Privacy policy

I run this site alone. I don’t sell your data, I don’t run ads, and the public site sets no first-party reader cookie until you sign in to the optional account. The owner-only admin uses one strictly necessary security cookie. Most of the site works without asking who you are. This page covers the places where data still comes up.

Who is responsible (the “controller”): Pablo M. Hernandez, publishing as The FIRE Exit, based in Lisbon, Portugal. For anything in this policy, email pablo@thefireexit.com.

The short version

• The calculators do their arithmetic in your browser. Some settings and results stay in that browser so the tools and My Exit can remember them.
• Buy or Rent keeps its normal working address clean. It only puts assumptions in an address when you explicitly create a share link or open one somebody sent you.
• Tool links can carry the exact numbers in their address. Opening or sharing one sends that address to the host and gives those figures to anyone who has the link.
• I only receive personal data when you choose to send it: the contact forms, booking a session, subscribing to the newsletter, or asking to sign in to the optional account.
• An account is optional and does one job: it keeps the categories you choose so your work can follow you to another device. You can download everything it holds or delete it, yourself, in account settings.
• No advertising trackers, no cross-site advertising profile, no selling of data and no automated decision-making.
• You’re never obliged to give me data. The forms simply don’t work without the fields they ask for, and everything else works with none.
• You can ask me at any time what I hold about you, and ask me to correct or delete it.

What I collect, and why

1. The contact forms

If you write to me through the contact form (a session enquiry or a talk enquiry), I receive your name, email address and message, plus which form you used. I use it to answer you and, if you’re booking a session or a talk, to prepare for it. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering correspondence (Art. 6(1)(f)). Retention: for as long as our exchange is live and up to two years after the last message, then deleted (earlier if you ask).

2. Booking a session

The booking calendar on the contact page is provided by Cal.com, running on its EU-hosted service (cal.eu). When the calendar loads, your browser talks to Cal.com’s servers; when you book, the details you enter (name, email, your answers to the screening questions and the time you pick) are processed by Cal.com on my behalf and land in my calendar. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b)). Cal.com acts as a processor; the embedded calendar may set its own strictly-functional cookies inside its frame to make the booking work, and Cal.com’s own privacy notice, including the safeguards it applies to any processing outside the EEA, is at cal.com/privacy.

3. The newsletter (“Postcards from the exit”)

If you subscribe, I store your email address, subscription status, source, opaque security tokens and the timestamps needed to run the list. I also keep the issue and send ledger so the same postcard is not sent twice. Sign-up is double opt-in, and every broadcast carries a one-click unsubscribe route under RFC 8058. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by unsubscribing or emailing me. Retention: an unconfirmed request expires after 30 days. A confirmed subscription stays while you are subscribed. If you unsubscribe I keep a suppression record so you are not silently re-added, and I erase that too on request. Processors: the list lives in a Neon Postgres database, the postcards are delivered through Resend, and private backups are kept in Vercel Blob storage. Full erasure removes the active database row and send ledger immediately. An older copy can remain in a backup until 14 newer successful snapshots replace it; if the backup job stops, that can take longer than 14 days. These providers process the data needed to provide their service. Resend states that its primary processing is in the United States and incorporates the EU standard contractual clauses into its data-processing addendum.

4. Plain email

If you email me directly, I’ll have whatever you send, in my mailbox, for as long as the conversation warrants. Same handling as the contact form.

5. Hosting and server logs

The site is hosted by Vercel. Like practically every host, Vercel keeps short-lived technical logs (IP address, browser type, pages requested, timestamps) to run and secure the service. Legal basis: my legitimate interest in operating a working, secure website (Art. 6(1)(f)). A requested address can include tool values in its query string, so hosting and security logs may receive that full address even though the calculator itself runs locally. Vercel Inc. is a US company; its current privacy notice states the EU–US Data Privacy Framework and standard contractual clauses among its transfer safeguards. Vercel’s privacy notice is at vercel.com/legal/privacy-notice.

6. Analytics

I use Vercel Web Analytics to see, in aggregate, what gets read. Before an analytics event leaves the page, I remove the query string and fragment, so it carries the page path but not the scenario values in a tool link. Vercel Web Analytics is cookieless and is not used here to follow you across sites or build an advertising profile. Legal basis: my legitimate interest in understanding how the site is used (Art. 6(1)(f)).

7. Things stored in your browser (and only there)

A few features remember choices on your own device: the theme; your atlas money and passport settings; course progress; the current Buy or Rent scenario; the results collected on My Exit; your Exit File; and your Spare Key. The Exit Audit keeps its draft answers only for the tab session. These values exist to restore the feature you used. They go when you clear that feature or your browser data; the audit draft goes when its tab session ends. This Local storage is separate from the optional account: signing in uploads none of it, and nothing in this browser reaches the account unless you choose to keep it there.

