Privacy Policy

Privacy at a glance

The short version, in plain language. The full policy below is the binding text.

1. What Data We Collect

Hy-Worth collects only the data you explicitly provide:

• Email address — used for authentication and account identification.
• Financial data — account balances, net worth entries, real estate records, planner scenarios, and any other data you enter into the application.
• Display preferences — your chosen currency, theme, and tracked currencies, the review findings you choose to dismiss, and the suggested links you turn down.
• Uploaded documents — files you choose to store in the document vault or attach to your companies (for example wills, deeds, agreements, or statements). They are used solely to display them back to you and are never analyzed for any other purpose.
• Statement import records — when you import balances from a dropped statement, we keep a fingerprint of the file (not the file itself), which period it was for, and counts of proposed/confirmed/unreadable balances — so a re-imported statement can be recognized and adoption can be measured. The file, its extracted text, and the balances it contained are never stored.
• Statement matching memory — when you confirm a statement balance against one of your accounts, we remember a short fragment of that match — a normalized version of the statement's label, the last 4 digits it showed (if any), the currency, and which account it maps to — so your next close pre-selects the same match instead of starting over. No statement text, file, or balance is kept in this record.

We use no tracking cookies and no advertising identifiers, and we never sell, rent, or share your personal data for marketing purposes. We keep a minimal record of which features you use (for example, that an import or a planner run happened) solely to power your own digest, reminders, and progress — never to profile you.

Legal bases. We process your account and financial data because it is necessary to provide the service you signed up for (performance of a contract, Art. 6(1)(b) GDPR). Security measures, abuse prevention, and cookieless aggregate analytics rest on our legitimate interest in running a safe, reliable service (Art. 6(1)(f)); billing records are additionally retained where financial-record laws require it (Art. 6(1)(c)). We do not rely on consent for any core processing, so there is no consent whose withdrawal would break the service. AI features are part of the service you signed up for (Art. 6(1)(b)). Most of them send data only when you use the feature; the currency explanation is the exception, because it runs as soon as a month with movements in more than one currency is shown.

2. How Data Is Stored

All data is stored in a database hosted by Supabase in Switzerland (Zurich region) and processed in the EU (Frankfurt). Data is encrypted when stored and when it travels. Sign-in is handled by Supabase Auth, and your session is kept in a cookie that is only ever sent over an encrypted connection.

Documents you upload are stored in a private storage bucket within the same Supabase project, with access restricted to your authenticated account. Files are encrypted at rest and in transit. Database and storage backups are encrypted and retained for a limited window (see Data Retention).

Estate documents are additionally encrypted by your browser before upload, under a key derived from a passphrase we never receive, so we store them as data we cannot read. Company documents use that same vault by default, and you can instead choose standard encrypted storage, which the application can read; a document uploaded before the vault existed stays readable until you move it in.

