Your census never leaves your browser.

By design, Retira.app is local-first. The employee census you enter stays in your browser, calculations run on your device, and census data is never transmitted to us.

If you sign in, we store your account information and the plan-design settings associated with your account in our cloud, so your saved plan settings are available across sessions and devices. Your employee census is never uploaded – it stays in your browser.

The app includes optional AI features. Every one of them is opt-in: nothing is sent to an AI provider until you explicitly agree, each feature asks for its own consent the first time you use it, and declining never breaks anything – the feature simply stays off or falls back to a local, on-device alternative. Even when you do opt in, your census is never uploaded.

The employee census, working plan rules, compare-mode plans, Estimate Mode assumptions and the census generated from them, and undo history are kept in your browser’s local storage so your work persists between sessions. This includes compensation, balances, dates, and other personal details in the census.

We do not receive census data. You can remove browser-stored data by clearing the census in the app or clearing browser storage for this site. On a shared device, consider a private window and clear site data when you finish.

Signing in to the studio is passwordless: we email you a one-time six-digit code that you enter to sign in. To provide this we store your email address, basic account and access-grant records, and a log of sign-in events (such as time and success) used for security and access control. Authentication is handled by our infrastructure provider, Supabase.

We use your email to operate your account and, where relevant, to contact you about access. We do not sell your personal information.

Your plan-design settings are stored in our cloud so they stay available across sessions and devices. The Client Book lets you keep and label multiple named versions. In all cases, census data is never uploaded.

Selecting a Client Book entry applies its plan settings to the census already open on that device. You can delete saved entries at any time.

Some features can use a US-based AI provider (no retention, no training on your data) to save you time. Each one is opt-in: the first time you use it, the app tells you exactly what would leave your browser and asks for your consent before sending anything. If you decline, the feature stays off or the app falls back to a local, on-device alternative. In every case, your census is never uploaded – each feature sends only the minimum described below.

Julio, the AI assistant, does nothing until you turn it on, and you can turn it off at any time. When you ask a question, that question, your plan design settings, and de-identified employee data – with names and IDs removed in your browser – are sent to generate an answer. Employee names and IDs never leave your browser: they are stripped before anything is sent and re-attached on your device. Answers are informational only and are not legal, tax, or investment advice.

Census import – “Match with AI”. To help match your spreadsheet’s columns, we send only the column headers and masked format samples in which every digit is replaced with a 9 and every letter with an X. No actual cell values – no names, compensation, dates, or other census contents – are sent.

Plan-document import. When you import plan settings from a plan document, the text is extracted from your file on your device, and only that document text is sent so plan rules can be read out of it. The suggested settings are checked against the app’s allowed values on your device before anything is applied, and nothing changes until you review and confirm.

Estimate Mode prefill. If you ask the AI to fill in the estimate form, only the rough plan description you typed is sent. The estimated census itself is generated entirely in your browser and is never uploaded.

PDF reports, results and census CSVs, and plan-settings JSON are generated on your device and saved by you. Once downloaded, these files are under your control and can contain compensation and personal data, so handle and share them accordingly.

We use local/session storage and necessary cookies to keep you signed in and to remember your preferences and work in progress.

Browser-stored data persists until you clear it. Account and sign-in records are retained while your account is active and as needed for security and legal obligations. Saved Client Book entries remain until you delete them or your account.

To access, correct, or delete your data, use the in-app controls or contact us. Subject to applicable law, you may have rights to access, correct, delete, or port your personal information.

Reach us through the Contact link in the app for any privacy request or question about this policy.

By accessing or using Retira.app (the “Service”), provided by Retira LLC, you agree to these Terms. If you do not agree, do not use the Service.

Informational only, not advice. The Service models 401(k) contributions for illustration and planning. It does not provide legal, tax, accounting, actuarial, or investment advice, is not a compliance or nondiscrimination test, and does not create a fiduciary or advisory relationship.

Your responsibilities. You are responsible for the accuracy of the data you enter, for the confidentiality of any census or personal data you handle, and for verifying results and compliance with applicable regulations and plan documents before relying on them. Confirm plan-design decisions with your recordkeeper, TPA, or ERISA counsel.

Accounts & acceptable use. You are responsible for activity under your account, for keeping access to your email secure, and for having authority to use the data you enter. You agree not to attempt to access other users’ data, disrupt the Service, or reverse-engineer it.

Estimates & no warranty. Outputs are estimates based on the inputs you supply and the IRS limits configured for the selected plan year. The Service is provided “as is” and “as available,” without warranties of any kind, including accuracy, completeness, availability, or fitness for a particular purpose.

Limitation of liability. To the maximum extent permitted by law, Retira LLC is not liable for any indirect, incidental, consequential, or special damages, or for decisions or filings made in reliance on the Service. Use of the Service is at your own risk.

Changes. We may update the Service and these Terms. Material changes will be reflected by the “last updated” date above; continued use after an update constitutes acceptance.