This Privacy Policy explains how Worth Yourself ("we", "our", or "us") collects, uses, and protects information when you use the Worth Yourself mobile application and associated services.
1. Information we collect
Account information
When you create an account, we collect your email address and a hashed password (if you use email/password sign-in). If you sign in with Google, we receive your email address and name from Google — we do not receive or store your Google password. We also store a unique user ID assigned by our authentication provider (Supabase).
Profile and in-app data
To provide the service, we store the data you create inside the app, including:
- Your Worth Score history and domain scores (Health, Education, Finance, Lifestyle, Bonds)
- Your habit records and completion history
- Your journal entries (tagged life events)
- Your domain weighting preferences
- Your optional public ticker symbol and display name (if you choose to claim one)
- Your friends list (if you use the social features)
- Your date of birth and country (used locally to determine data residency; not shared)
- Your display preferences (theme, text size, currency, haptics)
Coach messages
If you subscribe to the AI coach, your chat messages and the coach's replies are stored to provide conversation history across sessions. A summary of your in-app data (Worth Score, domain scores, habits, recent journal activity) is sent alongside each message to help the coach give relevant advice. This data is used only to generate your reply and is never used to train any AI model.
Health data
If you enable Apple Health or Google Health Connect integration, we read daily step count and sleep duration from your device. This data is processed on your device to generate a Health domain score and is not transmitted to our servers — it stays local to your device. We do not store raw health readings.
Waitlist and feedback
If you sign up for the waitlist or submit in-app feedback, we store your email address and the content of your submission.
Usage analytics
We use PostHog to collect anonymised product analytics — screens visited, features used, and key events (such as completing a habit or starting a trial). This helps us understand how the app is used and improve it. Analytics are not collected for users who are under the applicable consent age in their country (determined by the date of birth you provide during setup), or for users who use the app in local-only (offline) mode.
Technical data
Our infrastructure automatically records standard server logs including IP addresses, request timestamps, and error traces. These are used for security monitoring and debugging and are retained for up to 90 days.
2. How we use your information
- To provide and maintain the app and its features
- To authenticate you and keep your account secure
- To generate your Worth Score and coach responses
- To send transactional emails (account confirmation, password reset)
- To send product emails, such as tips and updates, if you signed up for the waitlist or created an account (you can unsubscribe at any time)
- To understand how people use the app so we can improve it
- To investigate and prevent fraud, abuse, or security incidents
3. Third-party services
We use the following third-party services to operate Worth Yourself. Each is bound by its own privacy policy.
Supabase
Our database, authentication, and server-side functions run on Supabase. All app data (scores, habits, journal, coach messages) is stored in a Supabase-managed Postgres database. Data is hosted in the US.
Anthropic
The AI coach is powered by Anthropic's Claude API. Your messages are sent to Anthropic's servers to generate a reply and are subject to Anthropic's API usage policy. Anthropic does not use API inputs to train its models by default.
PostHog
Usage analytics are collected by PostHog. Events are anonymised before being sent — we do not send your email address or real name to PostHog.
Resend
Transactional and marketing emails are sent via Resend. Your email address is transmitted to Resend to deliver emails you have requested or opted into.
Google (Sign-in)
If you choose to sign in with Google, your authentication is handled by Google. We receive only your email and name from Google. See Google's Privacy Policy.
4. Data retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or fraud-prevention purposes (such as server logs, which are retained for up to 90 days).
5. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Object to or restrict certain processing
- Export your data in a portable format
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email us at support@getvest.app. We will respond within 30 days. You can also delete your account directly from the app (Profile → Settings → Account → Delete account).
6. Children's privacy
Worth Yourself is not directed at children under 13. In countries where a higher age of digital consent applies (for example, 16 in some EU member states), we apply that higher threshold. During setup, we ask for your date of birth and country; users below the applicable consent age are restricted to a local-only mode where no data is sent to our servers and no analytics are collected.
If you believe a child under the applicable age has created an account, please contact us at support@getvest.app and we will delete the account promptly.
7. Data security
We use row-level security on all database tables so users can only access their own data. Communication between the app and our servers is encrypted in transit (TLS). API keys and secrets are stored as server-side environment variables and are never included in the app binary.
No method of transmission or storage is 100% secure. If you become aware of a security issue, please disclose it responsibly to support@getvest.app.
8. International transfers
Our infrastructure is based in the United States. If you are located outside the US, your data will be transferred to and processed in the US. We rely on standard contractual mechanisms where required by applicable law.
9. Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or in-app notice. Continued use of the app after a change takes effect constitutes acceptance of the updated policy.
10. Contact
If you have questions about this Privacy Policy or how we handle your data, please contact us at support@getvest.app.