A complete, verifiable audit of what RetIQ does — and does not do — with your data, on every platform
Every financial calculation — tax brackets, Social Security estimates, Roth conversion optimization, Monte Carlo simulation — runs locally on your device. On the web it runs in your browser; on iOS and macOS it runs inside the app's sandboxed environment. Nothing is sent to a server for processing. Your numbers never leave your device.
All plan data is saved to local storage on your device — localStorage in your browser on the web, or the app's private sandboxed storage on iOS and macOS. RetIQ cannot read, retrieve, or access this data remotely. Neither can anyone else.
RetIQ has no user accounts, no login, no analytics, no tracking pixels, no cookies, no fingerprinting. On the web, the only personal information collected is the email address you provide at Stripe checkout, used solely for license key delivery. On iOS and macOS, purchases are handled entirely by Apple — we receive no personal information at all. There is no mechanism to correlate your usage across sessions.
On the web, RetIQ installs as a Progressive Web App and works without any internet connection after the first load. On iOS and macOS, the app is fully self-contained from installation. This is structural proof that your financial data doesn't need to go anywhere — because it doesn't.
A strict Content-Security-Policy header tells your browser exactly which domains RetIQ is allowed to contact. Even if the code were somehow modified, your browser would block any unauthorized connections. This is a browser-enforced guarantee, not a promise.
RetIQ is built as a single HTML file with all calculations running in your browser. You can inspect the running code at any time using your browser's View Page Source (Ctrl+U or Cmd+Opt+U) and DevTools. Every calculation is validated against authoritative sources — open the Validation tab to see 361 automated tests with IRS/SSA/CMS citations. Transparency isn't a feature — it's the foundation.
The table below is an exhaustive list of every external domain RetIQ contacts, when it contacts them, and exactly what data is transmitted. There are no hidden endpoints, no background beacons, no telemetry.
| Domain | When | Purpose | Data Sent | Financial Data? |
|---|---|---|---|---|
| *.workers.dev Cloudflare Worker | Purchase & license only | Three endpoints handle licensing: • /create-checkout-session — redirects to Stripe for payment• /start-trial — issues a trial token• /validate-license — confirms a license key is valid | License key only. No financial plan data, no account balances, no personal information is transmitted. The checkout session sends only a trial token (if applicable). | No |
| checkout.stripe.com | Web purchase only | Stripe's payment page processes web purchases. You are redirected to Stripe's domain — RetIQ never sees your credit card number. | Stripe collects payment information under Stripe's Privacy Policy. RetIQ receives only a license key in return. | No |
| Apple StoreKit iOS & macOS only | App purchase only | In-app purchases on iOS and macOS are verified on-device through Apple's StoreKit 2 framework. Purchase validation happens locally — no server round-trip to RetIQ. | Nothing sent to RetIQ. Apple handles all payment processing. RetIQ receives only a purchase confirmation from StoreKit on-device. | No |
RetIQ includes a strict Content Security Policy (CSP) in its HTML. This is not just a claim — it's a set of rules your browser actively enforces. Even if RetIQ's code were somehow modified, your browser would block any connection that violates these rules:
| CSP Directive | Policy | What It Means |
|---|---|---|
| default-src | 'self' | By default, only load resources from retirementiq.app itself |
| script-src | 'self' 'unsafe-inline' | Only run scripts embedded in the page — no external JS files can be loaded from any domain |
| style-src | 'self' 'unsafe-inline' | Styles from the page itself only — no external CSS from any domain |
| font-src | 'self' | Font files from retirementiq.app only — self-hosted, no CDN |
| connect-src | 'self' | API calls restricted to the licensing worker — no other server can be contacted via fetch/XHR |
| img-src | 'self' data: blob: | Images from the site itself and inline data (icons) |
| object-src | 'none' | No plugins (Flash, Java, etc.) can run — ever |
| frame-src | 'none' | No iframes — no third-party content can be embedded in the page |
| form-action | 'none' | No form submissions — data cannot be POST-ed to any server via HTML forms |
Ctrl+U or Cmd+Opt+U) and look for the <meta http-equiv="Content-Security-Policy"> tag near the top. Your browser reads this tag and blocks any request that violates it — you can see violations in the DevTools Console.
