Privacy Policy
Last updated: October 27, 2026.
This policy explains what Durendo collects, why, who else touches it, and what you can do about it. Durendo is operated by Hagegard LLC, a California limited liability company doing business as Durendo. It covers durendo.com and the Durendo application.
How to read this document. Each section starts with a short In plain words box summarizing its main points. The text after the box is the operative policy.
The short version
In plain words We collect what we need to run your plan and your account. We do not sell your data, we do not use your financial data to train AI models, and we do not run ad trackers. Your plan data is encrypted, and you can export or delete it any time from the app. Optional usage tracking helps us improve Durendo, and you can turn it off in Settings. If paid plans are introduced, billing records will be retained as long as required by law.
We collect what is needed to operate your financial plan and your account. We do not sell your personal information or share it for cross-context behavioral advertising. Service providers process information needed to operate Durendo, as described below. We do not use your financial data to train AI models, and we only use AI services under terms that prohibit them from doing so. We do not use your financial data for advertising. You can export your plan data or delete your account at any time from the app. If paid plans are introduced, billing records will be retained separately for as long as required by law.
What we collect
In plain words Your email and login (through our sign-in provider), the financial figures you type in, operational records, and anything you send us in a support message. If paid plans are introduced, our payment processor will handle card details; we will not see the full card number. Optional usage records describe actions in the app, without your financial figures.
Account information. When you sign up, our authentication provider collects your email address and manages your login credentials. We never see or store your password. Access to the private beta requires an invitation.
Early-access requests and invitations. If you ask for early access, or we invite you, we keep your name, your email address and anything you wrote to us so we can send your invitation and emails that help you set up and use Durendo. This applies even before you create an account. You can ask us to stop emailing you, or to delete this information, at any time by writing to hello@durendo.com.
Plan data. The financial information you enter to build your retirement plan: ages, account balances, account types, spending categories, income sources, and the assumptions you set or accept (return expectations, retirement age, Social Security claiming age, and similar). This is the data the product exists to analyze. Durendo does not require your name, your account numbers, or your financial institutions in order to work, unless you choose to link an account.
Linked accounts (optional, when available). If you link a financial account, we receive the balances, holdings and account details you approve through our account-connection partner. We treat them like the rest of your plan data: encrypted, not sold, and not used for advertising or to train AI models. When you unlink an account, we stop retrieving its data and delete the data that link brought in within 30 days, except what you have already kept in your plan.
AI features (when available). If you use a feature that answers questions with AI, we send your question and only the parts of your plan needed to answer it to an AI service provider, never your name or email address, under terms that prohibit the provider from using it to train AI models. We keep the conversation for 90 days unless you choose to save it, and you can delete it at any time.
Operational records. Operational logs record requests, errors and account events to help keep Durendo working. Feedback includes the screen you were using. Your financial figures are not added to feedback automatically.
Account support milestones. We keep a small set of account milestones that support needs, such as first and last foreground app activity, the number of plans you own, setup progress, the first result made available and the number of feedback messages. Foreground activity means using the app, not background polling or a sign-in record. These milestones help authorized administrators support your account. They remain necessary account records even when optional usage tracking is off. Where earlier history is unknown, a milestone records what we first observed after tracking began.
Optional usage tracking. To understand how Durendo is used and improve it for you, we record how you use its features: for example, screens and help items opened, edits started or saved, analyses started, answered or applied, reports opened or printed, how long steps take, errors, and optional ratings and check-in scores. These records use a separate identifier linked to your account; they are not anonymous. They never contain balances, amounts, financial assumptions, plan names, saved question answers, support message text or screenshots. They stay in Durendo’s own database; we do not send them to an outside analytics service or advertising network. Authorized administrators see feature reports as totals, with groups of fewer than five people hidden.
In Settings > Privacy, you can turn off Share how I use Durendo. That stops new optional records from both the browser and our servers, including rating and check-in analytics and their prompts. It does not erase records already stored. Ordinary voluntary Feedback remains available, and necessary account support milestones continue. We do not record a sign-in history or use your financial figures to infer which features apply to your plan.
Website requests. Visiting the website sends technical information, including your IP address and browser information, to the services delivering the page and its resources. These requests do not include your financial plan. Sign-in uses necessary session information to keep your account authenticated; optional app usage tracking is separate.
Payment information. If paid plans are introduced and you purchase one, our payment processor collects and stores your card details directly. We never see or store your full card number. We keep a record of what you were charged and when.
Support and feedback. If you email us or use the in-app feedback form, we keep that correspondence so we can help you and improve the product. The feedback form attaches the screen or route you were on, never your plan’s financial values. If you paste figures or a screenshot into a support message, we will have those too, so include only information you are comfortable sharing with support. Authorized support staff can read what you choose to send. Messages sent to hello@durendo.com are forwarded to the owner’s support inbox. Support may use AI tools to help sort feedback. Before feedback text is sent to those tools, we remove account identifiers and filter recognized names, email addresses and phone numbers. This does not make the text anonymous: details you include may still identify you or contain financial information. Those tools do not receive screenshots, and the AI-training restrictions described above apply to financial information in feedback as well.
