Your financial data is yours. Here is how Landfall handles it.

1. We only collect what you give us. You do not need an account to use Landfall; the one optional detail we ask for is an email, and only if you want to sign in and reach your data from any device. Everything else (the accounts, income, expenses, and plans you enter) is stored only because you chose to enter it.
2. We use your data only to provide the service. Your financial information is used to build and show you your own forecast. Nothing else.
3. No passwords, and email used only when necessary. We never store a password. You sign in with a one-time code we email you, and we use your address only to send those codes and the occasional essential service notice, never marketing.
4. Your data is encrypted, in transit and at rest. Your connection is protected with HTTPS, and the figures you enter (your balances and amounts, and the profile and plans that hold them) are encrypted where they are stored, so they stay protected even if the storage or a backup were ever exposed. Our servers build your forecast, so the service can decrypt your figures to do that and nothing else; we have built it so that no one running it has a routine way to browse them: no admin screen, no logs. No system is perfectly secure, so while we protect your data with strong measures, we cannot promise absolute security.
5. We don't track you. No third-party analytics, no advertising trackers, no behavioral profiling.
6. We don't sell or share your data. Your information stays between you and the service. It is never sold or shared for marketing.
7. The providers we rely on see only what they must. To run the hosted service we use a small number of providers, such as cloud hosting and email delivery. Each receives only what it needs to do its job, none are advertisers, and self-hosting avoids them entirely.
8. You can delete everything yourself, anytime. From your account page you can permanently delete your account and all your data immediately, with no "contact us and wait". This deletes the data in every household you own, including any you share with others; when you delete your account you can choose to keep a shared household for its other owners instead. You can also delete or leave individual households, or remove records as you work. Deletion is immediate; we keep encrypted backups only for disaster recovery, for up to 90 days, and never use them to restore a deleted account.
9. You can keep your data on your own machine. Landfall is source-available. For the strongest privacy, run your own private instance, and your data stays entirely on your own machine. Either way, the code is open for anyone to inspect to ensure your data stays yours.
10. It's meant for adults. Landfall is intended for people 18 and older. We do not knowingly collect information from children.
11. We only use necessary cookies. A session cookie keeps you signed in. There are no tracking cookies.

We may update this policy from time to time; any material change will be posted here with a new effective date.