Privacy Policy
Last updated: October 2026 · See also the Terms of Service
Who we are
Hundred Summers (“we”, “us”) is operated by Hundred Summers, Bristol UK. Contact: contact@hundredsummers.co.uk. This policy explains what personal data we hold when you use Hundred Summers and why.
Your financial data stays on your device
This is the most important thing to understand: the financial information you enter into Hundred Summers — your income, pensions, savings, property, expenses and plans — is stored only in your browser on your own device. It is never sent to, or stored on, our servers. We cannot see it. If you clear your browser data or use a different device, it will not be there — and that is by design. The only optional exceptions are the AI Copilot and sharing with your adviser, both described below — nothing leaves your device unless you choose to use them.
Health information
The Longevity tab can ask about smoking, alcohol, exercise, BMI, medical conditions, family history and stress, to help estimate how long your plan should last. UK data-protection law treats this as health information, a special category that needs extra care. Like the rest of your plan, it is stored only on your device, and we never receive it. It is not sent to the AI Copilot, and neither is anything worked out from it, such as your estimated life expectancy. It goes to a financial adviser only if, when you share your plan, you tick the box that names it: that tick is your explicit consent, and even then it travels inside the encrypted copy we cannot read. Leave the box unticked and your adviser sees average-health values in its place. You can change or clear your answers at any time, and none of them is required.
What we do store
To operate your account we store: your email address and your password (held by our authentication provider, Supabase, in hashed form — we never see the password itself); your subscription status (free, premium or adviser); and, if you subscribe, a Stripe customer reference. Payment card details are handled entirely by Stripe and never touch our systems. If you send us a message through the contact form, we store that message and the email address you gave us so we can reply.
Why we store it (lawful basis)
We process this data to perform our contract with you (providing your account and subscription) and to meet our legal obligations (billing and tax records). We do not sell your data or use it for advertising.
Who else is involved
Supabase (authentication and account database), Stripe (payments and billing), and Netlify (website hosting) process data on our behalf under their own security and privacy commitments. Resend delivers our account emails (such as confirmation and password-reset messages) and any message you send through the contact form, so it processes your email address and, for a contact message, whatever you chose to write in it. We never put your financial plan data into an email; a contact message contains only what you typed. If you email contact@hundredsummers.co.uk directly, ImprovMX forwards your message to our mailbox. If you use the AI Copilot, Anthropic (our AI provider) processes the plan summary and questions you send, as described below. Plausible provides cookie-free, aggregate website statistics, as described under Analytics. No other third parties receive your personal data.
The AI Copilot (optional)
The Copilot is off unless you use it, and asks for your consent the first time you do. When you ask it a question, the summary of your plan needed to answer (your figures — deliberately excluding your name and your health information) and your question are sent via our server to Anthropic, our AI provider, for processing. When the Copilot compares options, it asks for each one to be calculated: your device runs it through your plan and sends back only the resulting figures (such as whether spending is covered, net worth and lifetime tax), never the plan itself. The same applies when it searches for an earliest retirement age or the most you could spend, or runs a health what-if: for a health what-if it chooses the ages itself, and is never sent your health answers or anything estimated from them. This may take place outside the UK/EU, safeguarded by Anthropic's data processing terms (including the EU-US Data Privacy Framework with its UK Extension and/or Standard Contractual Clauses). Anthropic retains API data briefly (up to around 30 days) for trust-and-safety purposes only and does not use it to train AI models. We store none of the conversation — only a running total of the processing cost, to operate the monthly usage allowance. If you never use the Copilot, none of this processing occurs.
The planning guide (optional)
The guide that can set up your plan by conversation works on your device: your answers are understood in your browser and saved only into your plan, and are not sent to us or to any AI provider. If you turn on reading aloud, your device's own voice reads its questions. If you choose to answer by speaking, your browser turns your speech into text; we never receive the audio, but some browsers use their maker's servers to do this (Google for Chrome, Apple for Safari), under that maker's privacy terms, and the guide says so before the microphone is first turned on. Typing your answers involves no such processing. We record only that the guide was started or finished, as one of the anonymous usage counts described under Analytics, never what you said.
Sharing with your adviser (optional)
If you choose to share your plan with a financial adviser who uses Hundred Summers, the plan is encrypted on your device to your adviser's key before it is uploaded. Our servers store only the encrypted copy: we cannot decrypt or read it — only your adviser's own device holds the key that can. Sharing happens only after you give explicit consent in the app, sends only the profile you selected, includes the health details from the Longevity tab only if you tick the box that names them, and updates only when you choose to send them. You can stop sharing at any time, which immediately removes the encrypted copy from our servers; any copy your adviser has already opened on their device remains with them, as it would with any document you had given them. Your adviser may keep a passphrase-protected backup of their own portal key on our servers so they can move devices without losing access to shares — that backup is encrypted with a passphrase that never leaves their device, so we cannot decrypt it, or any shared plan, in any circumstance. We keep a minimal audit log (who shared with whom and when — never the content). If you never share, none of this processing occurs.
The projection API (for businesses)
We run a proof-of-concept API that lets businesses we have agreed it with send a plan to our calculation engine and receive the projection back (hundredsummers.co.uk/api.html). It is separate from the app: no member’s plan is sent to it or held by it. A plan sent to the API is processed in memory on Netlify, which hosts it, and the answer is returned; nothing is stored and request bodies are not logged — we record only which key called, the response status and the time taken. Businesses are asked to send no names or contact details, and any names in a plan are removed before it is processed.
Cookies and local storage
Hundred Summers uses your browser's local storage to keep your financial data and app settings on your device, and essential session storage to keep you signed in. We do not use advertising or cross-site tracking cookies.
Analytics
We measure how the website and app are used in two privacy-preserving ways. First, website statistics use Plausible, an EU-hosted, cookie-free analytics service: it records aggregate page views, referral sources and button clicks, sets no cookies, and stores no personal identifiers. Second, the app records anonymous usage events — which tabs are opened and for how long, and simple counts that show whether a feature is used, such as how many life goals a plan holds or whether a goal was added (a number, never what you wrote), and, if you choose to answer it (during setup, or once on a card if you joined before we asked), how you heard about Hundred Summers in your own words (up to 100 characters; email addresses and long numbers are removed on your device before it is sent, and we ask you not to include names or contact details) — in our own database, tagged only with a random session identifier that exists for a single visit and is never linked to your account or email. Neither ever includes your financial data, and we use both solely to understand and improve the product.
How long we keep it
Account data is kept while your account exists. Billing records are retained as required by UK tax law (typically 6 years). Contact-form messages are kept while we need them to answer you and are deleted once the matter is closed. If you delete your account, your email and profile are removed immediately; Stripe billing records are retained only as legally required.
Your rights
Under UK GDPR you can access, correct, or delete your personal data, and complain to the ICO (ico.org.uk). You can delete your account at any time from the profile menu inside the app — this permanently removes your account and cancels any subscription. Remember that the financial data on your device is under your control, not ours: clear it via Your Facts → Clear All Data or your browser settings.
Questions about this document: contact@hundredsummers.co.uk.