FreeQDRO
Privacy Policy
Last updated 2026-10-11
FreeQDRO is built on a simple promise: the tools are free, and we do not make money from your data. There are no ad networks, no advertising trackers, no data brokers, and we never sell or share your personal information. Where an account saves your work, the case data is encrypted in your browser so that even we cannot read it. This policy says exactly what we do and don’t collect, what we store, and what we cannot access.
Your calculations stay in your browser
The calculators run entirely on your device. The numbers you enter - incomes, custody details, account balances - are processed locally in your browser to produce the result. They are not sent to our servers, not logged, and not stored.
What an account stores
If you create a free account, we store your email address, a verification of your password - a value derived from your password in your browser (never the password itself), which we hash again on our servers - whether the email has been confirmed, and the version and time of your acceptance of the Terms of Service. To support encrypted matters we also store the public salt used to derive your keys, your data key wrapped under your password and again under your recovery key, and a one-way verifier that lets us confirm a recovery-key reset without being able to read anything; none of these lets us decrypt your matters. Accounts created before matters shipped hold a bcrypt hash of the password instead and move to this scheme at their next sign-in. We use your email solely to let you sign in and to send account and security notices. We do not email you marketing. When the account is created we also record the request that created it: the IP address, the country it resolved to, the browser and device type, the browser language, and the page that referred you, and on each sign-in the time, IP address, country and device of that sign-in (only the most recent one is kept). We keep these to investigate abuse (automated sign-ups were the reason) and to answer support requests; they are not used for advertising or profiling, are not shared, and are deleted with the account.
Cookies
We set one cookie of our own: a signed, http-only session cookie after you sign in, so you stay logged in. It is not used for tracking or advertising. When the traffic measurement described next is running, Google Analytics sets its own cookies to tell a returning browser from a new one. We use no advertising cookies.
Traffic measurement
We use Google Analytics 4 to count visits and see which tools get used, in aggregate. Google signals, advertising features, and ad personalization are turned off, Google Analytics 4 does not log or store IP addresses, and nothing about your account, your matters, or the figures you type is sent to it. If your browser sends a Do Not Track header or a Global Privacy Control signal, the analytics script is not loaded at all: no request, no cookie. We run no advertising pixels, session recorders, or other third-party scripts. Standard server logs may briefly record request metadata (such as IP address) for security and reliability; these are not used to profile you and are not shared.
Document preparation is ephemeral
When a tool assembles a document for you (such as the retirement-order preparer), your answers are sent once, over an encrypted connection, to our document generator. The generator builds the document in memory, streams the file straight back to your browser, and keeps nothing: no saved documents, no database record, no content in any log. When your download finishes, the information no longer exists on our side - and it is never used to train anything. The one exception is a packet you choose to save to a matter, described under Client matters below: that copy is encrypted in your browser before it is stored.
Social Security numbers
Most orders the preparer drafts take the parties’ Social Security numbers under separate cover or on a page that is never filed, and the preparer does not ask for them. Twenty-one state retirement-system families, on the attorney path only, require the complete numbers on their own paper, and for those the preparer asks: the New Jersey NJSEDCP order’s Confidential Addendum (N.J. Court Rule 1:38-7(e)); a Massachusetts G.L. c. 32 order when counsel elects to place them in the impounded filing (Probate and Family Court Standing Order 3-08) or on its separate identifier page; the Tennessee TCRS form TR-0466 or its TR-0467 affidavits (Tenn. Comp. R. & Regs. 1700-03-03); the South Carolina PEBA orders’ never-filed Identifying Information Addendum (Rule 41.2(a)(1), SCRCP; the model’s footnote 3); the Connecticut SERS and TRB orders’ never-filed Practice Book 4-7 addendum; the Maryland State Retirement Agency and Anne Arundel County orders’ never-filed transmittal or cover letter (COMAR 22.01.03.03C) and the MCPS orders’ Rule 20-201.1 shielded copy (the docketed copy is redacted under Rule 1-322.1(d)); the