California privacy notice.

We don’t sell or share your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as California law defines both. We have not done either in the past 12 months, and that includes information about anyone under 16. So there is nothing to opt out of, and no “Do Not Sell or Share” form to fill in.

We still honor the Global Privacy Control signal: if your browser sends it, we turn off our optional counting in that browser, as the cookie preferences page explains.

What we collected in the past 12 months

• Identifiers. Your email address, account id, and Google account id if you sign in with Google. Your IP address appears briefly in hosting logs.
• Financial and household details you enter. Names, ages, state and county, income, accounts, debts, spending and goals, for you and a partner if you add one.
• Characteristics you choose to enter. Age, whether you plan with a partner, and a health status used for life expectancy.
• Commercial information. Whether you are on Free or Pro, and your Stripe customer and subscription reference.
• Internet activity. Pages viewed and getting-started steps, the first page you visited and the site that sent you, page speed, and error reports with every number removed.
• General location. The state and county in your plan, and the country a visit comes from in our page-view counts. Never a precise location.

It comes from you, from your browser as you use the site, from Google if you sign in with it, and from Stripe when you pay. We use it to run Calcifir, take payment, keep the service secure, fix problems and decide what to build, as the Privacy Policy explains, and we keep it for the periods set out there.

Some of what you enter, such as your finances and health status, is sensitive personal information. We use it only to run your plan for you, never to infer things about you, so there is nothing to limit.

Who receives it

We disclose personal information only to the service providers that run Calcifir for us, under contracts that limit them to that job: Supabase (database, sign-in and sign-in emails), Vercel (hosting, page views and page speed), Stripe (payments) and Google (only if you sign in with it). We also disclose it when the law requires. We don’t give it to anyone for their own marketing.

Your rights

• To know. Ask what personal information we hold about you, where it came from, what we use it for and who receives it, and get a copy.
• To delete. Ask us to delete it, subject to a few exceptions in the law, such as records we must keep.
• To correct. Ask us to fix information that is wrong. Most of it you can edit yourself in your plan.
• Not to be treated differently. We won’t charge you more, offer you less or refuse you service for using any of these rights.

How to make a request

The quickest way: export every plan, or delete your account and its data, yourself in Settings › Account. For anything else, email hello@calcifir.com with “California privacy request” in the subject.

To protect you, we confirm the request came from you, usually by replying to the email address on your account. We answer within 45 days, as the law sets, and usually much sooner. If we need more time we will tell you why.

Someone you authorize can make a request for you. We will ask for your signed permission, and may ask you to confirm it with us directly.

Direct marketing

We don’t share personal information with other companies for their direct marketing, so California’s “Shine the Light” law gives us nothing to report.