A net worth tracker that never asks for your bank login.
There is no aggregator, no credential vault, and no third party reading your transactions — because WorthSync never connects to your bank at all. You enter dated balances yourself, and sensitive fields are encrypted in the database.
What manual-first actually means.
Most trackers reduce risk by promising to guard your bank credentials well. WorthSync does not hold any, which is a different kind of answer.
No bank connection, anywhere
There is no Plaid, MX or equivalent in the product. Nothing links to an institution, so there is no credential to store, leak or revoke — and no aggregator outage that empties your dashboard.
Encrypted where it matters
Account names, institution names and balances are encrypted at the column level in Postgres, not merely encrypted at rest as a volume. Reading them requires a key the application supplies per request.
Isolation enforced in the database
Row-level security is applied in Postgres itself rather than in application code, so a bug in a query cannot return another household's rows. The policies are the boundary, not a convention.
Sharing is per account
Each account is private, shared read-only, or shared full-access. Joining a household does not expose anything by default — you choose what the other person sees, one account at a time.
Biometric lock on mobile
The iPhone and Android apps can be locked with Face ID or a fingerprint, separately from your sign-in session.
Export and deletion, on request
Full CSV export is on every plan, including the free one. Account deletion removes your data — there is a page describing exactly how, and what it does.
Security and privacy — FAQ
Do you ever see my bank credentials?
No, because there are none to see. WorthSync has no bank connection of any kind — no Plaid, no MX, no screen-scraping. You type balances in yourself, on the dates you have them. That is the whole design, and it is why there is no credential vault to compromise.
What exactly is encrypted?
Account names, institution names and balance figures are encrypted at the column level inside Postgres using pgcrypto, and decrypted only through a key the application injects for the duration of a request. That is stronger than volume-level encryption alone, which protects a stolen disk but not a leaked query result.
Can someone in my household see my private accounts?
No. Visibility is set per account, and the default is private. An account only becomes visible to your household when you change it to shared read-only or shared full-access. Joining a household exposes nothing on its own.
Do you sell or share my data?
No. We run no advertising trackers and no cross-site cookies, and we do not sell or share personal information as those terms are defined under CCPA/CPRA. Traffic analytics on the marketing site are cookieless and aggregate; the one measurement cookie we set is first-party and never leaves our own domains. The cookie policy describes it in full.
Is my data used to train AI models?
No. The one feature that answers questions about your numbers is computed by deterministic rules over your own snapshots — no external model is sent your data.
What happens to my data if I stop paying?
It stays. Shared visibility and the paid analytics are gated on the plan, so they stop being available, but every account, snapshot and goal remains in your ledger and can be exported in full at any time.
How do I delete my account?
There is a dedicated page describing the process and exactly what it removes. Deletion is permanent and wipes the account together with its ledger.