Oklahoma OPERS, URSJJ and TRS packets’ separate-cover CONFIDENTIAL member (and the TRS Recital D lines on the on-order route); the face of the Delaware Office of Pensions PENSION ALLOCATION ORDER (FCCR 101(c); Rule 90.1(c)); the Iowa IPERS Confidential Information form, a separate never-filed PDF to IPERS only (495 IAC 16.2(2)a(1)); the Nebraska NPERS packets’ Appendix 3 submitted as a confidential submission (Neb. Ct. R. 2-210; 6-1521(C)) and the NPERS confidential addendum, never in the filed order; West Virginia CPRB packets (wv-pers, wv-trs, wv-tdc, wv-state-police-a, wv-state-police-b, wv-dsrs, wv-jrs, wv-emsrs, wv-mpfrs): the Board’s forms require both parties’ full Social Security numbers and birth dates; they are printed only on the form copies (last four on the public copy; full on the copy filed under seal under W. Va. Code 48-1-303(c)), never on the motion, the notes or a header, processed in memory and never stored; the District of Columbia DCRB orders’ never-filed confidential transmittal to the DCRB Member Services Center (SCR-Dom. Rel. 5.2(a) bars the number from the filing; the year of birth only in the order); the Rhode Island ERSRI orders’ NON-PUBLIC unredacted copy for ERSRI Legal (Art. X Rule 8(b)(2); the public copy prints XXX-XX- and the last four); the Maine MainePERS NONPUBLIC order, where 5 M.R.S. 17059(4)(A) requires the complete numbers in paragraphs 2-3, and the PC-200 filed per party (M.R.E.C.S. 4(E)(3)(a), 7(D)(6), 38(B)(1)); the Hawaii ERS-302 page inside the pinned ERS-300 / ERS-301 bundle, mailed to the System and never filed, and the ERS-303 (the filed pages carry the last four - HCRR 2.19); the North Dakota NDPERS, HPRS and TFFR orders’ Appendix H Rule 3.4 Confidential Information Form, filed with the order and confidential under N.D.R.Ct. 3.4(d)(1) (the order prints XXX-XX-#### and the birth year unless the parties elect the 3.4(e)(1) waiver); the South Dakota UJS-104 Confidential Information Form as a separate confidential filing (SDCL 15-15A-9(1); no South Dakota order text carries any portion of a number); the Alaska DRB packets’ CONFIDENTIAL ORIGINAL (the redacted duplicate, the only copy in the public file, prints XXX-XX-XXXX - Civil Rule 90.1(g)); the Montana TRS Family Law Order forms and the MPERA Family Law Orders, whose page 2 identifiers TRS and MPERA require and the court seals on the unopposed motion; the Vermont VSERS, VSTRS and VMERS orders, which 3 V.S.A. 476a(c)(1) requires to state the numbers on the order’s face - rendered twice, a PUBLIC copy with the last four and a COMPLETE copy for the Retirement Division (V.R.P.A.C.R. 6(b)(14)); and Wyoming WRS packets (wy-wrs-public-employee, wy-wrs-law-enforcement, wy-wrs-state-firefighter, wy-wrs-warden-patrol-dci, wy-wrs-judicial, wy-wrs-paid-fire-b) and the wy-wrs-457 order: the Retirement Board’s Chapter 6 requires both parties’ full Social Security numbers and birth dates in the order the System receives; they are printed only on the copy filed under seal and mailed to the System (the filed copy shows the last four digits and the year of birth under W.R.C.P. 5.2 and Access Rule 7(b)); the numbers are not stored. No Kansas, Alabama, Arkansas, Indiana, New Hampshire, Mississippi or Kentucky output carries a number. A Social Security number typed into any other field is refused, not printed. The document generator handles them exactly like every other drafting answer: sent once over an encrypted connection, placed into the document in memory, and never stored, logged, or written into the counsel notes or the download headers by the generator. When you save the packet to a matter, the numbers are stored inside that matter’s client-side encrypted container together with the rest of your answers - decryptable only with your password or recovery key, never readable by the site, and never in headers, notes, or logs - so the order can be regenerated or amended without retyping them. If the preparer is not attached to a matter, nothing is retained after the download.
Document review has two layers, one of them on our server
The QDRO review tool (the Scrutinizer) parses your file in your browser and runs its checklist layer entirely there. The deeper, AI-assisted layer runs by default for signed-in, verified reviews: the document text is sent once, over an encrypted connection, to our server, which passes it to an AI model run by a third-party provider to produce additional findings. We do not store or log the document text. The findings appear on screen; our server holds them in memory for no more than fifteen minutes so that your browser can collect them and so that re-running the same document does not repeat the model call, then discards them. The deeper layer is capped in size and rate limited. To keep a document on your device entirely, check “Skip the deeper review for this document” before running; the choice is remembered in your browser, and with it checked nothing about the document leaves the page.
