What we hold,
and what we never ask for.

What the app asks you for

The planning inputs, typed or edited by you: your age, the age you would like to retire, annual income, annual savings, annual spending and the essential part of it, account balances grouped by tax treatment (taxable, tax-deferred, Roth, cash), non-housing debt, your own estimate of a Social Security benefit and the age you would claim it, any pension, continuing income and its start/end ages, your stock/bond/cash mix, and the modelling assumptions you can edit.

Optional planning details include dependent ages and labels, home value and mortgage balance, future net home-sale proceeds, dated spending changes and one-time costs. These are saved with your plan when you choose account sync.

There is no bank connection and no account aggregation. Years Ahead never asks for account numbers, institution logins, a Social Security number, a date of birth, a home address, or a photograph. It collects no health data, no location, and no advertising identifiers.

On your phone: nothing leaves it until you save

The app runs the projection on the phone itself and keeps your inputs and your consent choices in the device's secure storage (the iOS Keychain, on this device only). A copy of your last result is kept in the app's cache so the app opens on it instantly; the cache is not backed up. Nothing about your plan is transmitted until you choose to save it, and Delete my Years Ahead data removes all of them.

Signing in and saving

The app opens only after you sign in through Cidadel, the shared identity service behind this family of apps (Continue with Apple, or email and an authenticator app), and your Cidadel account details are governed by Cidadel's own terms. Saving your plan to your account is a separate, explicit choice. When you save, Years Ahead itself stores a household record keyed by a one-way hash of your Cidadel subject identifier, holding your plan inputs and saved runs encrypted at rest under keys scoped to this product. Every request is checked against the household it names. Connections from your phone to the service use HTTPS. Saved plans are versioned, so re-saving replaces the record rather than accumulating copies.

Cidadel receives your sign-in name, email and account identifier, plus a persistent device identifier kept in the phone's secure storage. It retains session and login records, including IP address and browser or app information, for authentication and account security. This device identifier is not an advertising identifier.

Service diagnostics

Server request logs record network addresses, requested routes, response status, timing and errors to operate and protect the service. Some routes include your account's household identifier. The Years Ahead API redacts authorization headers and request bodies. Its request logs rotate by size rather than after a fixed number of days; Cidadel's security records have separate retention settings. These records are used for app functionality, not advertising or tracking across other companies' apps or websites.

Optional explanations in Moves

Calculations and the standard explanations work on your phone. When optional AI context is available, you must allow each explanation request separately. This sends the selected move, the direction of its calculated effect, and whether the calculation uses IRA rules or is flagged fragile to Cidadel Arbiter and its external AI provider. Your Cidadel account identifier accompanies the request to Arbiter; balances, your name and email are not included in the prompt. The service uses a reference to your saved calculation to verify which result is being explained.

The consent screen shows the provider and prompt-retention period published by the service, or says they are unpublished. Whether prompts may be used for training is not published in the app. AI only selects reviewed wording; it does not calculate figures or choose a financial action. This permission is separate from peer sharing. Keeping the explanation on your device sends no explanation context to Arbiter. If AI is unavailable, the on-device explanation remains.

Optional profile chat

When profile chat is enabled in your build, it asks for separate permission before sending a message. It sends your question, recent conversation history, saved financial inputs, matching calculation facts and selected scenario to Cidadel Arbiter and its AI provider. This includes financial balances and age; your name and email are not placed in the prompt. Your account identifier accompanies the request to Arbiter.

The consent screen identifies the provider and states the available retention and training information. Unverified terms are labelled as unverified; an API provider's standard terms are not a claim about this deployment's account settings. Chat explains tested calculations and sourced comparisons. It does not calculate financial figures, select financial actions, or change your saved plan.

Conversations and their supporting result facts are encrypted in your account so you can return to them on another device. You can read history without using an AI reply, delete individual conversations, export them, or turn off permission for future messages. Turning permission off cannot recall a request already sent to the provider. Deleting Years Ahead data removes saved conversation content as well as your plan.

Subscriptions and usage

Apple or Google Play handles checkout and payment details. Years Ahead verifies purchases directly with the store and stores subscription identifiers, status and expiry to provide Pro access. Google Play purchase tokens are stored encrypted. Apple receives your opaque household identifier; Google receives its hashed form to bind purchases and restores to your Years Ahead account. Your financial plan and chat messages are not sent to the stores for billing. Years Ahead does not receive your card number. Reply counts, token usage and bounded cost records are linked to your account to enforce the AI allowance across devices. Minimal usage and abuse-prevention records may remain after deletion; they contain no conversation text or financial plan. Deleting the app or account does not cancel an subscription; manage it in the App Store or Google Play account where you subscribed.

Peer comparison is a second, separate opt-in

Comparing yourself against other Years Ahead users is off unless you turn it on, and it requires a saved account. When it is on, a snapshot of your household — your age, your investable assets, your annual income and your non-housing debt, if you entered one — is stored encrypted, at the same precision you entered it, and counted into aggregates. If you turn on the app-user comparison, what you owe is part of that snapshot. Your retirement goal never is. Your age is coarsened only when the comparison is computed: you are matched against other households inside a fixed five-year age band, and only totals over at least one hundred other consenting households are ever shown. Nobody receives an individual row. A comparison is withheld until enough other consenting households share your band, and it stays withheld while the group is too small. Withdrawing consent removes your contribution from future aggregates.

Comparisons against the general population come from the Federal Reserve's published Survey of Consumer Finances, not from other users, and no user data is contributed to them.

This website

The page you are reading is static. It carries no analytics, no tracking pixels, no advertising scripts, no cookies and no sign-up form. Its fonts are bundled and served from this site, so loading it contacts no third party.

Exporting and deleting

Export my inputs and result hands you a copy of everything held for you, in a readable format.

Delete my Years Ahead data deletes the live household record — inputs, saved runs, saved conversations and any peer contribution — from the connected service first, while your session is still valid, then deletes the Cidadel sign-in you created from this app, then clears this device. If any step does not complete, the app says so rather than reporting success, and names what is still there.

The Cidadel identity that deletion removes is the shared sign-in for this family of apps: deleting it removes the credentials, the sessions and the user record, so if you use that same Cidadel account anywhere else, that access goes with it. Only Years Ahead's own household data is deleted by the first step.

Encrypted backup copies of deleted records expire within 30 days of the deletion, after which the record is gone from the backups too.

Who this is for

Years Ahead is built for adults planning their own retirement and does not accept an age under 18. It is not directed at children and does not knowingly collect anything directly from them. Adults may enter dependent ages and optional labels as planning context.

Changes and contact

Material changes to what is collected will be reflected here with a new date above, and announced in the app before they take effect.

Write to support@yearsahead.si.

Read the terms and model limits for what Years Ahead is — and is not — allowed to tell you.