Privacy

Data lives in two places:

• Your dedicated database(a Neon Postgres instance provisioned during signup): your accounts, transactions, holdings, private investments, real estate, personal property, documents (PDFs stored separately in Supabase Storage), capital events, valuations, liabilities, insurance policies. This DB is yours alone; no other NetWorth customer's data is in it.
• Central directory (a shared Supabase project): your login credentials (managed by Supabase Auth, never plaintext), your profile row, a pointer to your dedicated database, encrypted MFA recovery codes, and the encrypted secrets you supply (Anthropic API key, Plaid client_id + secret, connection string to your dedicated database). All secrets are encrypted with AES-256-GCM using a key we never expose.

• Plaid— if you connect a bank via Plaid, Plaid (not us) collects your bank password over a secure connection. We never see the password; we receive an access token that lets us read transactions + balances. During beta, you supply your own Plaid Developer credentials so your bank data flows through YOUR Plaid account. Read Plaid's privacy policy at plaid.com/legal.
• Anthropic— when you upload a document for AI extraction (subscription agreements, capital account statements, insurance schedules, etc.), the PDF is sent to Anthropic's Claude API using an API key you provide. Anthropic's terms (anthropic.com/legal/privacy) say training on API traffic is disabled by default.
• Google— if you connect Google Sheets for the Tiller sync flow, we use Google's OAuth to access spreadsheets in your Drive that you explicitly grant. We store a refresh token (encrypted) so we can re-sync. Revocable at myaccount.google.com/permissions.
• Supabase and Neon — the infrastructure providers hosting the central directory and your dedicated database respectively. Both are SOC 2 Type II certified.

• You, via the app UI. Row-level security on the shared directory + database isolation on your dedicated database ensure no other NetWorth user can query your rows.
• Operations (Ary Khatchikian), via the service-role key for database maintenance, incident debugging, and support requests you make. We do not routinely browse customer data.
• Nobody else. We do not sell, share, or aggregate your data with third parties.

• Your Supabase Auth row
• Your profile row (including all encrypted secrets)
• Your dedicated Neon database (irreversibly)
• Any documents you uploaded to Supabase Storage

Deletion is typically completed within 3 business days. Backups may retain data for up to 30 days per Supabase and Neon's standard retention.