3. Third-Party Services

• Supabase — database hosting, authentication, and API layer. Subject to Supabase's Privacy Policy. supabase.com/privacy
• Frankfurter API / European Central Bank — used to fetch historical foreign exchange rates. No user data is sent to these services; only currency pair and date range queries are made.
• Vercel Web Analytics — privacy-friendly, cookieless usage analytics. It measures aggregate traffic (page views, approximate country, device type) without cookies, without storing your IP address, and without any personal identifiers. It is not used to track individuals. vercel.com privacy policy
• Vercel — application hosting and content delivery (United States / global edge network). Vercel processes request metadata (such as IP addresses) as needed to serve the application.
• Stripe — payment processing for paid subscriptions. Stripe receives your email address and payment details; full card numbers never reach our servers. Subject to Stripe's privacy policy.
• RevenueCat — subscription management for purchases made inside the mobile app, through Apple's App Store or Google Play. It receives your Hy-Worth account identifier and the state of your subscription from the store, so the app knows which plan you are on. It receives none of your financial data and none of your documents.
• Apple and Google sign-in — optional sign-in with an Apple or Google account instead of an email address and password. If you choose it, that provider handles the sign-in and tells us the email address on the account, so it learns that you use Hy-Worth. It receives none of the data you keep here.
• Plaid — optional bank and brokerage sync for US and Canadian institutions, available on the Pro plan and used only if you choose to connect an account. You sign in at your bank through Plaid; your bank credentials go to Plaid and never reach our servers. Plaid returns the balances of the accounts you connect and, for investment accounts, your holdings and recent investment transactions (trade dates, quantities, prices and fees). Each refresh is kept as a preview in your bank-sync refresh log for ninety (90) days (section 6); nothing is written into your accounts, holdings or trades until you confirm it. Because Plaid requires it to open a connection, the sign-in step also grants Plaid access to account and routing numbers — Hy-Worth never requests, reads or stores them, and never moves money. Plaid processes this data on servers in the United States. You can disconnect a bank at any time from Accounts. Subject to Plaid's privacy policy.
• Resend — transactional email delivery (for example signup confirmation). It receives your email address and the content of the emails we send you. It also receives the email address of anyone you invite to your household or name as an emergency contact, because that is where their invitation or notice is delivered.
• Upstash — API rate-limiting infrastructure. It receives pseudonymous user identifiers and request counters, and on a handful of endpoints — switching language, the demo, reporting a failed sign-in, unsubscribing from emails and the feedback forms — your IP address as the counting key. That key is kept for a little over twice the counting window, which is about two minutes on most of those endpoints and just over two hours on the feedback forms. It never receives your financial data or your documents.
• Cloudflare Turnstile — bot protection on sign-in and sign-up forms. Processes technical browser signals to distinguish humans from bots; no account or financial data is shared with it.
• Anthropic — AI assistance for Hy-Worth features. What is sent depends on the feature: a file's column headers and a few sample rows when you use AI import mapping, and — if you ask us to repair rows that failed — the specific cells that failed, which can include amounts, together with the names of the categories you have set up so that a mistyped one can be matched; the text of a text-based statement you drop for statement import, with IBANs and account numbers written as one run of digits or grouped by dashes or spaces masked to their last 4 characters before it ever leaves your browser (a number split into groups of three digits is kept, because a balance is written the same way) (a screenshot or scanned statement sends the page image instead, since it can't be reliably masked); aggregate figures such as your opening and closing net worth when you complete a month, and the currency movements behind a change, which are sent on their own as soon as a month with movements in more than one currency is shown rather than waiting for you to ask; the names (never the values) of accounts still missing a balance when you ask the assistant to help you finish a month; when you ask the assistant a question, your question and recent chat, and, once you have allowed Ask Hy-Worth to use your data, the totals and lines shown on the page you asked from, which can include balances, holdings and amounts (never documents, notes or anything from another person's household, and with account-number-like digits and email addresses in names masked); on Real estate, under the same choice, the names of your properties and their loans (never their values, balances or rates), so the assistant can suggest a change that is saved only if you apply it; on Accounts, under the same choice, the names of your accounts (never their balances or amounts), so the assistant can suggest a change that is saved only if you apply it; on Track Net Worth, under the same choice, the names of the accounts on screen beside the month's totals and lines, so the assistant can suggest a balance for that month that is saved only if you apply it; on Budget, under the same choice, the same lines numbered, so the assistant can suggest a line's amount, a new line or your own tax figure that is saved only if you apply it; on Insurance, under the same choice, the same policies numbered, so the assistant can suggest a policy's cover, premium, end date or whether it is active, which is saved only if you apply it; on Education, under the same choice, the names of your education plans by their kind of school (never your children's names, costs or years), so the assistant can suggest a plan's start year that is saved only if you apply it; the findings shown on Review my app, including the figures and property or account names they mention, when you press “Explain this in plain words” (or automatically if you have turned on AI messages); the name, description and a short note for a badge you unlock — and for a net-worth milestone that name carries the amount and currency you reached; and activity counts in the weekly digest. The month summary, the badge note, the currency explanation and the weekly summary's opening line are written only if you have turned on AI messages in Settings, which stays off until you do. The names and the page figures the assistant uses are covered by one choice that applies to the whole app: it stays off until you choose Allow, once, in Ask Hy-Worth, it is recorded with the date and the wording you were shown, and it can be turned off in Settings, under AI messages. Your stored documents are never sent, the assistant never sees anything from a page you are not on, and Anthropic does not use API data to train its models.
• Geoapify — finds the map location of each property address you enter, suggests matching addresses while you type, and draws the property map. It receives what you have typed so far while you type, the full address when you save a property, and each property's coordinates for the map, but never your account details or any amount. Every request goes through our servers, so Geoapify does not see your IP address, and its servers are in the EU.
• Sentry — error monitoring, so a crash or a failed background job is visible to us rather than only to you. Servers located in the EU (Frankfurt). Reports are scrubbed inside your browser and on our servers before they are sent: they carry the type of error, the file and line it happened in, and a random request identifier. They do not carry your name, your email address, your IP address, the contents of a page or a form, or any recording of your screen — those are removed outright rather than filtered. Amounts of four digits or more, figures written with digit grouping, and any figure standing next to a currency code or symbol are replaced with placeholders — as are email addresses, account numbers and access tokens found in the text of an error message. A small figure on its own — three digits or fewer, with no currency code or symbol anywhere beside it — can survive: at that size it is indistinguishable from an error code, an HTTP status or a line number, and redacting it would destroy the diagnosis without protecting anything. We cannot promise that no fragment of a label you wrote yourself ever appears in an error message, because a name you chose looks like ordinary text; what we can promise is that no report carries the data behind it.

