Privacy Policy

Last updated: June 2026 (AI Assistant disclosure Added) — Worth Flow is a personal hobby project, not a commercial service.

What we collect

• Email address - collected by Amazon Cognito when you create an account. Used only for authentication and password-reset emails.
• Financial plan data - stored in Amazon S3 only if you explicitly save your plan. Your data is written to a private cloud storage prefix that is scoped exclusively to your account; no other user or the application can access it.
  Note: The initial base scenario created during onboarding is automatically saved once it has been generated so that your starting plan can be restored later.
• Auth tokens - short-lived session tokens stored in your browser's memory / localStorage by aws-amplify, used to authenticate S3 requests. They are cleared when you sign out.

What we do not collect

• No analytics or tracking cookies.
• No advertising. We never sell or share your data with third parties for their own use. (The one outbound flow is the optional AI assistant - and only if you turn it on with your own key; see below.)
• No passwords - authentication is handled entirely by Amazon Cognito.
• No financial values, projection results, or any content of your plans - beyond the encrypted file you choose to save, and, if you enable the AI assistant, the forecast figures you choose to send to Google with your own key (see below).

Third-party services

Worth Flow uses the following AWS services for accounts and cloud saves:

• Amazon Cognito - user authentication, email verification, and password reset.
• Amazon S3 - encrypted storage for your saved plans, in a private per-user prefix.
• Amazon SES - delivery of Cognito transactional emails (sign-up verification, password reset).

These services are governed by AWS's privacy policy.

AI assistant (optional, bring-your-own-key)

Worth Flow has an optional AI assistant powered by Google Gemini. It is off by default and only works if you add your own Google API key. When you use it:

• Your forecast figures, account/instrument summaries, and active scenario are sent directly from your browser to Google under your own API key. No Worth Flow server is involved - there is no application server in this path.
• Your account credentials and internal record IDs are never sent.
• Your API key and your chat history are end-to-end encrypted in your browser with a passphrase only you know (zero-knowledge). Worth Flow stores only the encrypted form and can never read either - see the Security page.
• Google's handling of the data you send is governed by the Gemini API terms.
• You can remove the key and wipe the stored chat at any time from the assistant's key settings (Remove key & chat).

Data retention & deletion

• Delete individual saves - from your Profile inside the app.
• Delete your account & all data - open an issue on GitHub and your Cognito user and S3 data will be removed.

Cookies & local storage

Worth Flow uses browser localStorage to store your active plan state and auth session tokens locally. No tracking cookies are set. If you clear your browser's storage, your local plan state is erased (cloud saves are unaffected).

Changes to this policy

As a hobby project, this policy may be updated occasionally. Significant changes will be noted on this page with an updated date. Continued use of the app after changes constitutes acceptance.

Contact

Questions? Open an issue on GitHub.