Privacy Policy

Information we collect

We collect the following categories of information, and nothing more than the product requires:

• Account information — your email address, which you use to sign in. We do not ask for or store a password; sign-in is a one-time link sent to your email.
• Financial information you enter — the accounts, balances, currencies, and labels you add by hand.
• Connected account information — if you choose to link a brokerage or investment account, we import read-only information about it through our aggregation partner: the institution and account names, balances, holdings, and transaction history. To keep the connection refreshed, we store a secure, encrypted access credential for it. We never see or store your login for the connected institution, and the connection is strictly read-only — we can never move money or place trades.
• Authentication and session data — secure cookies and tokens that keep you signed in and protect your account, including a second-factor secret if you enable one.
• Usage analytics — a limited, pre-approved set of product events (for example, that a sign-in was requested or an account was added), associated only with your account identifier. These events are defined by an internal allow-list and carry no financial details or other personal content.
• Diagnostic data — technical error reports used to find and fix bugs. Personal data is disabled in these reports, and we do not use session recording or replay of any kind.
• Communications — if you email us, we keep your message and our reply so we can help you.

How we use your information

We use your information only to:

• Provide the service — sign you in, store and display the accounts and balances you enter, and keep your data isolated to your account.
• Sync connected accounts — when you link a brokerage or investment account, retrieve and refresh its balances, holdings, and transactions so the app can display them, and record when each sync ran.
• Secure your account — send sign-in links, support your second factor, apply rate limits, and detect abuse.
• Maintain and improve the product — understand which features are used (in aggregate, from the allow-listed events) and diagnose errors.
• Communicate with you — respond to your requests and send service messages such as sign-in links.
• Meet legal obligations — comply with applicable law and enforce our Terms.

Cookies and similar technologies

We use cookies that are strictly necessary to sign you in and keep your session secure — the service cannot function without these. We also use limited analytics to understand product usage.

Where required, non-essential analytics are off until you agree, and you can change your choice at any time. Strictly-necessary cookies do not require consent because the service cannot be provided without them.

How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share information only with service providers who process it on our behalf, under contracts that limit them to providing their service to us, and when required by law.

The service providers (subprocessors) we rely on are:

• SnapTrade — secure, read-only connection to your brokerage or investment accounts (account aggregation), used only when you choose to link an account.
• Supabase — authentication and the database that stores your account data.
• Vercel — application hosting and content delivery.
• PostHog — product analytics (United States).
• Sentry — error monitoring and diagnostics.
• Resend — delivery of transactional email, such as sign-in links.
• Upstash — rate limiting to protect authentication and other sensitive endpoints.
• Anthropic — AI features you explicitly choose to use; your data is sent only when you initiate such a feature.

How we protect your information

Security is built into the product, not added afterward. Every request is served over HTTPS with strict security headers. Your data is isolated at the database level by row-level security, so you can only ever reach your own records. Sensitive secrets are encrypted at rest. Authentication is passwordless with an optional second factor, and sessions are short-lived.

When you link an outside brokerage or investment account, you authenticate directly with that institution through our aggregation partner. We never receive your login for it; we store only an encrypted access credential, scoped to read-only, that you can revoke at any time by disconnecting the account.

No method of transmission or storage is perfectly secure, but we design, review, and test the service to keep your information safe.

How long we keep information

We keep your account information and the data you enter for as long as your account is active. When you delete your account or ask us to delete your data, we remove it from our production systems, except where we are required to retain certain records to comply with law, resolve disputes, or enforce our agreements. Backups are purged on a rolling schedule.

Information imported from a linked brokerage or investment account is kept on the same terms. If you disconnect a linked account, we stop syncing it and revoke our access; the information already imported remains part of your account history until you delete your account or ask us to remove it.

Analytics and diagnostic data are retained for a limited period for the purposes described above and are not tied to your financial details.

Your choices and rights

You can access and update the information in your account at any time from within the app, and you can ask us to delete your account and associated data. To make a request, contact us using the details below. We will verify your request through your account email before acting on it.

If you have linked a brokerage or investment account, you can disconnect it at any time from within the app. Disconnecting stops any further syncing and revokes our access to the institution.

Wendworth is available to people throughout the United States. Depending on where you live, you may have additional rights under your state's privacy law.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to:

• Know what personal information we collect, use, and disclose, and access it.
• Correct inaccurate personal information we hold about you.
• Delete personal information we have collected from you, subject to legal exceptions.
• Opt out of the sale or sharing of your personal information — we do not sell or share your personal information, so there is nothing to opt out of.
• Limit the use of sensitive personal information — we use it only as needed to provide the service.
• Not receive discriminatory treatment for exercising your rights.

Children's privacy

Wendworth is not directed to children. You must be at least 18 years old to use the service, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy as the product evolves or the law changes. When we make a material change, we will update the effective date above and, where appropriate, notify you. Your continued use of the service after an update means you accept the revised policy.

Contact us

If you have questions about this Privacy Policy or want to exercise a privacy right, contact Highfivery LLC at info@highfivery.com, or by mail at 651 N Highway 183, Ste 335, PMB 3069, Leander, TX 78641-7001, United States.