analytics counter described below.

Where your data lives

• Your plan: your browser's localStorage, on your device, under this site's origin. Clearing site data erases it — which is why the app offers Download Backup.
• Backups: a JSON file saved to your device. Where you store or send it is entirely your choice.
• Transfer links: the "Transfer to Another Device" link encodes your plan in the link itself (the fragment after #, which browsers do not send to servers as part of the page request). Treat the link like the data: share it only with yourself.
• Nowhere else. There are no accounts, no logins, no cloud sync, and no server-side copies to breach, subpoena, or sell.

What the network actually carries

• Static assets — the app's code, styles, and images.
• Aggregate, cookieless analytics — a privacy-preserving counter (named in the Privacy Policy) counts page views without cookies, without cross-site tracking, and without access to anything you enter. It tells us "how many visitors"; it cannot tell us who you are or what your plan says.
• Nothing else. No plan fields, no keystrokes, no identifiers.

Strictly optional email

Two features involve an email address, both opt-in and both separate from your plan data: the update newsletter (your address is stored by Kit, our newsletter provider, never linked to anything in the planner) and writing to [email protected]. Details in the Privacy Policy.

Our commitment on change

Today, no optional feature transmits plan data — there is nothing that "phones home." If any future feature would change that (for example, an optional AI assistant that sends a question to a model), this page and the Privacy Policy will describe exactly what would be transmitted before the feature ships, and it will be opt-in with the default off. The architecture is the promise: features that require your data to leave your device have to announce themselves here first.