Privacy policy

Landfall is published by RMPF Consulting Ltd, company number NI727300, of 20 Maxwell Road, Bangor, County Down, BT20 3SQ. We are the data controller for anything this policy covers. Write to support@landfall.money.

There is no account. The apps send nothing to us unless you write us a note from Settings, and then only the note.

• Your plans are stored on the device you made them on.
• iCloud Drive, or OneDrive on Windows, is used only if you switch it on, and then only between your own devices.
• Purchases are handled by Apple, or by Microsoft on Windows. We never see your name, your address or your card.
• A note you send us from the app carries the note, a rating, the app version and an anonymous installation code. Nothing from a plan.
• There is no advertising and no tracking in the apps or on this site.
• This site counts searches of its help. It keeps no IP address, no cookie and no way to link a search to you.
• The pension calculator sends the figures you type to our server to work them out and sends the answer straight back. It keeps none of them.

A plan holds what you type into it: the people in your household, their dates of birth, what they earn, hold and expect to spend, and your notes. It is stored in the app’s own container on your iPhone, iPad or Mac, or in its own folder on your Windows PC.

Nothing in a plan leaves your device unless you send it somewhere. Exporting a plan writes a file that is yours to keep, share or delete.

When your iPhone or iPad backs itself up, to iCloud or to a computer, your plans go into that backup like any other app’s data. The backup is yours, under your Apple Account or on your own computer, and we have no access to it.

Deleting a plan in the app removes it from that device. Deleting the app removes every plan on that device.

With Landfall + you can mirror your plans to your own iCloud Drive, so the same plans open on every device signed in to your Apple Account. It is off until you switch it on.

iCloud is Apple’s service, under your Apple Account and Apple’s privacy policy. We have no access to your iCloud Drive and no copy of what is in it.

With Landfall + on Windows you can mirror your plans to your own OneDrive, in a folder of Landfall’s own, so the same plans open on each Windows PC signed in to your Microsoft account. It is off until you switch it on.

OneDrive is Microsoft’s service, under your Microsoft account and Microsoft’s privacy statement. Landfall signs in to Microsoft in your browser. It asks only for its own folder, and for your name and email address so it can show which account is signed in. Both stay on your computer. We have no access to your OneDrive, no copy of what is in it, and no record of your sign-in.

Plans go to your OneDrive only after you choose OneDrive in Settings and answer yes to the question that follows. They keep going only while that choice stands. Switching back to this device, or signing out, stops it. We ask because a plan holds financial details about you and your household.

On iPhone, iPad and Mac, Landfall + is bought through the App Store. Apple takes the payment and holds your billing details. Your subscription, its renewal and its cancellation are managed in your Apple Account settings.

On Windows, it is bought through the Microsoft Store. Microsoft takes the payment and holds your billing details, and the subscription is managed in your Microsoft account.

Either way, the app learns only whether a subscription is active and when it ends, so it can open the features you paid for.

If you turn the lock on, the app asks your device to confirm it is you before showing your plans. On iPhone, iPad and Mac that is Face ID, Touch ID or your password. On Windows it is Windows Hello. The check is done by the device. Landfall never sees your face, your fingerprint, your PIN or your password.

If your iPhone, iPad or Mac is set to share diagnostics with app developers, Apple may send us a report when the app crashes. It describes what the app was doing and names no person and no plan. You can change that setting on your device at any time.

On Windows, Microsoft may show us a report of a crash, depending on your PC’s privacy settings. It gives the device model, the Windows version and what the app was doing, and names no person and no plan.

Settings has a form for telling us what you like, what you would like to see, or what looks wrong. Nothing is sent until you tap Send, and nothing is sent at any other time.

A note carries what you typed, your star rating, the app and its version, whether you have Landfall +, and the time. It also carries an installation code. The code is a random number the app makes the first time you open the form. It is not linked to you, your Apple or Microsoft account, your purchase or your plans, and clearing the app’s data makes a new one. It lets us count notes from one installation and ignore a flood.

A note never carries anything from a plan unless you type it. We keep notes for ninety days and read them to decide what to build. We cannot reply to each one, and the form says so.

Cloudflare receives the note on our behalf and keeps its usual short-lived request logs. We keep no IP address with a note.

A copy of each note is posted to our Slack workspace, where we read it. Slack holds that copy under its own privacy policy.

If you email support@landfall.money, we keep the correspondence so we can answer you, fix what you report, and see earlier messages if you write again.

That is our legitimate interest, and it is the lawful basis we rely on.

We keep an email for 24 months after the question it raised is resolved, then delete it. We keep it longer only while a dispute about it is open or the law requires it. We do not add you to a list.

This site is a set of static pages. We set no cookies.

When you search the help, we count the words searched for, how many topics they found and which one you opened.

A search holding a number, a currency sign or an @ is counted without its words, so your own figures and email addresses are never kept.

The count carries no IP address and no cookie, so nothing links a search to you, and Cloudflare deletes it after three months.

If your browser sends Global Privacy Control, nothing is counted.

Cloudflare serves this site. It keeps short-lived logs of requests to protect the site. It sets a cookie only if it has to check that a visitor is a person, as it may during an attack. The cookie remembers that the check was passed. Cloudflare’s privacy policy describes both.

Microsoft 365 holds our email. Cloudflare serves this site, receives notes sent from the apps, and keeps its request logs. Slack holds a copy of each note. Apple, and Microsoft on Windows, take payment for Landfall + and may pass us crash reports. Microsoft also holds your OneDrive, under your own account, if you mirror your plans to it.

Each follows its own privacy policy, and Apple, Microsoft, Cloudflare and Slack keep their own records of what they handle.

Microsoft stores our mailbox in the UK or the European Union. UK data protection law approves transfers to the European Economic Area, which includes the European Union.

If Microsoft handles it in the United States, it relies on the UK Extension to the EU–US Data Privacy Framework, and otherwise on standard contractual clauses.

Cloudflare may move the site’s request logs to the United States. For that it relies on the UK Extension to the EU–US Data Privacy Framework, and on standard contractual clauses if that ever lapses.

Apple Distribution International, in Ireland, controls Apple’s handling of data from the UK, and Apple uses standard contractual clauses for any transfer beyond it.

Microsoft Corporation and Microsoft Ireland Operations Limited control Microsoft’s handling of a Windows purchase or crash report from the UK. Microsoft relies on the UK Extension to the EU–US Data Privacy Framework, and on standard contractual clauses.

Landfall is about retirement and is not aimed at children. We knowingly collect nothing from anyone under eighteen.

Under UK data protection law you can ask what personal data we hold about you, ask for it to be corrected or deleted, and object to how it is used. Because the apps keep nothing about you, the answer will usually be that we hold only any email you sent us.

Write to support@landfall.money with any request. You can also complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.

If the apps or this site start to do something this page does not describe, the page changes first and the date at the top moves. The current version is always at this address.