Privacy Policy
Surveyor is a retirement planning and education tool. To do its job it needs detailed financial information about your household, which you enter yourself or connect through Plaid. This policy says exactly what we collect, why, who else sees it, how long we keep it, and how to delete it. We do not sell your information, share it for advertising, or use it to train AI models.
1. Who we are
Surveyor (usesurveyor.com) is operated by Dylan Schaefer, a sole proprietor based in California, United States ("Surveyor", "we", "us"). For anything in this policy, write to [email protected].
2. What we collect
Information you give us
- Your email address, used to sign you in. There is no password.
- Your household plan: whatever you enter on the planning tabs, which may include ages and birthdates, sex, marital status, children, retirement dates, state of residence, home and property addresses, income and employment, account balances and cost basis, pensions and Social Security estimates, expenses, debts, insurance, long-term care preferences, education plans, and the health and lifestyle answers on the Mortality tab. You decide how much of this to enter; the simulation runs with whatever you provide.
- Feedback you submit through the Provide Feedback form, and your name and contact email if you choose to include them.
Information from accounts you connect through Plaid
If you choose to link an investment account on the Account Connections page, you enter your bank's login in Plaid's own window. Your bank credentials never reach Surveyor. Plaid gives us an access token for the connection, which we store encrypted, and lets us fetch the institution name, account names and types, balances, holdings and cost basis. We keep the balances and cost basis you choose to add to your plan; holdings and transactions are read when you refresh and are not stored. You can disconnect an account at any time on the same page, which revokes our access at Plaid. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
Information collected automatically
- Sign-in records: when a sign-in link or code was sent and used, kept by our authentication provider for security.
- Technical logs: IP address, browser type, pages requested and timing, kept briefly by our hosting provider to run and protect the service. We do not use analytics trackers or advertising pixels.
- Browser storage: your sign-in session, a small record that lets the app notice if it crashed last time, and, while you connect a bank, a short-lived record of that attempt. See section 9.
What we deliberately do not collect
Passwords, bank or brokerage login credentials, payment card numbers, Social Security numbers, or government identification numbers. If a feature would ever need one of these, this policy will be updated first.
3. How we use it
- To run the simulation and show you the results.
- To save your plan so it is there when you come back, and to let you connect, refresh and remove linked accounts.
- To sign you in and keep your account secure.
- To respond to feedback or a request you send us.
- To protect the service: detecting abuse, investigating security incidents, and meeting legal obligations.
We do not use your information for advertising, do not sell or rent it, do not share it for cross-context behavioral advertising, and do not use it to train or evaluate machine-learning models. We may look at aggregated, de-identified usage counts to understand how the tool is used.
4. Who else sees it
We run Surveyor on a small number of service providers, each of which receives only what its job needs and is bound by its own terms to use it only to provide the service to us.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Your email, your plan, and the encrypted Plaid token |
| Cloudflare | Hosting, network security, three small server functions | Technical logs; feedback text in transit |
| Plaid | Connecting financial accounts | Your bank login (entered on Plaid's site); account data it returns to us |
| Google (Places API) | Address autocomplete on the Real Estate tabs | The address text you type into those fields |
| Resend | Delivering feedback to us by email | Your feedback, and your name and contact email if given |
| Fastmail | Hosting our email, where feedback and privacy requests arrive | Your feedback, your name and contact email if given, and any email you send us |
| RentCast | Home value estimates for a home whose value you let follow the estimate: when you enter its address, and about once a month after that when you sign in. Switch to your own value to stop it | The street address of that property; nothing else about you |
| CoinGecko | Cryptocurrency prices | Nothing about you; prices are fetched server-side |
| NHTSA (U.S. government) | Vehicle make and model lists | Nothing about you; the make and year you pick |
Beyond these providers, we disclose information only if the law requires it, to protect the rights or safety of users or the service, or, if Surveyor is ever sold or merged, to the new operator under this same policy with notice to you. We have no employees or contractors; the operator is the only person with administrative access, and reads a user's plan only to answer that user's support request, to investigate a security incident, or to run a data migration.
5. How long we keep it
| Data | Kept |
|---|---|
| Your plan | While your account exists. "Reset all data" in Settings replaces it with defaults at once. |
| Earlier versions of your plan | 14 days. We keep a copy of your plan as it stood when you start a session, every 30 minutes while you edit, and before a reset or a restore, so a mistake can be undone from the account menu ("Earlier versions"). You can delete them there at any time, and they are deleted with your account. |
| Your account and email | While your account exists; deleted within 7 days of a verified request. |
| Plaid connection and token | Until you disconnect it, or within a day of your account being deleted (the connection is revoked at Plaid, then removed). |
| Feedback | Until acted on, at most one year. |
| Home value lookups | The estimate and the date stay in your plan. RentCast keeps the addresses it is sent under its own privacy policy; we send them without your name, email or account, so they are not linked to you. |
| Sign-in and technical logs | Provider defaults, between 7 and 90 days. |
| Database backups | Provider retention, between 7 and 30 days; a deleted account leaves backups on that schedule. |
6. Your choices and rights
- See and change everything you have entered, at any time, on the planning tabs.
- Disconnect a linked account on the Account Connections page.
- Reset your plan from Settings, and restore or delete earlier versions of it from the account menu.
- Delete your account and everything in it, or receive a copy of your plan and its earlier versions, by emailing us from the address you signed in with. We confirm the request by replying to that address and complete it within 7 days. An address you looked up a home value for is also held by RentCast; because we send it without anything that identifies you, it cannot be found and deleted for you alone, and the copy in your plan is deleted with your account.
If you live in California or another state with a consumer privacy law, those laws may give you rights to know, delete, correct, and opt out of sale or sharing. We extend the same rights to everyone regardless of location, and we do not sell or share personal information, so there is nothing to opt out of. We will not treat you differently for exercising a right. We do not respond to browser "Do Not Track" signals because we do no tracking that they would apply to.
7. Security
Every connection to Surveyor uses TLS 1.2 or better. Your plan is stored in a database that encrypts data at rest, and each user's data is isolated by database-level access rules so that a signed-in user can only reach their own. Plaid access tokens are encrypted a second time by the application with a key that lives only on the server, and the browser has no path to the table that holds them. Administrative accounts use multi-factor authentication. Our full security policy, including how we would respond to and notify you of an incident, is kept as a written document and reviewed quarterly. No system is perfectly secure; if we learn that your data was exposed, we will tell you within 72 hours of confirming it.
8. Children
Surveyor is for adults planning their own retirement and is not directed to anyone under 18. We do not knowingly collect information from children. You may enter information about your own children (such as ages and planned education) as part of your household plan; that information is yours, stored with your plan, and deleted with it.
9. Cookies and browser storage
Surveyor sets no advertising or analytics cookies. Your browser keeps your sign-in session, a small crash-detection record, your automatic sign-out setting and the time you were last active (so the app can sign you out when you step away), and, while you connect a bank, a short-lived record of that connection attempt (so it can finish if your bank signs you in on its own site) in its own storage for this site. The connection record is removed when the attempt ends or you sign out; signing out also clears the session and the last-active time, and clearing site data removes the rest. Our hosting provider may set a cookie strictly needed to protect the site from automated abuse.
10. Where your data is processed
Surveyor is intended for users in the United States and our providers store data in the United States. If you use it from elsewhere, your information will be processed there.
11. Changes to this policy
When this policy changes we will update the date at the top and, for any change that affects how your information is used or shared, tell you by email or a notice in the app before it takes effect. Earlier versions are available on request.
12. Contact
Questions, requests, or concerns: [email protected].