Security and privacy
Privacy enforced where it cannot be bypassed
Worth Clarity puts its promises in the database rather than the interface. This page explains what that means in practice.
The layers
Six boundaries between your money and anyone else
Identity
Sign-in is Google OAuth through Supabase Auth. Worth Clarity never sees or stores a password. The account holds your name and email from Google and nothing else about you.
Data isolation
Every table you own carries Postgres row-level security keyed to your user id. Queries run as you, so a bug in the interface cannot return another person's rows.
Privileged paths
The few operations that cross a boundary, such as household totals and the admin panel, are SECURITY DEFINER functions that re-check permission inside the database and return aggregates or metadata only.
AI boundaries
The Assistant's tools are read-only and run on your session. Proposed edits are validated server-side and streamed as a card; the model never writes. Admin AI credentials are sealed behind admin-gated functions and never reach the browser in full.
Files
Receipts up to 5 MB live in a private storage bucket under your own folder, with storage policies keyed on that prefix. Opening one requires an ownership check and issues a five-minute signed link.
Your controls
Privacy mode blurs every amount for screen shares. Settings offers a full JSON export, a CSV ledger, a calendar feed, and a clear-my-data action, so leaving is always one click away.
In plain words
What Worth Clarity will and will not do with your data
- Store only what you enter, plus your name and email from Google.
- Keep every row isolated to your account at the database level.
- Share household numbers as aggregates only, never transactions.
- Let you export everything, in JSON and CSV, at any time.
- Never sell your data or use it for advertising.
- Never let the AI assistant write to your ledger without your confirmation.
- Never read another user's amounts, notes, or category names from the admin panel.
- Tell you clearly if any of this ever changes.
Everyday protections
The small things that add up
Isolated at the database
Every row you own is protected by Postgres row-level security. Even the AI assistant's tools run on your session, so nothing can reach across accounts.
Google sign-in only
No passwords to leak. Google tells us your name and email, and that is all the identity Worth Clarity stores.
Privacy mode
One tap blurs every amount, chart axis, and tooltip for screen shares and public places. Remembered so figures never flash readable on load.
Households share aggregates only
The only cross-user read in the whole system is a function returning headline totals. Transactions, notes, and categories never leave your account.
Receipts stay private
Attachments live in a private bucket under your own folder, opened through a five-minute signed link after an ownership check.
Yours to take with you
Full JSON export of every table, a spreadsheet-ready CSV, a calendar feed of your bills, and a clear-my-data action inside Settings.
Clarity you can trust with the real numbers.
Sign in with Google. Your ledger starts empty, private, and yours.
Free during early access. No card. Export any time.