ModernRetire — Security & Cookie Settings
Effective Date: 05/01/2026 Last Updated: 08/02/2026 Operated by: ModernRetire LLC
You are being asked to type your retirement into a website run by one person. That deserves a real answer, so this page describes what ModernRetire actually holds, what it cannot hold, and what happens when you ask for your data back.
This document is part of a set of legal documents that govern your use of the Service. Please also review our Terms of Service, Privacy Policy, and Disclaimers.
You choose where your plan lives
When you open the app, you choose where your plan lives: Cloud backup or This device only. You can change this at any time in Settings.
This device only: Your plan stays in your browser's local storage and never reaches a ModernRetire server. Nothing syncs. I cannot see your numbers, and I could not hand them over if someone asked me to.
Cloud backup: Your plan syncs to the database so you can pick it up on another device. You can turn it back off.
Two things about local-only mode that a marketing page would leave out:
Local storage is not encrypted. Your plan sits in plaintext in your browser profile. Against a breach of ModernRetire, that is safer than the cloud, because there is nothing of yours in the cloud to breach. Against malware or someone with access to your computer, it is worse than encrypted cloud storage. Pick the mode that matches the threat you care about.
Local storage is easy to lose. Clearing your browsing data erases your plan. So does using a private window, switching browsers, or getting a new laptop. Your browser can also evict stored data on its own when disk space runs low. There is no server copy to restore from, so export a JSON backup and keep it somewhere you trust.
Cloud backup off means your plan data never leaves your device. It does not mean you are anonymous. Your account still exists, which requires an email address. See the next section.
What ModernRetire stores
Your account: email address, display name if you set one, and an internal user ID. Sign-in is handled by Clerk, so ModernRetire never receives or stores your password.
Your plan, if cloud backup is on: ages, income and spending, account balances as dollar amounts, debts, Social Security and pension expectations, health and long-term-care assumptions, real estate, annuities, tax planning inputs, sex and general demographic details used by the projection model, and whatever you name the plan.
That includes health-related information. It is there because long-term-care cost modeling needs it, it is treated as sensitive, and it is covered by the same deletion and export controls as everything else.
Product usage: page views and performance timing through Vercel Analytics, plus first-party events recording which parts of the planner you used. These records are about how the app is working, not about your finances. ModernRetire does not run advertising trackers.
What ModernRetire never asks for
No Social Security number. No bank or brokerage account numbers. No routing numbers. No credit card numbers. No logins or passwords to any financial institution.
There is no bank connection and no brokerage linkage. Every number in your plan is one you typed in. ModernRetire has no ability to access your accounts, so there is nothing here that could be used to move your money.
This describes ModernRetire as it works today. If account linking is ever added, it will be something you turn on deliberately, never a default, and this page will change before it ships.
Who else touches your data
| Provider | What they handle | What they hold |
|---|---|---|
| Clerk | Sign-in and sessions | Your email, name, and login history. Passwords never reach ModernRetire. |
| Stripe | Subscription payments | Billing details and payment history. Card numbers never reach ModernRetire. |
| Neon | The database | Your plan data, if cloud backup is on. |
| Vercel | Hosting and analytics | Request logs, page view and performance data. |
| Resend | Transactional email | Email address and message content for waitlist confirmations, invitations, and notifications. |
This list is current as of the date at the top. It will be updated before any provider is added.
How the data is protected
Neon encrypts stored data with AES-256, manages keys through AWS KMS or Azure Key Vault with rotation policies, and requires TLS 1.2 or higher for every connection. Neon holds SOC 2 Type 1 and Type 2, SOC 3, ISO 27001, and ISO 27701, and states compliance with GDPR and CCPA. Their SOC 3 report is public and available without an NDA through their trust center.
Those certifications cover Neon's infrastructure and controls. They are not certifications of ModernRetire. This section describes the foundation the application sits on, not an audit of the application itself.
Connections between your browser and ModernRetire use HTTPS.
Access control. Every request that reads or writes plan data is scoped to your authenticated account, using an identity verified by Clerk. Database-level row security enforces the same restriction independently of the application code, so a bug in one endpoint cannot expose another account's data.
Internal access. ModernRetire is run by one person. I have administrative access to the database, which is what running the service requires. I do not read plans out of curiosity, and I do not use plan data for anything other than making the product work for you.
Getting your data out
Export your entire plan as a JSON file at any time, from inside the app. The format is documented, the file is yours, and it imports back into ModernRetire. You are not locked in.
Export works whether or not you have an active subscription. See the continuity statement for what happens to your data if ModernRetire ever shuts down.
Deleting your account
You can delete your account yourself from inside the app. No email to support, no waiting.
What is removed: your plan and all scenarios, your account record, and your sign-in identity with Clerk. Your stored card details are removed from Stripe.
What remains, and why:
Your data is purged from the live database immediately. Encrypted database backups age out over time.