Client matters
A matter holds a case’s caption and the preparer’s saved answers - the plan, the elections, and the parties’ details - so that returning to a case starts from the saved answers rather than a blank form. Everything in a matter is encrypted in your browser with a key derived from your password that is never sent to us. We receive and store only the resulting ciphertext, plus a copy of your data key that is itself wrapped by that password-derived key (also unreadable to us). We cannot decrypt your matters, produce their contents in response to a subpoena, or mine them, because we do not hold the key. What we can see is that an account has matters, how many, their size, and when each was last saved. Changing your password re-wraps the key without touching your data. A one-time recovery key, shown once when your vault is created (at signup, or at the first sign-in after matters shipped), is the only way to keep your matters after a forgotten password. Resetting the password by email code gets you back into the account, but the matters it held are deleted, because nothing can decrypt them. If you lose both your password and your recovery key, your saved matters cannot be recovered - by us or by anyone - by design. You can delete any matter yourself, and deleting your account deletes all of them.
Your choices
You can delete any matter, or your entire account, at any time from your account page. Deleting your account removes your account record and every matter’s ciphertext; it is immediate and cannot be undone. An export of your matters to a readable file will be offered from the account page when available; until then, download the documents you generate and keep your own copy of anything you cannot afford to lose. You do not need to contact us to delete anything, though the contact form works if you prefer.
Contact
Privacy questions? Use our contact form. Deleting your account no longer requires a request: it is done from your account page.
Changes
If this policy changes, we’ll update the date above and describe what changed here. 2026-10-11: the account section now says that the sign-up request’s IP address, country, browser and device type, language and referring page are recorded with the account, as are the time, IP, country and device of the most recent sign-in, why, and that they are deleted with it. 2026-09-22: the preparer’s own retention sentence, shown before you start, now matches this page (the generator keeps nothing; the complete answer set is retained only if you save the packet to a matter, inside that matter’s encrypted container); the twenty-one families’ complete numbers are asked on the attorney path only. 2026-09-21 (the sixth tranche): the preparer now covers all fifty states and the District of Columbia, and the Social Security numbers section grows from three to twenty-one retirement-system families whose own paper requires the complete numbers - South Carolina PEBA, Connecticut SERS / TRB, Maryland SRA / Anne Arundel County / MCPS, Oklahoma OPERS / URSJJ / TRS, the Delaware Office of Pensions, Iowa IPERS, Nebraska NPERS, West Virginia CPRB, the District of Columbia DCRB, Rhode Island ERSRI, Maine MainePERS, Hawaii ERS, North Dakota NDPERS / HPRS / TFFR, South Dakota (UJS-104), the Alaska DRB, Montana TRS / MPERA, the Vermont Treasurer’s systems and Wyoming WRS - each on the attorney path, each on a never-filed, sealed, confidential or system-only page as that state’s rules provide, processed in memory by the generator and retained only inside a client matter’s encrypted container when you save one. 2026-09-21 (later the same day): freeqdro.com now offers encrypted client matters, and this page adds the Client matters and Your choices sections and rewrites the account and Social Security numbers sections to match. The earlier 2026-09-21 entry’s statement that FreeQDRO has no place to keep the numbers is withdrawn: when a preparer packet is saved to a matter, the complete answer set, the numbers included, is kept inside the matter’s client-side encrypted container so the order can be regenerated or amended. The generator itself still processes them in memory only, and an unattached packet retains nothing. Account deletion is now self-service from the account page. 2026-09-21: the Social Security numbers section now states plainly that FreeQDRO does not retain the numbers (there is no account vault here) and points attorneys who need retention to F-Law’s encrypted matters. 2026-09-20: added the Social Security numbers section - the preparer now asks for the complete numbers on three state retirement-system orders whose own paper requires them (New Jersey NJSEDCP, Massachusetts c. 32, Tennessee TCRS; eighteen more families joined on 2026-09-21, see above), on the attorney path, processed in memory and never stored; every other order still takes them under separate cover. 2026-09-18: the account now records the version and time of your acceptance of the Terms of Service and whether your email is confirmed; the review section names the AI model as run by a third-party provider; the child support calculator no longer requires an account. 2026-09-06: the deeper, AI-assisted layer of the document review now runs by default for signed-in reviews rather than on request; the review section above describes what is sent, what is kept (nothing), and the per-document skip. 2026-09-05: added the traffic-measurement section. Analytics went live on 2026-08-26, and until that update the page still said we ran none; that gap was ours, and this page now describes exactly what runs. 2026-09-05 also first described the AI-assisted review layer.
FreeQDRO provides tools and general information, not legal advice, and is not a law firm. See our Terms of Service.