Privacy Policy

MyWorth · Last updated: · October 6, 2026

Scope and operator

This policy describes how MyWorth, operated by Inon Cohen, an individual in Israel, handles information. Privacy and support contact: inoncohen.support@gmail.com. Data is kept until you delete your account; deletion takes effect immediately on the device and in cloud records, and backups held by the infrastructure provider may persist for up to 30 days.

Account and cloud information

Supabase handles email/password or Apple/Google sign-in and profile information such as name and avatar. Cloud records include portfolios, savings, assets, funds and deposit history that users enter themselves. MyWorth does not retrieve these figures from a bank and does not request or collect bank-login or payment-card credentials. Do not enter such credentials or card details in notes or other fields. They may contain names, categories, target ages, birth dates, dates of opening/purchase, deposit schedules, return and fee assumptions, reported balances, notes, links, vehicle plates, fund providers and account numbers. Account numbers and vehicle plates are included only if you enter them. These records may reveal sensitive financial information and information about family members or children. There is no bank integration or live financial feed in this version.

Device and browser information

Debts, goals, monthly net-worth snapshots and exchange-rate/valuation overrides are stored locally rather than in the app's cloud financial tables. On supported mobile builds, local financial storage and offline cache use AES encryption with keys in the device's Keychain/Keystore. The offline cache has a 30-day time-to-live; this is not a cloud-data retention period. On the web, sign-in session information is in browser localStorage and local financial information is in browser memory. On iOS, widget snapshot amounts and series are stored locally in plaintext in the app group so the widget can read them. These widget snapshots are cleared on logout or deletion. Mobile storage encryption therefore does not cover every local copy. Device backups and files you export can create additional copies.

Technical information and updates

Supabase and other infrastructure can process technical information associated with authentication and requests. The actual server-log fields and retention periods are not yet specified in this version. Expo EAS Update is used for app updates; Expo describes update requests as including operating system, project information and a random update token. This does not mean all financial records are sent to Expo. No advertising, product-analytics or third-party crash-reporting SDK is identified in the reviewed app code. Local notifications are used; remote push delivery is not verified as active in this version.

Purposes and your choices

Information is used for account access, storing and displaying your records, calculations from your assumptions, local/offline features, exports and app updates. Contacting support can disclose the information you choose to send. Providing information is voluntary. Without required account fields, an account cannot be created; missing financial entries limit the relevant record or calculation. Do not enter unnecessary birth dates, account numbers, vehicle plates or information about others. Terms acceptance is not blanket consent to unrelated processing.

Providers and sharing

MyWorth uses Supabase for cloud authentication/database services, Expo for relevant update/build infrastructure, and Apple or Google when you choose their login. Providers and relevant subprocessors may receive information needed for those services. Build tooling alone does not mean a provider receives all financial records. The complete production recipient, data-category and processing-country list is not yet specified in this version. Exports and sharing go to the app or recipient you choose. Full financial-backup JSON and device-finance JSON are unencrypted. Copies you share are subject to the destination's handling and are not automatically deleted with your account. Disclosures required by applicable law may also occur; sharing is not limited to such disclosures.

International processing

The operator is in Israel and providers may process information in other countries. The Supabase region, backup/support locations and applicable transfer arrangements are not yet specified in this version. No claim is made that all processing remains in Israel, in the EU or in one server region.

Retention

Data is kept until you delete your account. Deletion takes effect immediately on the device and in cloud records, and backups held by the infrastructure provider may persist for up to 30 days. Retention of authentication/security logs and support messages at providers is not yet specified in this version. The mobile offline cache's 30-day time-to-live is a separate mechanism. Local widget snapshots are cleared on logout or deletion. Information in exported files and independently retained copies is outside the app's automatic cleanup.

Access, correction and deletion

Applicable law can give you rights to access and correct information and, in some circumstances, delete, restrict or object to processing or obtain a portable copy. These rights depend on the applicable law and are not waived by using the preview. You may have a right to complain to a relevant privacy authority. A functioning privacy-request contact and the request-handling timetable are not yet specified in this version. The app includes a deletion action calling a remote server function, but complete cloud deletion has not yet been verified. The web request address, completion time and backup expiry are not yet specified. After confirmed server deletion, the app removes local data, keys and cache. Widget snapshots are cleared on logout or deletion. Signing out or uninstalling is not cloud-account deletion.

Security limits

Local mobile encryption is not a claim of end-to-end encryption of cloud records or verified server encryption. iOS widget snapshots and JSON exports are plaintext. Account multi-factor authentication is not provided in this version; a local biometric/PIN lock is only a local access control. No method is completely secure. Server encryption settings, production access-control testing and incident-handling details are not yet specified in this version.

Age and information about others

Accounts are intended for users aged 18 and over. Adult users can still enter child-related savings information, including birth dates. Enter others' information only where you have lawful authority and only to the extent needed. The app does not verify age.

Regional rights and changes

Worldwide availability does not remove applicable local rights. The specific GDPR/UK GDPR legal bases, representative or DPO details where required, and California threshold assessment are not yet specified in this version. This policy does not certify worldwide compliance or claim exemption from those laws. Future policy changes do not by themselves authorize new processing or waive mandatory rights.