In short: your plan never leaves your device without your separate, case-by-case permission. Varallisuuspolku uses no user accounts, no cookies and no advertising or tracking technology. Three features send data only on your own initiative — the share link, Ask AI and the anonymous comparison data — and they are itemised below. This statement covers both the web service (varallisuuspolku.com) and the mobile app. Personal data is processed only in these features and in the server's technical logs, described below. Updated 25 Sep 2026.
What data is processed, and where
All calculation happens on your own device. Your plan (ages, amounts, events, settings) is saved only to your device's own storage — localStorage in the browser, the app's own storage in the app. Data is never transferred to a server, and the service operator has no access to it. The data disappears when you clear the browser's site data or delete the app.
The app's home screen widget reads a device-internal summary written by the app itself — it too stays on the device.
Exceptions — always an action you start yourself, separately
Three actions move data off the device, and each of them happens only at your own initiative:
| Share link | "Copy share link" packs your entire plan into a web address. Anyone with the link can see the plan's contents — share it only with people you want to show it to. The link is never stored on a server. |
| Ask AI (Tulkki) | When you ask a question, the server receives your question, an anonymous form of the plan (no names or identifiers) and the calculation's key figures. The relay server is stateless: it stores neither questions nor answers, and its source code is open. The language model is Anthropic's Claude: the server relays the question to Anthropic's API, and Anthropic keeps the content of API calls for at most 30 days to prevent misuse. The free text of your question is passed on as is — don't write names or other personal data in it. |
| Anonymous comparison data | If you wish, you can share your plan anonymously into the common comparison data. Before sharing you see exactly what is sent: no names, no titles, no IP address; amounts are rounded to two significant figures and the date is stored at month level. The row contains nothing with which the maintainer could link it to you. It does, however, contain your age and the ages of your events, so someone who already knows the details of your plan could in principle recognise it in the raw data — which is why raw data is never published. Only distributions from groups of at least 30 plans are published, and every key figure has its own 30-plan threshold. If you update your share, the new version replaces the previous one and the previous one is deleted. The random identifier needed for replacing it lives only in your browser and contains no device or personal data. The comparison data is backed up daily, encrypted (AES-256), to GitHub Actions, where each copy is kept for 90 days — a deleted or replaced row may therefore remain in a backup for at most 90 days. The receiving server code is open source. |
Server technical logs. The server for Tulkki and the comparison data runs on the Railway platform. The server's own code keeps the IP address only in memory to limit request rates and does not store it. The platform does, however, record a technical log line for every request (time, path, IP address and browser user agent), kept for 7 days. No questions or plan contents are stored in the log.
Visitor measurement (web service only)
Website visitor counts are measured with Plausible analytics, which is cookie-free and does not identify visitors. It counts page views and a few named usage events (for example "onboarding complete", "comparison", "plan exported") without the plan's numbers or content. The mobile app has no analytics at all: the app collects no data.
The app's optional features
Reminders are scheduled on the device (nothing is sent), the app lock uses the device's own authentication (Face ID / fingerprint — biometric data never leaves the device's secure environment and the app never sees it), and actuals entries are stored on the device only. All of these are off or empty by default.
Data controller, your rights and contact
Data controller: Olavi Kurola, info@varallisuuspolku.com.
Your plans stay on your own device and you can delete them yourself (clearing the browser's site data or removing the app). On the server, personal data is processed only as described above: Tulkki questions while they are relayed (at Anthropic for at most 30 days), IP addresses in the platform's technical logs for 7 days, and shared comparison rows. The comparison data and Tulkki are based on your consent, as you start them yourself; the technical logs and rate limiting are based on legitimate interest, namely the security of the service. The service providers (Railway, Anthropic, GitHub) operate in the United States.
Comparison rows are pseudonymous: they carry no identifier with which the maintainer could find your particular row, so showing or deleting a row on request is not possible. You can replace your own row by sharing an updated plan from the same browser. You have the right to lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi). Questions about privacy: info@varallisuuspolku.com.
The service's source code is open: GitHub. Calculation assumptions and a description of the service: the front page's About the service section.
Varallisuuspolku is an indicative illustration tool, not investment advice. Varallisuuspolku — all planning happens on your own device.