Privacy policy
Last updated: October 2026.
Suffisa calculates your retirement plan on your device. If you choose an email link to open the full result, we temporarily store an encrypted draft so you can return to it on another device. This policy explains what we collect in plain terms.
What we collect
We use privacy-friendly external analytics to count page views and unique visitors, without advertising profiles and without your simulation inputs. We also count the unique browsers that finish an analysis: a random browser identifier is converted to a server-salted one-way digest. If you answer the optional questions after an analysis, we store your Yes/No choice and written response with that digest. We do not store the identifier itself, your IP address, user agent, or any simulation input for this measurement. If you create an account: your email address, language preference, your province when you confirm residence before paid checkout (for subscription availability and sales tax), and PayPal payment confirmations if you subscribe (never your card number). If you save a plan: the plan's inputs, encrypted at rest. For our own advertising tests, we record the registered ad and campaign codes, first visit time, and whether the profile steps and calculation were completed, the results offer was viewed or chosen, and later sign-in and trial steps were reached. We do not record the answers or financial results in these events. After verified sign-in, we can associate this acquisition record with your account and confirmed payments to measure which ads produce customers. A digest of a single-use sign-in token carries that association when you open the email link on another device.
Calculations on your device
The free simulator runs in your browser. Its financial inputs stay on your device unless you choose a secure result link or explicitly save a plan. A random browser identifier in local storage is sent to our measurement endpoint and immediately converted to a server-salted digest. A first-party signed cookie lasts up to 30 days to connect ad visits with sign-in and checkout. Pending measurement events may be retried for up to seven days. Clearing browser storage resets browser identity.
Secure result links
When you choose to email yourself a link to the full result, we store your plan inputs as an encrypted draft. The link expires after 24 hours. We bind the draft to the email address you enter, and only a sign-in session verified through that email can reopen it. The email and its link contain no financial inputs or results. Expired drafts are deleted by daily maintenance or the next draft creation. Deleting your account also removes drafts bound to your email. Promotional email remains optional and requires separate consent.
PDF reports
The PDF is created in your browser from the displayed results. The server checks Plus access and records an account-linked PDF feature-use event. This request contains neither the plan’s financial inputs nor its results. Downloading a PDF does not save the plan to your account.
How saved plans are stored
Saved plans are encrypted (AES-256) before they are written to our database, which is itself encrypted at rest. Share links you create expose a read-only view of a plan's numbers to anyone holding the link, until you revoke it. Viewing the link recalculates the saved plan on the server.
Payments
Suffisa Plus is billed through PayPal. PayPal processes your payment details under its own privacy policy; we receive and keep only the confirmation (subscription status, amount, date) needed for your receipts.
Optional email reminders
Creating an account does not subscribe you to promotional email. If you explicitly opt in, we send up to three reminders about the Plus trial and saving plans, at least two weeks apart. We keep your consent time, language, consent wording version and source, unsubscribe preference, and reminder delivery history with your account. Resend processes the reminder email to deliver it. Reminders stop when you unsubscribe, activate Plus (including its trial), or save a plan. Every reminder contains an unsubscribe option that does not require signing in. Sign-in and billing emails are separate. Consent records and reminder history are included in your account export and deleted when you delete your account. Pending consent confirmation digests expire after 24 hours. We do not include financial profile data in reminders or track opens.
What we share
We do not sell or rent personal information. Our advertising measurement is first-party: we do not send your financial inputs, profile answers, or payment attribution to advertising platforms. We do not use third-party advertising pixels for this test. Service providers handle data only to operate Suffisa.
Retention and deletion
Your data stays until you delete it. "Delete account and all data" on the account page removes your profile, saved plans, and share links immediately; payment records required for tax purposes are kept only as long as law requires. The anonymous completed-analysis digest and any optional results feedback attached to it are retained for up to 24 months. Acquisition records are retained for up to 24 months; sign-in attribution tokens expire after 24 hours. Deleting your account removes its acquisition link. Browser-only aggregate measurement may remain without that account association.
Your rights (PIPEDA & Law 25)
You can access, export, correct, or delete your personal information at any time — export and deletion are self-serve on the account page. Quebec residents have the additional rights provided by Law 25, including data portability.
Contact
Privacy questions or requests: hello@suffisa.com. We answer within 30 days, as PIPEDA requires.
Measurement on this browser
You can turn off Suffisa’s first-party ad and profile measurement on this browser. This does not change the planner or delete records already stored. Global Privacy Control also disables this measurement. For account-linked records, use your account’s export and deletion controls.
Measurement is on for this browser.