How we use it
In plain words To run your plan, keep your account working and secure, fix bugs, respond to support requests, tell you about Durendo, and improve the app using optional action records you can turn off. If paid plans are introduced, we will also process payments.
We use your information only to provide, secure, debug, support, and improve Durendo; to process payments and send transactional and legally required notices such as renewal reminders; to email you about Durendo itself, such as new features, changes to the service and tips for getting started; and to comply with law. Emails about Durendo itself include an unsubscribe link. Unsubscribing does not stop emails about your account, security or billing. We choose which of these emails is relevant to you from how you have used Durendo, such as whether you have finished setup, never from the numbers in your plan. We do not use your plan data or financial assumptions for advertising, unrelated profiling, credit decisions, or sale to third parties.
What we do not do
In plain words We do not sell your data, use advertising trackers, train AI models on your financial data, or analyze your financial figures in aggregate. No tool lets Durendo staff open your financial plan. Staff can read messages and screenshots you choose to send to support; your financial data is not attached automatically.
- We do not sell, rent or trade your personal or financial information. We do not share it for cross-context behavioral advertising, including “sharing” as defined under the California Consumer Privacy Act.
- We do not run advertising trackers and we do not disclose your data to ad networks.
- We do not use your financial data to train AI models, and we only use AI services under terms that prohibit them from doing so.
- We do not analyze your financial data in aggregate. Operational records help us keep the service working. Optional usage tracking records fixed app actions, including screens opened, and can be turned off as described above.
- There is no tool that lets Durendo staff open your financial plan, and multiple safeguards stand in the way. If you choose to send financial information or screenshots to support, staff can read that submitted material. A support request does not give staff access to your plan.
How we protect your data
In plain words Your plan is encrypted in transit and at rest, with a key unique to your account. Access is restricted to your account and permissions you have granted. There is no admin screen showing your numbers, and we have multiple safeguards against anyone at Durendo reading your plan. If your data is ever caught in a breach, we email you.
Your plan is yours. Durendo’s own tools are built so that no one but you can read your financial data, not even Durendo staff.
Your plan data is encrypted at rest using envelope encryption: your data is encrypted with a key unique to your account, and that key is itself encrypted before storage. All connections use TLS. Access to your data is scoped to your account and permissions you have granted. There is no administrative view of your plan’s financial values in day-to-day operation.
Authorized administrators can see basic account information (your email address, your name, your access level and recent authenticated account activity) and how features are used, such as which screens were opened. No administrative screen shows your balances, amounts or plan details, and there is no feature that lets anyone at Durendo view the app as you. The account activity timestamp is updated when authenticated requests are made; it is not a record of individual sign-ins.
Access to the systems that hold your data is limited to the people who need it and protected by two-step sign-in, and we have multiple safeguards in place against anyone at Durendo reading your plan.
If we discover a security incident affecting your data, we will email you promptly – as the law requires, and whether or not it technically requires it in a given case. Report a suspected vulnerability or incident to hello@durendo.com.
Subprocessors: who else touches your data, and why
In plain words Service providers help run your account, store your plan and handle support messages. The table below explains what each receives.
| Provider role | What it does | What it receives |
|---|---|---|
| Database host | Stores the database. | Your encrypted plan data at rest, account support milestones and optional action records. |
| Backup storage provider | Stores encrypted off-site copies of the database. | Encrypted database backups. They are encrypted before upload with a key the provider does not hold. |
| Application host | Runs the app. | Your requests as they are processed. |
| Sign-in provider | Handles sign-in. | Your email address and login session; never your plan data. |
| Website hosting and delivery services | Deliver the public website. | Website requests, including IP address and browser information; not your financial plan. |
| Account-connection partner (only if you link an account) | Connects to your financial institution with your permission. | Your institution sign-in, handled by the partner and never by Durendo, and the account information you approve sharing. |
| AI service provider (only if you use an AI feature) | Generates answers to your questions. | Your question and the plan information needed to answer it; never your name or email address. Not used to train AI models. |
| Market-data provider (only when investment features are available) | Supplies prices and fund information. | The fund and security identifiers we look up; never your name, email address or plan data. |
| Payment processor | Processes payments when paid memberships open. | Your billing and payment details; never your plan data. |
| Email delivery service | Sends Durendo’s emails to you: invitations, account and security emails, and emails about Durendo. | Your name and email address, the content of each email, and its delivery status (for example delivered, bounced or unsubscribed); never your plan data. |
| Email forwarding service | Routes messages sent to hello@durendo.com to the owner. | Messages and attachments you send by email. |
| Support mailbox provider | Stores support messages and replies. | Messages and attachments you send by email, and our replies. |
| Feedback review tools | Help support sort feedback. | Feedback text after account identifiers and recognized names, email addresses and phone numbers are removed. Text may still contain identifying or financial details; never screenshots. Use remains subject to our AI-training restrictions. |
| Health insurance price lookup (the U.S. government’s HealthCare.gov Marketplace service, run by CMS) | Returns Marketplace plan prices when you ask for a health insurance estimate. | Your ZIP code, state and county, the plan year, and the ages, tobacco use and relationships of the people to be covered; never names, income, balances or other plan data. |
Your plan data is stored in the United States. Email and other service providers may process information through global networks. If we add or change a subprocessor in a way that changes what data it sees, we will update this page, and a material change is presented for your acceptance the next time you sign in.