RetIQ saves your settings and plan data locally on your device. On the web, this uses your browser's localStorage, sandboxed so that only retirementiq.app can read it. On iOS and macOS, the app uses its own private sandboxed storage, inaccessible to other apps. In all cases, data never leaves your device. Below is every key RetIQ writes (web key names shown — the iOS and macOS apps store equivalent data):
| Key | Contains | When Written |
|---|---|---|
| retiq_v1 | Your retirement plan inputs: ages, income, expenses, account balances, Social Security settings, Roth strategy, etc. This is the core of your financial plan. | Every time you change an input (Pro users only) |
| retiq_theme | Your color theme preference: "dawn" (default), "dark", or "light" | When you toggle the theme |
| retiq_pro | "true" or absent — whether Pro is activated on this device | When you activate a license |
| retiq_license | Your license key string | When you activate a license |
| retiq_trial_token | A trial session token (no personal info) | When you start a trial |
| retiq_trial_start | Timestamp of when your trial began | When you start a trial |
You don't have to trust these claims — you can confirm them in under two minutes using tools built into your browser. These same techniques are used by security professionals to audit web applications.
F12 (or Cmd+Opt+I on Mac), then click the Network tab. In Firefox, press F12 and select Network. In Safari, enable the Develop menu in Preferences, then press Cmd+Opt+I.retirementiq.app — the app itself, its fonts, and its icons. No external domains are contacted. Zero.retirementiq.app. You'll see exactly the keys listed above and nothing else.Ctrl+U) and find the Content-Security-Policy meta tag in the <head>. This tells your browser exactly which domains are allowed. In DevTools → Console, any CSP violation would appear as a red error — the browser will block any attempt to send data to an unauthorized domain.Most retirement planning tools store your financial data on their servers, require accounts, and use tracking. Here's how RetIQ's architecture differs:
| Privacy Feature | RetIQ | Typical Cloud-Based Planning Tools |
|---|---|---|
| Where calculations run | Your browser | Their servers |
| Where data is stored | Your device only | Their cloud database |
| Account / login required | No | Yes |
| Email required | At purchase only (license recovery) | Yes (account required) |
| Analytics & tracking | None | Google Analytics, Mixpanel, etc. |
| Works offline | Yes (PWA) | No — requires server |
| Source code visible | Yes — View Page Source in browser | No — server-side code |
| Content Security Policy | Yes — browser-enforced | Rare |
| Data survives if company shuts down | Yes — your files, your device | No — data locked in their servers |
| Vendor can be breached | No financial data to breach | Yes — single point of failure |
Content-Security-Policy meta tag that tells your browser exactly which domains the app is allowed to contact. This is a browser-enforced guarantee — not just a promise from the developer. The policy restricts scripts to inline-only (no external JS), styles and fonts to 'self' only (self-hosted), API calls to the licensing worker only, and blocks all iframes, plugins, and form submissions. You can inspect it by viewing the page source — it's in the <head>.
a Cloudflare Worker endpoint for three licensing-related API calls (none of which transmit financial data), plus checkout.stripe.com via redirect during purchase. Fonts are self-hosted. No WebSocket connections, no Server-Sent Events, no background sync, no push notifications.
connect-src restricts API calls to 'self' and the Cloudflare licensing worker onlyfont-src 'self' restricts fonts to the app's own origin (self-hosted WOFF2 files)style-src 'self' 'unsafe-inline' — no external CSS can be loadedobject-src 'none' blocks all plugins (Flash, Java, etc.)frame-src 'none' blocks all iframesform-action 'none' blocks all form submissionslocalStorage keys are used (see table above). No cookies are set. No IndexedDB databases are created. No sessionStorage is used. The Service Worker cache stores only static application assets (HTML, icon images, manifest, and self-hosted font files).
window.open() and document.write(). The exported file is rendered locally and can be saved via the browser's Save dialog. No data is uploaded during export.
Content-Security-Policy via a <meta> tag in the HTML head. This is a browser-enforced restriction — not just a promise — that prevents the app from contacting unauthorized domains, loading external scripts, or exfiltrating data. The policy restricts font-src and style-src to 'self', blocks all form submissions and object embeds, and limits connect-src to the app's own origin and the licensing endpoint. You can verify this by inspecting the page source or checking the Application → Security panel in DevTools.