Privacy Policy

Trying the application without an account

You can explore the entire application in demo mode without registering. Demo mode loads a fictional sample persona and stores everything in your own browser's localStorage. That data never leaves your device and is never sent to the server. Turning demo mode off, or signing in, clears it. The standalone calculators on the Tools page and the education pages likewise work without an account and send nothing to the server.

What is collected when you have an account

• Account details — your email address and password (stored only as a salted hash, never in readable form), any passkeys you add (described below), plus optional profile settings such as an alias, an avatar you build from the application's own parts, birth month and year, country and region, the public pension programs you are eligible for, retirement age goal, risk profile, preferred currency, and notification preferences.
• Financial data you enter — income, expenses, liquid assets, investments, property such as a home or vehicle and the debts against it, debts, savings goals, the spending budgets you set and the spending you log against them, the public pension entries you record for your household (each person's program, birth month and year, planned start age and statement amount), the payments you mark as paid or skip, the website address you may save for paying a bill or debt, the spending decisions you log, and the quarterly snapshots generated from them. This exists solely to produce the budgets, reports, and projections you asked for.
• Life events you mark — if you use the life-event map that is part of Plus: the events you mark as having happened, such as a marriage, a new job, an illness or a death in the family; the ones you put on your roadmap; and the ones your own financial data shows, such as a debt paid off. Which events they are is encrypted at rest. They are used only to draw your own map and are never shown to anyone you share your finances with. They are deleted with your account and included when you download your data.
• Plus records — if you have Plus, the dates it covers, its tier, and why you have it: Plus given to you, such as a thank-you for testing, or a payment, recorded with the amount paid and that payment's reference. The amount and the reference are encrypted at rest, and this application holds no card or bank details. Plus records are deleted with your account and included when you download your data. Plus payments are taken by Paddle.com, which sells Plus as the merchant of record and collects the name, email address, billing address and payment details it needs under its own privacy notice. This application gives Paddle an identifier for your account, so a payment can be matched to it, and receives back the amount, the dates and the payment's reference.
• Feedback you submit — the name or alias, subject, comments, optional email address, and the IP address the submission came from (kept to deter abuse of the form). All of it is encrypted at rest, and it is deleted after 12 months — see Retention and deletion below.
• Server logs — ordinary application logs for diagnosing errors and keeping the application running.
• Anonymous diagnostics — script errors and page-load performance from your browser, described in its own section below.

On How You Compare, the group you choose to compare with — a household size, an income range, owning or renting — is picked out in your browser. Which group you chose is never sent to the server or saved to your account; if you ask the application to remember it, it is kept in that browser's localStorage and nowhere else.

There is no advertising in this application and no third-party analytics or tracking. Nothing here is shared with an ad network, a data broker or an analytics company, and no cross-site tracking or profiling scripts of any kind load.

Diagnostics and performance data

So that broken pages and slow loads can be found and fixed, the application collects a small amount of anonymous, first-party diagnostic data in your browser and sends it to its own server — the same origin everything else talks to. None of it goes to a third party.

• Script errors — when something fails in the browser, the error message, a stack trace and your browser's user-agent string. Anything that looks like an email address or a long number is removed before it is sent, and again on the server; page addresses are reduced to the page name, with any query string dropped.
• A short trail of what led to an error — attached to a script error only, this is a list of the last few page names you moved between, the kind of element you clicked (its tag, such as "button", and its identifier in the page's code), and any request that failed, by address and status code. It records no text from the screen, no amounts and nothing you typed. There is no screen recording or session replay in this application, and none is planned.
• Page-load performance — standard web-performance measurements (how quickly the main content appears, how much the layout shifts, how responsive the page is) and a count of which pages are visited, by page name only.

No identifiers are attached, the request carries no cookies, and none of it can be tied back to you or your account. If your browser sends a Do Not Track or Global Privacy Control signal, the performance and page-visit measurements are switched off, along with the navigation and click part of the trail described above; genuine script errors are still reported, with failed requests still listed, because they carry no information about you and are what keeps the application working.