We may disclose information where required by law. If the business is transferred, any successor must assume our obligations, including our privacy commitments, as provided in the Terms. Neither circumstance gives staff a new way to open your financial plan.
Data retention
In plain words We keep your plan while your account is open. Delete your account and it is gone from the live database straight away, out of the database provider’s recovery history within 7 days, and out of our encrypted off-site backups within 30 days. Billing records stay for as long as tax law requires, usually seven years. Support content is kept for 12 months after a case closes, then manually reviewed for removal; deletion is not automatic.
Your plan data is retained for as long as your account is active. If you delete your account, your plan data is deleted from our primary database immediately. Backup copies then expire on a fixed schedule, in two layers: it leaves the point-in-time recovery history our database provider keeps within 7 days, and it leaves the encrypted off-site database backups we keep with a separate provider within 30 days. After 30 days no backup copy of your plan data remains. The encrypted copy of your account-specific encryption key is removed from the live database with your account. Older database backups may contain the encrypted key as well as encrypted plan data until those backups expire under the schedule above.
Billing records are retained separately for as long as tax and accounting law requires, typically seven years, independent of your account status.
Account support milestones remain while your account exists. Foreground activity by UTC day is retained for 30 days. Optional action records and derived usage totals are retained for up to 13 calendar months. Turning optional tracking off stops new collection. Account deletion deletes your support milestones and detaches your retained action records from you: they are kept, until they expire on the schedule above, under a new random identifier that is not linked to any account, so retained totals continue to count them. Our account export includes your own retained action records and support milestones.
Other operational records are retained for as long as they are useful for debugging and support. Support messages, screenshots and related email are kept for 12 months after the case closes, then manually reviewed for removal. They are not automatically deleted at 12 months. When you delete your account, feedback linked to your account has its messages and contact details cleared and its screenshots removed from Durendo’s live database. Support case status, billing records and audit references are retained for support, security and accounting; separately held support email follows the support retention policy above.
Your rights
In plain words Export your plan, delete your account, or ask us what we hold on you. All three work no matter where you live. Export gives you a copy of your data, not a restore file.
At any time you can:
- Export your account data, including your plan data, retained optional usage records and account support milestones, from the app in a machine-readable format. An export is a copy of your data for your own use; it is not a full backup and not a restore mechanism.
- Turn off optional usage tracking with Share how I use Durendo in Settings > Privacy. Necessary account support milestones and ordinary voluntary Feedback remain available.
- Delete your account and its data from the app. If you have a paid subscription, it is canceled first, so you are never billed for an account that no longer exists. Your support milestones are deleted, and your retained usage records are detached from you and kept only under a random identifier that is not linked to your account, so retained totals still count them.
- Ask what we hold about you, or ask us to correct it, by emailing hello@durendo.com. We respond within 45 days, and usually much sooner.
- Complain to us at hello@durendo.com or to an appropriate privacy regulator. California residents may contact the California Privacy Protection Agency or the Attorney General. You do not need to contact us first.
We will not discriminate against you for exercising any of these rights.
A note on California privacy law
In plain words We offer the access, correction, export and deletion options above to every user, regardless of where you live or which privacy laws apply.
The rights described above are available to every user. Nothing in this policy limits rights or protections you have under applicable privacy law. We treat your financial information as private and limit its use to the purposes described in this policy.
Children’s privacy
In plain words Durendo accounts are for adults. An adult’s household plan may include information about children or other dependents.
Durendo is not directed to, and is not intended for use by, anyone under 18. Adults may enter information about children or dependents as part of their household planning. We protect that information under this policy. If we learn that someone under 18 has created an account, we will take steps to close it and handle its data under the retention and deletion provisions above and applicable law.
International use
In plain words Durendo is operated from the United States and models US retirement, tax and account rules. Your plan data is stored in the United States. Other service providers may process information in other countries.
Access is currently by invitation. If you use Durendo from outside the United States, consider whether its US planning rules fit your situation. Your plan data is stored in the United States; email and other service providers may process information through global networks. Nothing in this policy limits protections that apply to you under applicable law.
Changes to this policy
In plain words If we change something that matters, we update this page and ask you to accept the change the next time you sign in.
If we make a material change to this policy, we will post the update here with a new “Last updated” date and ask you to review and accept it the next time you sign in. Where required by applicable law, we will obtain consent before using previously collected information in a materially different way. Updating this policy does not by itself authorize such a change. Changes requiring revised Terms follow section 16 of the Terms of Service.
Contact
Hagegard LLC d/b/a Durendo, 914 Valley Crest Street, La Cañada Flintridge, CA 91011. Questions about this policy, or a request about your data: hello@durendo.com.
Durendo is educational retirement planning software, not financial, investment, tax or legal advice. See our Not Financial Advice disclosure.