Privacy
No account, no name, no email to make a plan. The shortest honest version of this page is that we do not know who you are and have not tried to find out.
Who is responsible
RetOpt is operated by Jacob Risk Management Ltd. ("we," "us"), which is responsible for the information you enter on this site and in the calculator. Questions about it go to info@retopt.com.
What you type
The form asks for ages, salaries, account balances, contribution room, what you want to spend, and where you live. It does not ask for your name, your email, your address, your date of birth, your Social Insurance or Social Security number, or any account number. We could not identify you from what we hold, and neither could anyone who took it.
How long we keep it
A plan you do not save is kept for 30 days and then deleted. A plan you save is kept for 365 days, because you asked for a link that still works. Press "Delete it now" on your plan and it goes at once, whichever it is; our backups forget it within 35 days. Intermediate results behind the sliders are kept for 180 days.
The link is the key
Saving a plan gives you a URL with a signed key in it. That key is the only thing protecting the plan: anyone you send the link to can open it, and so can anyone who finds it in a shared browser history. Send it the way you would send a bank statement. Anyone with the link can also delete the plan, and if you would rather we did, write to info@retopt.com with the link and we will, usually the same day.
Cookies and logs
Three cookies, and none of them is a login. One is a random token that lets your browser reopen a plan you started, and it lasts 90 days. One remembers which country you said you live in, for 90 days. One holds your answers to the first few questions, signed so they cannot be changed, for 30 days, so the form opens on them. There is no tracking pixel and no third-party anything on this site or in the app.
We do not keep any access logs, even anonymized ones. An IP address written next to a saved plan's key would turn two harmless things into one identifying thing, and nothing we need is worth that.
What we count
The form counts how many people reach each of its pages and how many go on to the next, by day, so we can see which question makes people stop. A count is all we keep: no cookie goes with it, nothing you typed, no address, and nothing that ties one page to the next. Your browser remembers, in that tab only, which pages it has already counted, so a reload is not counted twice, and it forgets when you close the tab.
Each plan we work out also leaves one record of how the calculation went: how long it took and how good a plan it found, and the kind of household it was for. That is the country, the province or state, one person or two, the years they were born, whether they are still working, what kind of business they own, if any, and whether the plan was free. It does not hold the plan's link or any amount you typed.
Neither has anything in it for us to delete on your behalf, so we keep both.
If you ask for an advisor's price
"Contact RetOpt for custom pricing" is the one form that asks who you are: your name, your email address and how many clients your practice has, so that we can write back with a price. We keep it for a year in the country you asked from, email it to ourselves, and use it for nothing else. To have it deleted sooner, write to info@retopt.com.
If you use “Ask about your plan”
The button at the foot of your plan opens an assistant that answers questions about that plan. The answers are written by Claude, an AI made by Anthropic, PBC. Nothing is sent to Anthropic until you have read what is sent and pressed “I agree”.
When you ask a question, we send Anthropic your question, the earlier questions and answers about the same plan, your plan's numbers (what you typed for it and what the calculator worked out), and the tax rules it was worked out on. Nothing that names you is sent, because we hold nothing that names you. Anthropic processes it in the United States, wherever you live.
Anthropic's terms for its API say it deletes what we send within 30 days and does not use it to train its models. It may keep it longer only where it must, to enforce its usage policy or the law. We checked those terms on 14 October 2026.
Your questions and the answers are kept with your plan, for as long as the plan is kept, and “Delete it now” deletes them with it. We also keep the date you agreed and which version of the notice you agreed to. Besides that we count, by day, how many questions were asked and how many tokens, the units Anthropic charges by, they took, and nothing else: no question, no answer, and nothing that ties a count to a plan.
Where it runs
If you live in Canada, what you type is stored and processed in Canada. If you live in the United States, it is stored and processed there. You tell us which when you start, and we do not guess it from the country your plan is about: people retire across the border both ways.
The one exception is a question you choose to ask with “Ask about your plan”. That question and your plan's numbers are processed by Anthropic in the United States, and only after you agree to it. Your plan itself, and the conversation, stay stored where your plan is.
Nothing is sold. Apart from a question you choose to ask with “Ask about your plan”, described above, nothing you type is sent to a third party.