Stripe keeps a record of past payments. Invoices are financial records with retention requirements, and they carry the email address that was on them at the time. Stripe also retains a deleted customer record so payment history stays traceable. This is Stripe's system rather than mine, and I cannot erase it. You can contact Stripe's privacy team directly about their own retention.
If you used local-only mode, your plan was never on the server. Deleting your account removes your login. Clearing your browser data removes the plan.
What ModernRetire does not have
ModernRetire has no SOC 2 report, no ISO certification, and no third-party penetration test. Those cost money and staff time that a one-person product at this stage does not have. Saying so is more useful to you than dressing up the vendor certifications above as if they were mine.
There is no security team. There is one developer who takes this seriously and has written down what he does and does not know.
How ModernRetire makes money
Subscriptions. That is the entire business model. Your data is not sold, rented, or shared with advertisers, data brokers, or anyone else, and it never has been. There are no ads in the product.
Reporting a problem
Security questions and vulnerability reports: security@modernretire.com
If you have found something, tell me. I will respond, I will not threaten you, and I will credit you if you want the credit.
If you are evaluating ModernRetire and need something this page does not cover, ask. I would rather answer a hard question than lose you to an unanswered one.
Cookies & Browser Storage
Our Approach
ModernRetire uses minimal cookies and browser storage. We do not use advertising cookies, tracking pixels, or fingerprinting techniques. We do not participate in cross-site tracking networks.
What We Use
localStorage (Browser Storage)
Purpose: Storing your Plan Data (financial inputs, assumptions, settings) locally in your browser.
Key: rp-v1
Data stored: Your plan configuration as a JSON object, including personal details you've entered (ages, account balances, income, expenses, settings). This data never leaves your browser unless you are signed in and have cloud backup enabled.
Duration: Persists until you clear your browser data or use the in-app "Reset" function.
Required: Yes, for the core functionality of the tool. Without localStorage, the Service cannot save your plan between sessions.
Your control: You can clear this data at any time by clearing your browser's localStorage for modernretire.com, or by using the "Reset all data" function within the app.
Authentication Cookies
Purpose: If you create an account, Clerk (our authentication provider) sets session cookies to keep you signed in.
Cookies set by Clerk:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
__session | Session authentication token | Session / 7 days | Strictly necessary |
__client_uat | Client-side session freshness check | Session | Strictly necessary |
__clerk_db_jwt | Development environment auth (dev only) | Session | Strictly necessary |
These are strictly necessary cookies required for authentication functionality. They are not used for tracking or advertising.
Your control: You can sign out at any time, which clears your session. You can also clear all cookies for modernretire.com in your browser settings.
Analytics
Purpose: Understanding aggregate usage patterns to improve the Service.
Technology: Vercel Web Analytics, a cookieless analytics service. It does not set any cookies, does not use localStorage for tracking, and does not collect personally identifiable information. Data is collected at the aggregate level only (page view counts, device category, country).
Your control: If you wish to block analytics entirely, you may use a browser extension such as uBlock Origin, which will prevent the analytics script from loading.
What We Do NOT Use
- No Google Analytics or Google Tag Manager
- No Facebook Pixel, Meta Pixel, or social media tracking pixels
- No advertising cookies or retargeting cookies
- No third-party tracking scripts
- No cross-site tracking or fingerprinting
- No cookie walls or consent-gated content (the Service works fully without optional cookies)
Cookie Consent
Because ModernRetire uses only strictly necessary cookies (authentication) and cookieless analytics, a traditional cookie consent banner is not required under most jurisdictions. However, we believe in transparency:
- You can view exactly what is stored by inspecting your browser's cookies and localStorage for modernretire.com at any time.
- Authentication cookies are set only if you choose to create an account.
- You can delete all cookies and localStorage at any time without losing access to the free tier (though you will lose locally stored Plan Data).
For European Users
Under the ePrivacy Directive and GDPR, strictly necessary cookies do not require consent. Our authentication cookies fall within this exemption as they are essential for the Service to function for authenticated users. Our analytics solution (Vercel Web Analytics) does not set cookies and does not process personal data, so it does not require consent under the ePrivacy Directive.
If you have concerns about cookies or data processing, please contact us at support@modernretire.com.
Infrastructure Security
Hosting: ModernRetire is hosted on Vercel's infrastructure, which provides DDoS protection, automatic SSL/TLS encryption (HTTPS), and a global edge network.
Authentication: User authentication is managed by Clerk, which provides industry-standard security including bcrypt password hashing, brute-force protection, session management, and optional multi-factor authentication (MFA). We never store passwords directly.
Payment security: All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Credit card information is entered directly on Stripe's hosted checkout page and never passes through ModernRetire's servers.
Security headers applied on all responses:
X-Content-Type-Options: nosniff— prevents MIME type sniffingX-Frame-Options: DENY— prevents clickjackingReferrer-Policy: strict-origin-when-cross-origin— limits referrer information shared with third partiesStrict-Transport-Security— enforces HTTPS connections