Privacy Policy
Last updated: September 5, 2026
This policy explains what Worthy collects, how it is used, who it is shared with, and the choices you have. It applies to the Worthy mobile app and the Worthy web app at worthy.brettt.com.
1. What we collect
Account information
When you sign in, we store your email address, display name, and (if you sign in with Google) your profile photo URL. We use this to authenticate you and personalize the app.
Assets you add
Items you add to Worthy — name, category, purchase date, price, merchant, description, photo, and any notes — are stored in your Worthy account so you can see them across devices.
Receipts and email content
If you connect Gmail or forward receipts to your Worthy address, we process those messages to extract purchase details (merchant, date, total, items). The extracted details and the original receipt text are stored in your account. We do not read, store, or process email that does not look like a purchase confirmation.
Photos you upload
Receipt and asset photos you upload from the camera or your photo library are stored in your account so you can view them later.
Device and diagnostic data
If you enable push notifications, we store the Expo push token for your device so we can notify you when new assets are imported. We do not collect advertising identifiers and we do not track you across other apps or websites.
2. How we use it
- To authenticate you and keep you signed in.
- To turn receipts into assets and calculate current value.
- To look up market prices for items you own.
- To send push notifications you have opted into.
- To respond to support requests.
- To detect abuse and keep the service running.
We do not use your data for advertising. We do not sell your data.
3. Service providers
Worthy uses the following processors to operate the service. Each only receives the data needed for their role.
| Provider | Role | Data shared |
|---|---|---|
| Supabase | Database, authentication, file storage, serverless functions | Account info, assets, receipts, photos |
| Google (Gmail API) | Read-only access to scan inbox for receipts, only when you connect Gmail | Subject, sender, and body of messages that look like purchase confirmations |
| OpenAI | Extract structured purchase details from receipt text and images | Receipt text and receipt images you submit |
| Mailgun | Receive emails you forward to your Worthy address | The forwarded message contents |
| Expo (push notifications) | Deliver notifications to your device | Push token, notification title and body |
| Netlify | Host the Worthy web app | Standard web request logs |
| Apple, Google Play | Distribute the app and process any future in-app purchases | Whatever the app stores require for installs and crash reports |
4. Apple App Privacy categories
To match Apple's App Privacy label, the data we collect maps to:
- Contact Info — Email Address, Name. Linked to you, used for App Functionality, not used for tracking.
- User Content — Photos. Receipt and asset photos you upload. Linked to you, used for App Functionality, not used for tracking.
- Purchases — Purchase History. Extracted from receipts you import. Linked to you, used for App Functionality, not used for tracking.
5. Your choices
- Disconnect Gmail. Settings → revoke Worthy's Gmail access at myaccount.google.com/permissions.
- Turn off push notifications. Settings → Notifications, or your device's system settings.
- Edit or delete an asset. Open the asset and tap delete.
- Delete your account. In the app, open Settings, tap your profile, then tap Delete Account. We remove your assets, receipts, photos, and profile immediately. If you cannot sign in, email hi@brettt.com from the address you signed in with.
6. Data retention
We keep your data for as long as your account is active. When you delete your account, we delete it from our primary database immediately and from encrypted backups within 30 days.
7. Security
All data is encrypted in transit (TLS) and at rest. Authentication tokens on your device are stored in the iOS Keychain or Android Keystore via Expo SecureStore. We restrict server-side access to production data to a small number of administrators.
8. Children
Worthy is not directed to children under 13 and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
9. International users
Worthy is operated from the United States and uses providers hosted primarily in the United States. By using Worthy you consent to your data being processed there.
10. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be announced in the app.
11. Contact
Questions, requests, or concerns: hi@brettt.com.