PPP privacy

Information PPP keeps

• If you unlock personalized results, the normalized email address or U.S. phone number you choose, a fixed access source and the capture timestamp. Email and phone use separate records and are not treated as a verified identity pair. A phone supplied for access does not authorize or trigger a text.
• If you separately request report email, your email address and email-contact timestamps.
• If you separately request a report text, your mobile number and the time you agreed to that one-time transactional text. Text delivery does not ask for, transmit, store or fingerprint an email address. An older, inactive combined table may contain historic email-and-phone pairs until an approved retention process safely handles them.
• Technical records needed to prevent excessive access requests. PPP derives opaque, expiring counters from the connecting network address but does not store the raw address or user agent.

Results-access security

PPP uses Cloudflare Turnstile to check that an access request is human. Cloudflare processes the challenge under its own privacy terms. PPP transiently uses the connecting network address to derive fixed-window HMAC counters, but does not write the raw address or user agent to its database or link a counter to a contact record. Counter rows contain only opaque keys, counts and expiry times.

Access cookie

After an accepted access request, PPP sets a signed, first-party access cookie for 30 days so the same browser can reopen personalized results without entering a contact again. It contains only a format version, expiry time and signature—not the email, phone, calculator inputs or results. It is a convenience gate, not an account, contact verification or proof of identity.

Calculator and report information

The access request never includes age, service, salary, plan, job class, assumptions, scenarios or results. Those calculator values stay in page memory. PPP processes them on the device to show results and create direct HTML and PDF downloads after access is unlocked. While provider delivery is disabled, PPP does not write those calculator inputs, the selected plan, the report source or the generated pension amounts to its contact or delivery database.

TSP illustration

TSP balance, contribution, service, return, fee, inflation, wage-status and tax-treatment choices stay in component memory. They are not stored, attached to a pension report or sent with report delivery, job alerts, news updates or coalition interest. PPP does not ask for a birth date, account number, fund holdings or exact prior-year wages for this illustration.

Email and text delivery

If activated, an emailed report will include the full estimate in accessible text and HTML plus a PDF attachment. A durable queue will temporarily keep the exact provider-ready report payload in private storage. It will become ineligible for delivery after its 48-hour delivery window and be removed by scheduled cleanup, with an independently configured storage lifecycle as a backstop. The configured email service and your mailbox provider will process that report content. A texted PDF report will use a separate private object and a high-entropy, unlisted link; access ends after 24 hours. The texting provider will process your mobile number and message. Those providers maintain information under their own service and retention terms.

Local campaign and coalition interest

If you separately choose a nonpartisan campaign or coalition category, PPP stores only that category and your affirmative choice in this browser. The choice is not combined with your email or phone, transmitted to PPP or an organization, or treated as enrollment or marketing consent. Actual destinations remain pending an approved organization list and a separate integration.

Planned job-listing updates

PPP’s job-listing request is contact-only. It accepts either one email address or one U.S. mobile number and the minimum consent and suppression records needed to confirm the request and honor unsubscribe or STOP. It does not submit or associate the contact with age, salary, service, plan choice, job class, TSP inputs, scenarios, reports or pension estimates. Matching preferences stay in the browser and are not saved with the contact. Sign-up is not active yet, so no request is currently sent or saved. Public Pension News remains a separate external resource and is not part of this request.

Partner links

PPP links to the National Public Pension Coalition and Public Pension News as clearly labeled external resources. PPP does not add tracking parameters or send calculator inputs or contact details with those links. If you open a partner site, your browser makes a normal request to that site and its privacy practices apply.

No automatic outreach consent

Providing a contact to unlock results, requesting or downloading a report does not join Public Pension News, start job listings, join a campaign or coalition, or authorize marketing, email or texts. Job-listing email and job-listing text each require a separate affirmative choice; email supports unsubscribe and text supports STOP and HELP. Mobile information is not shared with third parties or affiliates for their marketing or promotional purposes. Delivery vendors act only as service providers for the message requested.

Security, retention and activation

Results-access capture fails closed unless its exact origin, bot check, private database, privacy-preserving rate limits and reviewed retention executor are configured. Report delivery uses separate request validation, hashed download tokens and private storage. No contact-retention periods, cleanup schedule or privacy-request address have been approved yet, so production access-contact collection, update sign-up and provider delivery remain unavailable. Update activation also requires verified sender identity, confirmation, email unsubscribe, text STOP/HELP handling and tested suppression controls. Report activation separately requires the durable outbox worker, private-storage lifecycle rules and tested retention jobs.

Planned missing-plan notifications

The missing-plan preview does not send or save a request or collect contact drafts. When activated after a separate privacy and security review, the request will contain only the requested plan name, one email address or U.S. mobile number, and the minimum notification-consent, confirmation and suppression records. Unlike contact-only job updates, this separate purpose associates the contact with the requested plan name. It will not include salary, age, service, union membership, retirement inputs or pension estimates, and will not enroll anyone in other outreach. Plan-name searches currently remain in this page’s memory and are not saved.