In one line: by default, we don't have your data. It stays on your device unless you turn on Cloud sync, and even then, it's not going anywhere ordinary.
Out of the box, WorthOS keeps your notebook in your browser's local storage. Nothing is sent anywhere. There's no account to create, no server request when you save a snapshot, and no way for us to see your numbers even if we wanted to — we don't have them.
Cloud sync is opt-in, off by default. If you turn it on, your notebook syncs to a self-hosted server — not a shared commercial cloud. Stored data is encrypted at rest, and the connection itself runs over HTTPS. Database policies isolate every account's data at the query layer (row-level security), so no other account can read yours.
Sign-in uses a one-time magic link sent to your email. No passwords are stored, ever.
If you use Cloud sync: your email address, and the numbers you enter — assets, liabilities, goals, income, debts, and your manual snapshots. That's it. WorthOS does not connect to any bank, brokerage, or financial institution, and never will; every number in the notebook is one you typed in yourself.
Two processors, both named here rather than buried in a policy: Supabase, running on our own infrastructure rather than Supabase the company's commercial cloud, and Resend, which delivers the magic-link sign-in email and sees only your email address, not your financial data.
Export your entire notebook to JSON any time from Settings → Backup. If you've used Cloud sync, delete your account and every server-side copy from Settings → Account & sync — that action is permanent.
Cloud data is kept until you delete your account. There is no automatic expiry, and no automatic sharing with anyone, for any reason.
Questions
Reach us directly at [email protected] — a real inbox, not a support ticket queue.
The compliance-reviewed policy is linked in Settings and in the footer of every page.