Buy or Rent calculates without changing its normal page address. An incoming shared scenario stays temporary and does not replace the Local copy merely because you opened it. If you choose to create a share link, that link contains the numerical housing, mortgage, cost and return assumptions shown on the page. A Switzerland link can also contain the canton and numeric municipality BFS identifier, but the calculator asks for no municipality name or property address. Anyone with the link can read them.

Once this page is open, the Rehearsal works without a connection. Your work is saved in this browser until you clear it, and nothing is sent unless you choose to keep it in your account. Printing and downloading create copies you control.

Anyone using this browser profile may be able to open this Rehearsal. Export it and clear the browser copy if the device is shared. Export files are plain JSON, not encrypted.

There is no private share link. Rehearsal answers never go into the page address.

The plan is saved in this browser until you clear it, and nothing is sent unless you choose to keep it in your account. Downloading creates a copy you control.

Anyone using this browser profile may be able to open this File, and browser cleanup can remove it. Download a copy if either matters here.

The Exit File has no share link. Nothing you enter goes into the page address, and a copy travels only as the JSON you download, or in your account if you keep it there.

The Key is saved in this browser until you clear it, and nothing is sent unless you choose to keep it with your File in your account. Printing and downloading create copies you control.

Anyone using this browser profile may be able to open this Key, and browser cleanup can remove it. Download a copy if either matters here.

The Spare Key has no share link. Nothing you enter goes into the page address, and a copy travels only as the JSON you download, or with your File if you keep it in your account.

8. The optional account (My Exit)

Everything on this site works without an account. If you create one, this is exactly what that adds, and where it lives.

What signing in creates. An account is made the moment a sign-in link is opened, not before. Asking for a link already stores the address you typed, in that link’s own row, account or not. If the link is never opened and no account exists behind the address, you can’t delete that row here yourself: it ages out on its own, on the sign-in-link clock below. The account itself stores your email address as the sign-in identity, the account’s own status and timestamps, a row for each signed-in browser (the kind of device and the dates, no device name, no location), and the used-once sign-in links themselves, kept only in hashed form. If you set the optional password, a one-way hash of it is stored, never the password itself. In this browser, signing in sets the cookie that keeps you signed in and a small marker that this browser has signed in before; signing out clears both.

What it keeps. Only the categories you switch on: tools and plan numbers, Rehearsals and written reflections, reading and course progress. Nothing is preselected, signing in uploads nothing, and work in this browser reaches the account only when you choose to keep it there. The account’s address has nothing to do with the newsletter: the two live in separate databases, and neither can read the other, even if you used the same address for both.

What it’s for, and what it’s never for. The account exists so the work you chose to keep can follow you to another device, and for the security of the account itself. I don’t sell account data, and I don’t use it for advertising, marketing, profiling, recommendations from a model, or training one. Legal basis: running the account you asked for is performance of a contract, and holding a sign-in request you haven’t finished is a step taken at your request on the way into one (both Art. 6(1)(b) GDPR); the security records below are my legitimate interest in keeping accounts safe (Art. 6(1)(f)).

Where it lives, and who processes it. The account’s database is a Neon Postgres project in Frankfurt (AWS eu-central-1), separate from the newsletter’s. The site runs on Vercel, whose functions for this project also run in Frankfurt (fra1), so account requests are processed where the rows live. Even so, I don’t claim EU-only processing. The two account emails (the sign-in link and the password confirmation) are delivered through Resend, whose primary processing is in the United States under the EU standard contractual clauses in its data-processing addendum. I put account data into those three services and no others. One more call leaves the server, and it adds no new processor of personal data. It happens only when you set or change the optional password, never when you sign in. The server asks Have I Been Pwned, an outside service, whether the password you chose has already appeared in a known leak. What goes out is the first five characters of a hash made from the password for this check alone. Nothing else goes: not the password, not the rest of that hash, not your email address, not your network address. The service answers with a block of possible matches, and the comparison happens back on this server; your browser never talks to Have I Been Pwned at all. The check exists so you can’t protect your account with a password that’s already on a public list of leaked passwords, and it’s built so the password itself never leaves. If the password is found in a leak, or the check can’t run at all, the password is not set and no hash is stored.

Reading your data. There is no screen here that browses account content, and no support impersonation: support questions get answered from value-free records, counts, timestamps and status codes. But I won’t dress that up as more than it is. The server necessarily reads what it stores in the ordinary course of running the feature: to check a save is valid, to sync it, to show you counts and dates, and to delete it when you ask. And the operator of any database could technically read what’s in it. The promise that holds is the paragraph above: what this data will never be used for.