4. International Data Transfers

Your data is stored in Switzerland (Zurich) and processed in the EU (Frankfurt). Some of the providers above (Vercel, Stripe, Resend, Upstash, Cloudflare, Anthropic, and — where they apply to you — Plaid, RevenueCat, and Apple or Google sign-in) process limited data in the United States or globally. Where personal data is transferred to the United States, we rely on providers certified under the Swiss–U.S. and EU–U.S. Data Privacy Framework or on standard contractual clauses, and we are putting data-processing agreements in place with our processors. Push notifications, if you enable them, are delivered through Apple's and Google's notification services; the content of a notification transits their infrastructure.

5. Your Rights

You have the right to access, export, and delete your data at any time. All of these actions are available in the Settings page: /settings

• Access — view all your data directly within the application.
• Correction — edit any entry directly in the app — every value you have entered can be changed at any time.
• Export — download a copy of the data in your account in JSON format. The file lists what it leaves out: the locked key to your document vault, because anyone who got hold of the file could use it to try guessing your vault passphrase; the files you stored, which you download from the page where you stored them; and the backup copies of earlier balances that let us undo a change to a co-owned property's balances.
• Deletion — permanently delete your account and all associated data.

Hy-Worth makes no automated decisions that produce legal or similarly significant effects about you. AI features only propose — nothing they suggest changes your data until you approve it.

6. Data Retention

Your data is retained for as long as your account exists. When you delete your account, your data — including uploaded documents — is immediately removed from our production systems, and residual copies in encrypted backups are purged automatically within thirty (30) days. Anonymized aggregate data may be retained for analytics. Authentication records are removed with the account.

Billing records may be retained for up to ten (10) years after the relevant transaction where Swiss financial record-keeping law requires it.

A small number of operational records are pruned on a fixed schedule, shortening how long they are kept below the life of your account: read in-app notifications after ninety (90) days and unread ones after three hundred sixty-five (365) days; the log of bank-sync connection refreshes after ninety (90) days; billing webhook replay-protection records after ninety (90) days (the underlying billing record of truth is retained by our payment provider as described above); the in-app activity log (data imports, simulations, stress tests, questions to the assistant, which kind of suggested change you applied and on which page, and month-close timings) after one hundred eighty (180) days, keeping only a count of the simulations and stress tests you have run so that the progress milestones you have earned are not lost; and market-data ingest run logs, which contain no personal data, after three hundred sixty-five (365) days.

7. Data Breach Notification

If we become aware of a breach of your personal data that is likely to result in a risk to you, we will notify the competent supervisory authority (in Switzerland, the FDPIC; in the EU/UK, the relevant data-protection authority) within the legally required timeframe — 72 hours where the GDPR applies — and will inform affected users without undue delay if the breach is likely to result in a high risk to them, including what happened, which data was affected, and the measures taken.

8. Regional Privacy Frameworks

Hy-Worth operates across multiple jurisdictions and complies with the privacy frameworks that apply to its users:

• Canada — PIPEDA — Hy-Worth complies with the Personal Information Protection and Electronic Documents Act. Canadian users may request access, correction, or deletion of their personal data. By creating an account and entering your data you provide meaningful consent to the processing described in this policy; you can withdraw it at any time by deleting your account.
• Canada (Quebec) — Law 25 — For Quebec residents, Hy-Lev SA's founder acts as the person in charge of the protection of personal information (privacy@hy-worth.com). You may request access to, correction of, or deletion of your personal information, and you may lodge a complaint with the Commission d'accès à l'information (CAI).
• Switzerland — revDSG — For Swiss users, Hy-Worth complies with the revised Federal Act on Data Protection (revDSG, in force September 2023). You may request data access, correction, or deletion at any time.
• European Union / United Kingdom — GDPR / UK GDPR — For users in the EU/EEA and the UK, Hy-Worth complies with the General Data Protection Regulation (GDPR) and UK GDPR, including the rights of access, rectification, erasure, restriction, data portability, and objection. You also have the right to lodge a complaint with your local supervisory authority. Contact us to exercise any of these rights.
• United States (California) — CCPA / CPRA — California residents have rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know, the right to delete, and the right to opt out of the sale of personal information. Hy-Worth does not sell personal data. We also do not “share” personal information for cross-context behavioral advertising. Because we use no tracking, there is nothing for a Global Privacy Control signal to opt out of.

9. Children

Hy-Worth accounts are for adults: you must be at least 18 years old to use the service (see our Terms of Service). Information about children appears in Hy-Worth only when a parent or guardian enters it — for example, a child's name and birth year for education or family planning. That information appears only inside your own account and for anyone you explicitly share your household with, is used for no other purpose, and is deleted together with your account.

10. Contact

If you have any questions or concerns about this privacy policy or your data, please contact us at privacy@hy-worth.com.

Hy-Lev SA, Canton of Vaud, Switzerland