The private retirement planner

Why most retirement calculators want an account

Not usually for your benefit. An account lets a planner store your figures on its servers, which is what makes a subscription enforceable, a mailing list possible and a company valuation larger. It also means your income, savings, ages and health assumptions sit on someone else’s computer — subject to their security, their policy changes, their acquisition, and their pricing.

That trade is worth making for some products. For a calculator that does arithmetic on numbers you already know, it is worth asking what you are getting in return.

What “private” means here, precisely

The AI Retirement Income Planner is one self-contained HTML file. You download it, open it, and everything happens inside your own browser:

• No account and no sign-up. There is no login, so there is no profile, no password to leak and nothing to cancel.
• No uploads. Your figures live in your own browser’s storage. There is no server that receives them, because there is no server.
• No bank connections. The planner never links to a financial account.
• No analytics inside the product. No telemetry, no crash reporting, no usage tracking of any kind.
• It works offline. Opening the file makes no network request at all — there are no external scripts, fonts or stylesheets in it.

You can verify this in about ten seconds

This is the part that separates a privacy claim from a privacy policy. Open the planner, press F12 to bring up your browser’s developer tools, and watch the Network tab while you build an entire plan. You will see exactly one request: a look-up of published currency conversion rates, which carries nothing about you. Not one figure from your plan leaves.

If that sounds fiddly, there is a blunter version: disconnect from the internet and keep working. Every number still runs. A planner that needs an account cannot pass either test, no matter how reassuring its privacy page reads.

Every request the planner is capable of making is listed here — there are only a handful, and none of them carry your plan.

The one exception, in our own words

The planner has an optional AI co-pilot. If you switch it on and choose a cloud provider — Anthropic, OpenAI, Google or OpenRouter — a summary of your plan is sent to that provider so it can answer, using an API key you supply and pay for. It never passes through us and we never see it, but it does leave your computer.

Three things follow: the co-pilot is off until you turn it on, the planner is fully functional without it, and if you want AI and complete privacy you can point it at a local model running on your own machine, which keeps everything offline.

What that summary contains — and what it cannot

It sends the plan, not the planner. There is no field anywhere in the file for your name, email address, postal address, phone number, employer, or any account, policy or Social Security number — it never asks for them, so there is nothing of that kind for it to send. There is no login either, so no user id or profile is attached to the request.

What does go is the arithmetic:

• The figures you entered — ages, filing status, account balances, withdrawals, pensions and Social Security amounts, and the tax settings for the country and US state you asked it to model. Your birth year too, if you gave one, because it sets your Full Retirement Age.
• The results the engine produced from them — income, tax, healthcare cost and ending balance for each phase, and which plan health checks currently pass.
• Your question, as you typed it.

What never goes:

• No name, email or address. There is no box to type one into.
• No account or institution details. A balance is just a number — the planner never knows where the money is held, and it connects to no bank or brokerage.
• No Social Security or tax ID numbers. The planner models the benefit; it never asks for the number.
• Not your plan notes. The free-text notes you can attach to a plan are for your own report. The co-pilot never sees them.
• No tracking of any kind. No analytics id, no device fingerprint, and no record on our side that a question was asked at all.

Two caveats, because a privacy page that only reassures is not much use. First, the only free text that leaves is text you wrote yourself: your question, the label you gave a lump sum (“house sale”, say), and any reason you typed when dismissing a suggestion. Name things however you like — just know those labels travel with the question. Second, the request goes from your browser straight to the provider under your own API key, so they see it as ordinary API traffic on your own account, your IP address included, exactly as any website you visit does. What they then do with it is governed by their terms rather than ours — which is why the planner names the provider before you use it, and lets you point it at a local model instead.

Who this tends to matter to

People who are self-employed or hold company equity, and would rather their compensation not sit in a marketing database. People planning a move abroad, whose residency and tax position is nobody else’s business. People who have simply been breached before. And people who object on principle to renting access to their own arithmetic.

If none of that is you, the planner is worth having on the modelling alone — the privacy is just how it happens to be built.

What you actually get

A month-by-month retirement income engine covering five phases, US, UK, Canadian and Australian tax treatment, Social Security timing, ACA and Medicare thresholds, Roth conversions, Monte Carlo and historical backtesting. Bought once, owned outright, with no subscription and no renewal.

See the products Try the live demo

Educational only — not financial, tax or legal advice. Every projection is an estimate based on the assumptions you enter.