Privacy
Last updated 21 September 2026.
Worthog is run from the United Kingdom and is the data controller for everything described here. In short, Worthog stores your figures so you can view them. It does not share or sell your data, use it for advertising or build a profile about you. You can export or delete your data at any time.
What Worthog stores
- Your email address, and a hashed form of your password. The password itself is never stored and cannot be recovered from the hash.
- The account names, groups and balances you type in, along with the date of each snapshot. Balances are stored as whole pence.
- Whether you have asked for a reminder when a snapshot is due, and the due date the last reminder was about.
- Session records, so you stay signed in, and so “sign out everywhere” can work.
Worthog does not connect to your bank or import anything from a financial institution. It does not ask for or store account numbers, sort codes or card details.
What Worthog does not store
Worthog uses no advertising, tracking pixels or third-party scripts. Its content security policy prevents your browser from loading content from another origin. Worthog does not build a profile about you or share, sell or disclose your data to another company.
Usage statistics
To see whether Worthog is useful, it counts a few things: which pages are visited, which of Worthog’s adverts a visit came from, if any, and the kind of device. On the home page, which sections come into view and which buttons are pressed. How far someone gets through signing up: starting, submitting, and whether it worked or, if not, the kind of problem, such as an address that already has an account. Whether a first account is added, counted only as something owned or owed, and whether a first snapshot is saved. And when someone saves a snapshot, is offered a reminder, or turns reminders on or off. For the spreadsheet import, whether a file or the example was chosen, whether it could be read, whether the result needed checking, and whether it was adjusted or saved. The counts are stored by PostHog in the EU. They travel through Worthog’s own address, so your browser never contacts PostHog directly.
The counts never include your balances, account names, email address or anything you type. Page addresses are reduced to the kind of page, so a snapshot is counted as a snapshot page rather than as your snapshot. The identifier an advertising network adds to a link, which could tie a visit to the person who clicked, is removed, and your IP address is discarded. Nothing is stored in your browser to recognise you from one visit to the next.
Cookies
Worthog uses one cookie to keep you signed in. It is marked HttpOnly and SameSite=Lax and is sent only over HTTPS. There is no cookie banner because Worthog uses no optional cookies, and the usage statistics use no cookies or browser storage at all. The one thing Worthog keeps in your browser is a spreadsheet import you chose to save before creating an account: the balances it found wait there, on your device, until you sign in and they are saved, and are cleared then or after a day, whichever comes first.
Why Worthog stores it
- To provide the service you signed up for. In UK GDPR terms, performance of a contract.
- To email you a link confirming your address, or one to reset your password. Also performance of a contract, and a necessary part of keeping the account secure.
- To email a reminder when a snapshot is due. This is consent, is off unless you switch it on, and can be switched off again in Settings at any time.
- To count visits and a few actions, so we can tell what is working. This is legitimate interests: the counts carry nothing that identifies you, and nothing is stored on your device to make them.
Who processes it
Three companies handle data on the service’s behalf, under contract, and for no purpose of their own:
- Netlify hosts the site, runs its server code and holds the database.
- Resend delivers the confirmation, password reset and reminder emails. It receives your email address and the contents of those messages, and no balances.
- PostHog stores the usage statistics described above, on servers in the EU. It receives no balances, account names or email addresses.
All three are United States companies, so they may process your data outside the UK, although PostHog stores the statistics in the EU. These transfers use the UK international data transfer addendum to the EU standard contractual clauses.
How long Worthog keeps it
Worthog keeps your data for as long as your account exists. If you ask us to delete it, we permanently remove your account and ledger without a recovery period. Export a copy first if you want to keep one. The hosting provider overwrites its backups on its own schedule, measured in weeks rather than years.
Your rights
Under UK GDPR, you can ask for a copy of your data, have it corrected or erased, object to or restrict how it is used, and withdraw consent for reminder emails. You can export your data as JSON or CSV and turn reminders off at any time in Settings.
To have your account and its ledger erased, or for anything else, email hello@worthog.app from the address you signed up with. Erasure is done by hand, within 30 days and usually within a few. If you are not happy with the response, you can complain to the Information Commissioner’s Office.
Security
Worthog encrypts traffic in transit and the database at rest, and hashes passwords with scrypt. The application and database restrict every read and write to one signed-in account, so one account cannot reach another’s figures. No system is perfect, and Worthog is a small independent service, so consider that when deciding what to record.
Changes
If this notice changes in a way that matters, we will change the date at the top and email everyone with an account. For smaller corrections, we will only change the date.