RetireAligned · Free checkup

Your privacy

Version: 24 September 2026

What the checkup uses

We save your ten answers, progress, permissions and timestamps, and invitation status. A random browser cookie identifies your checkup; it contains no answers. We use your partner’s email only to deliver the invitation. We do not save that address in the checkup database. The email provider processes it for delivery.

Private answers, limited sharing

You can read your own answers through your browser session. Your partner cannot retrieve your raw answers. When both complete and consent, a deterministic comparison creates limited shared observations. Someone reading a summary may draw inferences about your perspective. There is no relationship score or diagnostic interpretation.

Your browser and your choices

Access expires 30 days after starting. A shared device can expose your session to another person using it. Clearing cookies loses access; this guest service has no account or email recovery. Invitation links expire after the period shown in the invitation and can be revoked before acceptance.

You can withdraw permission for paired results or delete your own checkup from the result page. Deletion removes your answers and permissions, prevents future paired results, and preserves your partner’s own private checkup. Withdrawal cannot erase a summary already read or saved.

Retention and operations

The configured retention target is 30 days for incomplete checkups and 30 days for completed solo or paired checkups, measured from each person’s start. Session access never exceeds 30 days. The provisional policy schedules daily deletion of expired checkups, their answers, permissions and associated audit records. Operations may shorten this period. Expired or revoked invitations are eligible for deletion 7 days after their expiry or revocation, whichever is later, unless the pair is removed sooner. Accepted invitation records end with their pair. Delivery status is stored with the invitation, without the email address.

Physical removal follows the next successful daily cleanup. Access expiry alone does not erase backups. Hosting region, backup and provider-log retention, maintenance scheduling and legal review remain launch checks. Until verified, this release is for fictional test data only. These are provisional operating choices, not claims about legal retention requirements.

Analytics and email

No third-party analytics or session replay is active. The event interface accepts only a fixed set of event names, with no answers, email addresses or invitation links. Operational audit records contain action names and timestamps, not response content. In local development, invitations are previews and no email is sent.

Abuse prevention uses temporary request counters and keyed hashes of guest sessions and normalized recipient addresses. Counters last until the end of their minute or UTC-day window and are removed by daily maintenance. No IP address or device fingerprint is collected by this application for these limits. Operational logs contain fixed operation names and outcomes, without answers, email addresses, session or invitation tokens. Hosting providers may independently process connection metadata.

Service providers and contact

The intended providers are Render for application hosting, Supabase for database and account authentication, and Resend for transactional invitations. Hostinger manages the domain’s DNS. Invitation delivery requires Resend to process the recipient address and the private invitation link. Provider configuration, processing locations, access and retention require verification before real collection begins.

For privacy, access, deletion, withdrawal or customer questions, contact info@retirealigned.com. Do not email your answers or invitation link. We may need to establish ownership safely before acting; an email address alone does not identify an anonymous checkup. Your browser’s own deletion and withdrawal controls provide the direct route.

There is no marketing subscription as part of this checkup. Do not forward an invitation: whoever holds its link can accept it. No email identity verification is claimed.

Legal review pending: operator identity, provider arrangements, backup retention and request-handling procedures must be approved before public collection. No compliance certification is claimed.