Your plan stays in your control.

Lantern Retirement Planner is provided by Rivers Edge Software, LLC. We do not operate a financial-data backend, sell your plan data or use advertising or tracking SDKs in the app.

Financial records and encryption

Information you enter or approve is processed in the app. Financial payloads are encrypted before local persistence and before optional CloudKit synchronization. Encryption keys are held in Apple Keychain. We do not receive your financial vault or hold its recovery key. If a required key is unavailable, the app preserves existing encrypted data rather than falling back to plaintext.

Optional private iCloud synchronization

Private iCloud synchronization is enabled by default in production builds and can be turned off for each device in Storage & privacy. Encrypted plan payloads synchronize through your Apple account using CloudKit; encrypted local saving remains available when iCloud is unavailable. Apple operates those services under its own terms and privacy policy. Keychain and account availability affect access across devices. Keep an independent encrypted backup and its password in a safe place.

Optional AI assistance

When you request plan assistance, relevant structured planning information and calculation references may be sent to Apple Private Cloud Compute, subject to supported hardware, service availability and quota. Source statements, account numbers and original documents are not sent. Certain local tasks use Apple's on-device model. Apple describes PCC as processing requests without retaining the data. See Apple's PCC privacy information. No external AI provider is used. AI suggestions require review; deterministic calculations and the written plan work without AI.

Imports, research and provider credentials

Supported statements are processed locally and transiently. Only reviewed fields and sanitized descriptions are retained; original statements are not stored as part of your plan. Optional public research sends public identifiers and date ranges to the selected provider, together with the network information required to deliver the request. It does not send balances, quantities, allocations, transactions or household details.

Tiingo requires your own provider account and token. The token is stored in device-local Keychain, not plan exports or synchronized plan payloads. Provider account terms, privacy practices and licensing apply. Tiingo operates the account you connect under its own terms and privacy policy. Lantern does not install Tiingo cookies or send your household finances to Tiingo. Reviewed research observations may be retained within your encrypted plan cache.

Purchases and diagnostics

Apple processes App Store purchases and subscription billing. The app uses verified StoreKit transactions to determine Pro access and does not receive your payment-card information. There are no advertising SDKs, third-party analytics or developer telemetry services in the app. Apple may process platform diagnostics according to your Apple settings and its own privacy practices.

Reports and encrypted backups

A requested PDF, CSV or XLSX report is a readable export. Protect and share it deliberately. Encrypted backups are separate, password-protected recovery files. You control their destination; we do not receive copies. Forgotten keys and backup passwords cannot be recovered by the developer.

Your controls and deletion

You can edit records, review saved revisions and conflicts, pause synchronization, export backups and permanently delete a plan in Storage & privacy. Deletion queues removal from private CloudKit when connected; offline devices apply it when they synchronize. Separately exported reports, backups and Apple-managed retention are not removed by deleting a plan. Manage those copies separately.

Support and this website

If you choose to contact support, the information you submit is used to respond to your request. Do not include financial documents, secrets or personal plan values. The public website is separate from the app; ordinary web-server request logs may include connection information. This Lantern site uses no analytics or advertising scripts.

General questions and beta access requests go to our support mailbox. Problem reports, feature requests, contact details and optional attachments are stored in our private GitHub support tracker, accessible to authorized maintainers and support automation. We follow up only when requested or about requested beta access. No GitHub account is needed. The contact form uses Cloudflare Turnstile to process technical browser and connection signals for spam protection; it does not receive your message contents. See GitHub’s privacy statement and the Turnstile Privacy Addendum.

The website uses keyed identifiers to limit abuse and prevent duplicate reports; raw connection addresses are not included in issues. Duplicate-detection receipts are normally kept for seven days, while unresolved delivery receipts may remain until reviewed. Image metadata is removed, but visible personal information must be redacted by you. Videos are stored as submitted and may contain audio or metadata. Voluntary support communications are retained as long as reasonably necessary to provide support, improve the app, maintain security and meet legal obligations, then deleted or anonymized. We do not sell them or use them for advertising. Do not attach your financial records or backups. For access, correction or deletion of contact information you submitted, use the general contact form and begin your message with “Lantern privacy request.”

Questions and changes

For privacy questions, use the Rivers Edge Software contact form, choose “General question,” and mention “Lantern privacy.” We will update this page if these practices change. See also Apple's privacy policy and Tiingo's privacy information.