Security records. A sign-in log keeps value-free events for 90 days: what happened and when, the kind of device, and a hashed, shortened form of the network address, kept so a break-in can be investigated. Abuse counters hold hashed keys and counts; rows older than 48 hours are cleared the next time the counters run. The application writes no account content to any log. Vercel’s own hosting logs (documented retention: one day) receive request addresses like any host’s, and while a sign-in link is still valid, the address it carries includes its one-time token.

How long things last.

• What you keep: until you delete the item, the category or the account. There is no inactivity purge; an account you don’t touch keeps its work.
• A sign-in: works for 90 days, or 30 days unused, whichever ends first, and signing out ends it sooner. The stored row of an ended session remains until the account is deleted.
• A sign-in link: usable once, for 15 minutes. Its stored row becomes eligible for cleanup two days after it’s used or expires, and is cleared the next time a link is issued or the account is deleted.
• Sign-in log events: 90 days, cleared as newer events arrive.
• The account’s sync history: entries recording a save are cleared after 90 days; entries recording a deletion are content-free and stay until the account itself is deleted, so a deleted thing can’t quietly come back.
• A deletion receipt: value-free, expires after 30 days; the row itself is cleared by a later operation.
• Where a line above says “cleared the next time”, that is literal: cleanup runs on the next relevant operation, not on a scheduled clock.

Deletion, and the honest edges of it. Deleting a category or the whole account removes the rows from the database itself, in one transaction: no partial deletions. What deletion can’t reach: copies outside my control (your downloads and printouts, work kept in a browser, an email already in your inbox) and the database’s own short-term restore history, which can hold just-deleted rows for up to six hours before that window passes. The six hours is the measured setting of this database’s restore history, and it covers restore history only. Today that database is a single branch, and I’ve made no snapshot or dump of it; if that ever changes, the copy has its own lifetime and its own deletion, and this page changes to say so. After a whole-account deletion, what remains on my side is an anonymous deletion receipt (the fact and the time, nothing else, expiring after 30 days) and the value-free security records above, which can no longer be tied to you. If the law ever compels a disclosure or a preservation, I comply exactly as far as the order reaches and no further.

Your download. One control in account settings builds a single plain JSON file of everything the account keeps, with a readable list of what’s inside. It never contains your sign-in address, your sessions or any security record. It’s built when you ask and handed straight to you as a download, never sent by email.

What an account holds

The limits are published, and they’re set by type, count and size. Nothing is measured by reading what’s in your work.

• One saved workspace per tool. Saving again replaces it, and there’s no automatic history.
• One Exit File draft, plus 20 sealed versions. Each is capped at 250 KB, which is far more than a plan made of numbers and dates needs.
• One Spare Key draft, plus 20 sealed Keys. Each is capped at 200 KB, including the frozen File values it keeps.
• One Rehearsal in progress, plus 12 finished ones. Each is capped at 100 KB, and that’s with the text you write.
• 500 saved and read marks. The whole site carries well under 200 pages you can mark today.
• Five full downloads a day.
• 5 MB across the whole account. Numbers and text weigh almost nothing; you’d have to try.

At a limit, everything already saved stays readable, downloadable and deletable. Nothing gets deleted to make room, the Local paths stay open, and there’s no upgrade to buy.

What I don’t do

• No selling or renting of personal data. Ever.
• No advertising, ad networks or cross-site advertising trackers.
• No profiling and no automated decision-making about you.
• No server-side profile of your browsing or reading: the account keeps only work you explicitly chose to keep, and visits, scrolling and time on a page never become reading history. The exception to remember is still the URL itself: if it carries numbers, the host and anyone you share it with can receive them.

Your rights

Under the GDPR you can ask me for access to the personal data I hold about you, ask for it to be corrected or deleted, ask me to restrict or object to how I use it, and ask for a portable copy. Where something runs on consent (the newsletter), you can withdraw that consent at any time, with no effect on what happened before. Email pablo@thefireexit.com and I’ll answer within a month. For the account you don’t even have to ask: downloading everything, deleting a category and deleting the whole account are controls in account settings, and they work without me.

If you think I’ve handled your data badly, you can complain to a supervisory authority. In Portugal that’s the CNPD, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live.

Children

This site is not directed at children, and I don’t knowingly collect data from anyone under 16. The optional account is for adults, 18 and over: stated at sign-in, not verified, because I don’t collect a birth date — checking one would collect more data than the limit protects.

Changes

If the site starts doing something new with data (a new provider, a new form), this page changes with it, and the date below moves.

Last updated: 5 August 2026. Questions? pablo@thefireexit.com, or read the terms of use.