Privacy policy

Information we collect

• Account information: your email, name if provided, password hash, verification status, sign-in sessions, and security settings such as two-factor authentication.
• Tracking data: the account names, categories, asset and liability balances, dated snapshots, goals, and preferences you enter or import. This data is stored on our servers to provide your account across devices; NetWorthy is not a device-only tracker.
• Payment records: Stripe customer, checkout, and payment references, purchase and refund amounts, payment status, and Pro access records. Stripe collects payment details on its hosted checkout. NetWorthy does not store your full card number or CVC.
• Technical and security information: IP addresses and browser/device information used by authentication, hosting, and security services; sign-in activity, operational logs, and rate-limit data. Our application audit records hash IP addresses and user agents.
• Support information: the messages and attachments you choose to send us.

NetWorthy does not connect to your bank or request banking credentials. Avoid putting bank login details, card numbers, or identity documents into account names or support messages.

How we use information

We use information to create and authenticate your account, store and display your records, calculate charts and projections, process purchases and refunds, manage access, deliver account emails, answer support requests, prevent abuse, and maintain the service. We also use it when necessary to meet legal obligations or resolve payment disputes. We do not sell your personal tracking data or use your balances for advertising.

Service providers and sharing

We use Vercel for hosting and usage/performance analytics, Supabase for the PostgreSQL database, Upstash for caching and rate limiting, Better Auth and its infrastructure for authentication and security, Resend for transactional email, Stripe for payment processing, and Gmail for support correspondence. Each receives the information needed for its role. For example, cached dashboard data can include your financial records; payment processing does not require your net worth balances.

Stripe handles payment information under its Privacy Policy. We may also disclose information when required by law or reasonably necessary to protect users, investigate abuse, or establish or defend legal claims. Our providers may process data outside Singapore. We use provider safeguards and contractual protections for these transfers as required by applicable law.

Cookies and analytics

Essential cookies keep you signed in and support authentication. If you choose to trust a browser for two-factor authentication, a cookie remembers that choice for up to 30 days; you can revoke trusted browsers in Settings. We also store interface preferences, such as your theme, in your browser.

Vercel Web Analytics and Speed Insights collect page-view, browser/device, approximate location, and performance information. Web Analytics does not use third-party tracking cookies. We do not intentionally send your financial balances to these analytics tools. Blocking essential cookies may prevent sign-in. Your browser settings can control cookies and local storage.

Retention and deletion

We keep your account and tracking data while your account is active. You can export your snapshots as CSV and delete your account in Settings. Account deletion removes your user profile, authentication records, accounts, preferences, and snapshots from the active database and invalidates user-scoped cached data.

Minimal payment references and security audit records can remain after deletion when needed for accounting, refunds, fraud prevention, disputes, or legal obligations. Support correspondence, provider records, and backup copies can also remain for their applicable retention periods. Retention depends on the purpose, legal requirements, and unresolved requests or disputes; we do not promise immediate deletion from every provider or backup. Contact us if you need information about a particular record or its retention.

Your choices and requests

You can view and correct tracking data, change account settings, export your snapshots, and delete your account. You may contact us to request access to or correction of your personal data, information about its use or disclosure, or withdrawal of consent, subject to applicable law. Depending on where you live, other rights may apply, including objection, restriction, portability, or a complaint to your data protection authority. We may verify your identity before fulfilling a request. Withdrawing information needed to operate your account may mean we cannot continue providing the service.

Security and policy changes

We use authentication, access controls, encrypted connections, rate limiting, and optional two-factor authentication to help protect your data. No service can guarantee absolute security. We will assess incidents and provide notifications where required by applicable law.

We will update the date above when this policy changes and provide notice of material changes through the service or account email. See our Terms of service for the rules governing use of NetWorthy.