Security

A plain explanation of how Worthful protects your data, for anyone deciding whether to trust it with real financial information.

Worthful never asks for your full card number or CVV, and has nowhere to store them. The only card details the app keeps are the last 4 digits (to recognize the card at a glance) and the expiry month and year. Both are for display only, never for making a charge.

Passwords are hashed with PBKDF2 (100,000 iterations, with a unique random salt per account) before they're stored. Nobody, including us, can look up or recover your actual password. A forgotten password can only be reset, never retrieved. Login sessions use random tokens in a secure, httpOnly cookie that your browser's JavaScript can't read, and every login and sign-up attempt is rate-limited to slow down password guessing. Signing in with Apple on iOS doesn't use a password at all: Apple gives the app a signed identity token, and our server checks it against Apple's public keys before creating a session.

Free plan: everything stays in your browser's local storage and is never sent to our servers. If you clear your browser data, it's gone, unless you've exported a backup yourself.

Premium / Lifetime: your financial entries sync over HTTPS and are encrypted in our database with AES-256-GCM. Uploaded card images are stored separately. Your account and any Partner you connect can access shared data, and authorized admins can help with account support.

On the web, Premium (monthly or yearly) and Lifetime purchases are handled entirely by LYNK.ID, a separate payment processor. We never see, receive, or store your card or payment details. LYNK.ID only tells us that a payment succeeded and for which email, and that's what activates your account. In the iOS app, purchases go through Apple's In-App Purchase: Apple bills you directly, and our server only verifies Apple's signed receipt before activating your account.

Site admins can see your account's email and a summary of what's synced (item counts and the last sync date). They can help with support requests, like fixing a username, resetting a password, changing your plan, or deleting your account if you ask. They can never see your password, because it's a one-way hash that even we can't reverse. Your synced financial data stays encrypted at rest, so it isn't something an admin can casually browse.

Please report it directly rather than filing it publicly: egifermn@gmail.com