Script errors and their trails live in the application's operational monitoring for about 90 days and are then deleted. The performance measurements are kept longer — up to about 13 months — but only as counts: how many page loads fell into each speed range, per page name and day. Nothing in that record is about a person, and no individual measurement is kept.

Signing in with Microsoft

Signing in with a Microsoft account is optional. If you do, Manage Your Means just receives your email address and links it to your Manage Your Means account.

How your data is protected

• Sensitive fields — account names, balances, amounts, and similar values — are encrypted at rest in the database. The encryption keys are held in Azure Key Vault, separately from the data itself.
• All traffic to and from the application is encrypted in transit over HTTPS.
• Your password is stored only as a salted, slow one-way hash — it is never kept in a form anyone can read back.
• Passkeys, if you add any, are stored as a public key, the name you give it, the date you added it, and the technical details your device reports about it (such as whether it syncs across your devices). Your fingerprint, face or PIN never leaves your device — the application never receives it, and a public key cannot be used to sign in on its own. Removing a passkey in Preferences deletes it, and closing your account deletes them all.
• Passwords are checked against a public list of credentials exposed in data breaches, so a password already known to attackers cannot be chosen here. Your password is never sent anywhere. It is hashed on the server and only the first five characters of that hash are sent to the checking service (Have I Been Pwned), which replies with every match for those five characters; the comparison happens here. The service cannot tell what your password is, and is not told who was asking. If it cannot be reached, your password is simply not checked — it never blocks you from signing up or changing a password.
• Signing in sets a single, essential authentication cookie so the application knows who you are between requests. It is not used for tracking, and there are no advertising cookies. The anonymous diagnostics described above are sent without it.
• The application is hosted on Microsoft Azure. Microsoft processes data on the operator's behalf as the hosting provider.

What is never done with your data

• It is never sold, rented, or traded.
• It is never shared with advertisers or data brokers.
• It is not used to build a profile of you or to train any model.

Data may be disclosed only where the law genuinely requires it, or where it is strictly necessary to investigate abuse of the service.

Retention and deletion

Your data is kept for as long as your account exists. You can edit or delete any individual record from within the application at any time. A deleted record is hidden immediately and permanently removed from the database 30 days later — that window exists so an accidental deletion can still be recovered on request.

You can close your account yourself, at any time, from Preferences → Security settings → Delete account. Doing so erases your entire financial model — income, expenses, spending budgets, debts, investments, liquid assets, property, savings goals, public pension entries, payment history, snapshots, spending-log entries, spending decisions and the life events you marked — along with any household sharing you had set up in either direction, any feedback you submitted from that email address, and the sign-in itself. That deletion is immediate and permanent: it does not wait for the 30-day window above, and there is no backup copy to restore from. Download a copy first if you want to keep it (see below).

Feedback submitted through the application is kept for 12 months and then deleted, whether or not anyone replied to it. If it is removed sooner from the admin view, it is erased from the database 30 days after that, the same window as any other deleted record. Feedback has no account attached to it — the form works without signing in — so this window is what bounds it. Closing your account also erases, immediately, any feedback you submitted from that account's email address.

Security and audit log entries are the one exception. They record actions — who signed in, who was granted access to whose data, when an account was closed — using account identifiers only, never amounts, names or descriptions, and they are retained separately from your financial data because one side of that record can belong to somebody else.

You can download a copy of everything your account holds, at any time, from Preferences → Security settings → Download your data. It contains your whole financial model, your settings, the life events you have marked, the household sharing you have given and the changes household members made to your data, and any feedback you submitted from your account's email address — as a spreadsheet, and as a complete machine-readable file with a guide to reading it. It leaves out your password, two-factor secrets and passkeys, anything you have already deleted, and anything that belongs to someone else, including a household that shares its data with you. The file is not encrypted: once downloaded it is plain text on your device, and keeping it safe is up to you.

If anything above doesn't work for you, or you would like a copy of something the download doesn't include, email support@manageyourmeans.com from your registered address.

Children

This application is not intended for use by children under 13, and accounts are not knowingly created for them.

Changes to this policy

If this policy changes materially, the date above will be updated. Continuing to use the application after a change means you accept the revised policy.

Contact

Questions about privacy, or a request to delete your data: support@manageyourmeans.com.