WorthCanvas (“we”, “us”, “our”) operates the WorthCanvas mobile application (the “App”), a personal-finance tracking tool that helps you record and understand your own money. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the App you agree to this policy.
1. Information we collect
Information you provide
- Account details — your name, email address, time zone, and a password. Your password is never stored in readable form; we keep only a secure cryptographic hash of it. If you enable two-factor authentication (2FA), we store the secret needed to verify your codes.
- Financial information you enter or import — accounts and balances, transactions (amount, date, description, merchant, category, and any notes you add), budgets, and detected subscriptions. You may add this manually, or import it from CSV or PDF statements, from bank/payment SMS text you provide, or by optionally connecting a financial account.
Information collected automatically
- Technical and security data — your IP address, app version, device type, and request timestamps. We use this to operate the service, enforce rate limits, and protect your account against abuse.
- Push token — only if you enable notifications, so we can deliver them to your device.
What we do not collect
We do not collect your precise location, your contacts, biometric data, or advertising identifiers. The App contains no third-party advertising or analytics SDKs and no ad trackers.
2. How we use your information
- To provide and operate the App — storing and displaying your finances, categorizing transactions, and computing budgets, analytics, and insights.
- To authenticate you and secure your account, including 2FA and password resets.
- To send you essential service emails (such as password-reset messages). We do not send marketing email.
- To detect, prevent, and investigate fraud, abuse, and security incidents.
- To comply with our legal obligations.
Transaction categorization, budgeting, and analytics are performed by deterministic, rules-based logic on our own servers. We do not sell your data, and we do not use your financial data to train third-party AI models.
3. How your information is shared
We do not sell or rent your personal information. We share it only in these limited cases:
- Service providers (sub-processors) that process data on our behalf, under contract, solely to run the App:
- Cloud hosting and database providers, which run our application servers and store your data in an encrypted database.
- A transactional email provider, used to deliver account emails such as password resets.
- A push-notification delivery service — used only if you enable notifications.
- Optional account-aggregation providers — used only if you choose to connect a financial account. We never receive or store your bank login credentials.
- Legal reasons — if required by applicable law, regulation, legal process, or to protect the rights, property, or safety of our users or others.
- Business transfers — if WorthCanvas is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction, subject to this policy.
4. How we protect your information
- All traffic between the App and our servers is encrypted in transit (HTTPS/TLS).
- Your data is stored in an encrypted database, and access is restricted by strict per-user controls, so only you can access your own financial data.
- Passwords are hashed using a modern, memory-hard algorithm (Argon2id). Sign-in tokens are stored in your device’s secure keychain/keystore, not in ordinary storage.
- Optional two-factor authentication adds a second layer of protection to your account.
No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security — but we work to protect your information using the measures above.
5. How long we keep your information
We keep your information while your account is active. You can permanently delete your account at any time from Settings → Delete Account in the App. When you do, we delete your personal and financial data from our live systems; residual copies in encrypted backups are purged within 30 days. We may retain limited records where we are legally required to.
6. Your rights and choices
- Access & export — you can export a copy of your data from within the App.
- Correction — you can edit or correct your data directly in the App.
- Deletion — you can delete your account, and its data, at any time from Settings.
- Notifications — you can turn notifications on or off in your device settings.
Depending on where you live (for example, under India’s Digital Personal Data Protection Act, or the EU/UK GDPR), you may have additional rights, such as the right to object to or restrict certain processing, or to lodge a complaint with a data-protection authority. To exercise any of these, contact us at the address below.
7. Children’s privacy
WorthCanvas is a financial tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
8. International data transfers
We may store and process your information on servers located outside your country of residence. Where we transfer data internationally, we take steps to protect it consistent with this policy and applicable law.
9. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will notify you in the App or by email. Your continued use of the App after an update means you accept the revised policy.
10. Contact us
If you have questions about this policy or your data, contact us at support@worthcanvas.com.
This document is provided for transparency about our data practices. It is not legal advice.