Privacy · effective October 11, 2026
Privacy Policy
This notice describes the included application code. The site owner must confirm that the deployed host, mail service, contact information, and retention practices match it before publication.
01 / FIELD NOTE
Publisher identity and contact
Troilitoidic is the website name. The legal person or business operating the Troilitoidic, its verified public address, and its privacy contact have not been provided for this build. The owner must supply those facts in the site configuration and ensure the displayed About, Contact, and privacy details identify the actual publisher. The site is not an IRS or government website.
02 / FIELD NOTE
Calculator inputs and results
The starting balance, monthly contribution, years, return, inflation assumption, projection, chart, and table are processed by JavaScript in the visitor’s browser. The app code does not send these values to a server, write them to a cookie or local storage, or store them in an application database. The web server still receives a request for the page and assets and may create technical logs under the host’s configuration.
03 / FIELD NOTE
Contact form information
The contact form asks for name, email, topic, and message. The PHP endpoint validates input lengths and email format, rejects oversized requests, checks a session CSRF token and honeypot, and enforces a short per-session cooldown. It sends accepted fields by email to the configured recipient using PHP mail(). The application does not save the message in a database or file. The destination mailbox and its provider may retain a copy; do not send account numbers, tax returns, passwords, or sensitive documents.
04 / FIELD NOTE
Server logs and service providers
The VPS or hosting provider may process IP address, user agent, requested URL, referrer, timestamp, and diagnostic or security data. The site package does not set the host’s logging fields, access permissions, subcontractors, or deletion schedule. The PHP mail transport and recipient email provider process message data to carry and receive it. The owner must identify actual providers and verify retention with them; no retention period is represented here.
05 / FIELD NOTE
Cookies, analytics, and advertising
The contact flow starts a PHP session and may set a first-party session cookie with HttpOnly and SameSite=Lax, and Secure when HTTPS is detected. The session supports the CSRF token and cooldown; its server-side expiry depends on PHP and host configuration. No analytics tag, Google Ads conversion tag, social pixel, third-party font, or advertising cookie is enabled in this package. If any are added, the policy and consent controls must be updated before activation.
06 / FIELD NOTE
Purposes, retention, and security
Contact information is used to route and respond to the inquiry and prevent repeated submissions from a session. The application has no submission database, so it has no application-level message retention schedule. Mailbox retention and server log retention are controlled by the operator and its service providers. The endpoint uses validation, request limits, CSRF protection, a honeypot, and a cooldown; these safeguards cannot guarantee security. The owner should secure the VPS, TLS, PHP sessions, and mail relay.
07 / FIELD NOTE
Privacy choices and state rights
Privacy rights vary by state, the type and amount of information processed, the publisher’s business facts, and the law’s applicability thresholds. The included privacy-choices page explains that no optional advertising or analytics tags are enabled. It does not substitute for an operator’s legally required request process. The owner must provide a verified contact channel, evaluate rights that apply, and implement applicable opt-out signals if the data practices change.
08 / FIELD NOTE
Changes and contact
This policy should be revised when the site adds a tracker, changes hosts or mail providers, changes the contact form, or changes its information practices. For a question or request, use the Contact page and identify the page or issue. A real publisher name, address where required, privacy email, host details, and a working response route must be supplied before public launch.