Privacy Policy

This policy covers Well Spent, the retirement projection tool at wellspentyears.com. Well Spent is operated by Matt Warden, an individual based in Tennessee, United States ("we", "us"). You can reach us about anything on this page at privacy@wellspentyears.com.

The short version

You can use the calculator without signing in or telling us anything. Signing in with Google is what makes Well Spent remember your plan between visits. When you do sign in, we receive three things from Google — your Google account ID, your email address, and your name — and we store whatever plan figures you choose to save. There is no advertising, no analytics, no tracking, no third-party scripts, and nothing is sold or handed to anyone for their own purposes. Email us and we delete all of it.

What we collect

Data from your Google account

Signing in uses Google OAuth 2.0 with the openid, email and profile scopes. Those scopes give us, and we store:

• your Google account identifier (the stable sub value), which is how we recognize you on your next visit;
• your email address, used to identify your account and to reply if you contact us;
• your name, used to greet you in the interface.

We request no other Google scopes. Well Spent has no access to your Gmail, Drive, Calendar, Contacts, Photos, or any other Google service, and it never sees your Google password. We do not store Google access tokens or refresh tokens: the identity token Google returns is verified once at sign-in and discarded.

The plan data you enter

If you save a snapshot while signed in, we store what you typed: your date of birth, the value of your portfolio on that date, your stock and bond split, the spending you intend, the age you want the plan to run to, your assumed fee drag, your guardrail settings, and any note you wrote. We also store the sustainable spending figure the model produced for that snapshot, so that your history shows what the tool actually said at the time rather than what it would say today.

Snapshots are kept as a timeline on purpose — the point of the tool is what changed — so saving a new one does not erase the old ones.

Technical data

A session cookie identifies your browser while you are signed in. Our hosting provider, Cloudflare, processes standard request data such as IP address, user agent, and timestamps in order to serve and protect the site. We do not build profiles from it, and we do not retain our own copy of it beyond Cloudflare's own short operational retention.

What we never collect

Well Spent does not connect to your bank, brokerage, or any other financial institution. It has no account numbers, no credentials, no Social Security number, no transaction history, and no payment details — the tool is free, so there is no payment processor at all. It runs no analytics products, no advertising pixels, no session recorders, and no third-party scripts of any kind.

How we use Google user data

Because Google's verification process asks this specifically, here it is on its own, plainly:

• Access. We access your Google account ID, email address, and name, once, at the moment you sign in, and only because you clicked the Google sign-in button.
• Use. We use them for exactly one purpose: authenticating you so that the plan you saved is the plan you see. They are not used for advertising, for training any model, for marketing, or for any secondary purpose.
• Store. We store them in our Cloudflare D1 database, in the region Cloudflare assigns, for as long as your account exists.
• Share. We do not share them. They are not sold, rented, traded, or transferred to anyone, other than to Cloudflare as the infrastructure provider that stores them on our behalf, and except where the law leaves us no choice (see below).

Well Spent's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Three, all strictly necessary, none for advertising or analytics:

• ws_session — an opaque random identifier for your signed-in session. HttpOnly, SameSite=Lax, Secure, and it expires after 90 days. It contains no personal data itself; the session state lives in our database, which is what makes signing out actually revoke access.
• ws_oauth_state and ws_oauth_verifier — two short-lived values that exist for the ten minutes of the sign-in handoff and protect it against forgery. They are cleared as soon as sign-in finishes, successfully or not.

Where your data lives, and who else touches it

Two companies are involved, and no others:

• Google LLC — only to authenticate you, when you choose to sign in. Google's handling of your Google account is governed by Google's own privacy policy.
• Cloudflare, Inc. — hosts the application and stores the database. They process the data on our instructions in order to run the service.

Beyond those, we disclose personal information only if we are legally compelled to — a valid subpoena, court order, or equivalent legal process — or where disclosure is necessary to protect someone's safety or to investigate a security incident. If Well Spent were ever transferred to another operator, your data would move with it, and we would say so on this page and by email before it happened.

We do not sell your personal information, and we never have. We do not share it for cross-context behavioral advertising. There is no advertising here to share it for.

How long we keep it

Your account and your snapshots are kept until you ask us to delete them — this is a tool whose entire value is the multi-year record it builds, so it does not quietly expire your history. Session rows expire 90 days after they are created. Accounts that have not been signed into for three years may be deleted, with notice sent to the email address on the account first.

Deleting your data

Email privacy@wellspentyears.com from the address you signed in with, and say you want your account deleted. We will delete your user record and every snapshot and session attached to it within 30 days, and confirm by reply. There is no retention period after that and no archived copy we hold back; deleted rows may persist briefly in routine infrastructure backups before those age out.

You can also revoke Well Spent's access to your Google account at any time from your Google account permissions page. Doing so stops future sign-ins but does not by itself delete the plan data you have already saved here — email us for that.

Want a copy of what we hold, or a correction to it? Same address. We will send you your data in a machine-readable file within 30 days.

Security

Everything is served over HTTPS. Sessions are opaque random identifiers stored server-side rather than signed tokens, specifically so that signing out can genuinely revoke them. Session cookies are HttpOnly, so page scripts cannot read them. Every database query that touches your data is scoped by your user ID. Our OAuth client secret is held in encrypted secret storage, not in the source code.

Honesty about the limits: no service can promise perfect security, and this one is operated by one person. That is part of why it deliberately holds so little — no account numbers, no credentials, no way to move a dollar. The worst case for a breach here is that someone learns figures you typed, which is bad, and is a great deal less bad than the alternative designs.

Children

Well Spent is not directed at children and is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will remove it.

Changes to this policy

If this policy changes, the effective date at the top changes with it. For any change that materially affects how we handle data we already hold, we will email the address on your account before it takes effect.

Contact

privacy@wellspentyears.com. A real person reads it.

See also the Terms of Service, which cover the more important point that this is a projection tool and not financial advice.