Your net worth stays with you. There are no analytics and no tracking. Only if you use “Together” to share expenses with other people does a small server hold those shared groups.
WorthFlow is a personal capital tracker for iPhone, iPad, Mac and Android. It records what you own and what it is worth over time, and lets you split expenses with other people in “Together”. This policy explains exactly what the app does with that information.
Your net worth: nothing. Accounts, balances, assets, transactions, bank statements and history never reach the developer. There are no usage statistics, no crash reports and no advertising identifiers.
The app works without any sign-up. An account exists only if you sign in to “Together” — see Shared expenses (“Together”) for exactly what that server holds.
The app contains no analytics and no advertising frameworks. The iPhone, iPad and Mac app uses no third-party SDKs. The Android app uses Google’s own components for two things only: Firebase Cloud Messaging to deliver “Together” notifications, and Google Sign-In to sign in to “Together”.
Everything you enter — accounts, balances, assets, transactions and history — is stored locally on your device, inside the app's private storage, protected by the device's own file encryption.
If you turn on iCloud Sync in Settings, that same data is also stored in your own private iCloud database so it can appear on your other devices. It is held in your personal iCloud account under Apple's terms; the developer of WorthFlow has no access to it and cannot read it. Turning the setting off stops syncing.
Backup files you create with the export feature are written wherever you choose to save them. They are plain files under your control, and the app does not upload them anywhere.
“Together” is optional. If you never sign in to it, nothing on this server concerns you.
If you do, the WorthFlow server at worthflow.dev-industry.tech, run by the developer,
stores what the members of a group need to see the same thing:
Where. The server runs on DigitalOcean in London, United Kingdom. Its encrypted daily database backups are stored in Cloudflare R2. Nobody but the developer has access to either.
The server never receives your net worth, your other accounts, your bank tokens or your bank statements. Group names, notes and push tokens are encrypted in the database. Shared expenses are not end-to-end encrypted: the server can read titles and amounts, because it adds repeating expenses and checks that every split adds up.
Notifications. When someone adds an expense or a settlement, the other members get a notification with who did it, the title and the amount. Apple (Apple Push Notification service) delivers it to iPhones, iPads and Macs; Google (Firebase Cloud Messaging) delivers it to Android phones. You can turn notifications off in your device settings at any time.
“Suggest right after payment” (Monobank, optional). If you turn this on, the app registers a secret address of the WorthFlow server with Monobank, using your own Monobank token on your phone. When you pay by card, Monobank calls that address; the server does not read or keep what the bank sends — it only wakes your phone with an empty notification. The phone then reads the statement itself and asks “split this?” only if a trip or a rule of yours matches. The server keeps a one-way hash of the address and nothing else. Turning the switch off removes it.
How long. Your account and your groups are kept until you delete them. A sign-in lasts 90 days, then the app asks you to sign in again; signing out ends it at once. Technical records that prevent a change from being applied twice are deleted after 30 days. Daily database backups are kept for 30 days, so deleted data leaves the backups within that time.
The app talks to a small, fixed set of services, and only for the purposes below. None of them receive your balances, your holdings, or anything that identifies you.
| Service | Purpose | What is sent |
|---|---|---|
worthflow.dev-industry.tech |
“Together” — shared expenses, only if you sign in | Your groups and what you add to them; see above |
| Apple / Google sign-in | Signing in to “Together” | Handled by Apple or Google; the app receives a signed token with your identifier and, if shared, your name and email |
api.frankfurter.dev |
Currency exchange rates | Currency codes only (e.g. USD, EUR) |
open.er-api.com |
Exchange rates for currencies the European Central Bank does not publish | Currency codes only (e.g. UAH) |
api.coingecko.com |
Cryptocurrency prices | Asset identifiers only (e.g. bitcoin) |
api.monobank.ua |
Optional bank connection | Your personal Monobank token, only if you add one |
acp.privatbank.ua |
Optional bank connection | Your personal PrivatBank token, only if you add one |
api.binance.com |
Optional exchange connection | Your Binance API key signature, only if you add one |
tradernet.com |
Optional broker connection (Freedom24) | Your Freedom24 public key and request signature, only if you add one |
All requests use HTTPS. The rate services are contacted regardless of whether you connect a bank; the bank, exchange and broker services are contacted only if you set up that connection yourself, and the WorthFlow server only if you sign in to “Together”.
Connections are entirely optional — the app is fully functional without them, and you can enter balances by hand.
ThisDeviceOnly protection level (on Android, encrypted with a key in the
Android Keystore). They stay on the one device: they are not
synced to iCloud Keychain, are not included in device backups, and are never transmitted
anywhere except to the service they belong to — including to the WorthFlow server.If you enable the app lock, authentication is performed by iOS. WorthFlow is told only whether authentication succeeded. Your biometric data is never available to the app.
Your data is never sold, rented, or used for advertising or profiling. What you add to a “Together” group is shared with the members of that group, and with nobody else.
WorthFlow is a general-audience finance tool and is not directed at children, and “Together” is not meant for them.
Deleting the app removes all of its local data from that device. If iCloud Sync was enabled, the synced copy can be removed in iOS Settings under your Apple Account → iCloud → Manage Account Storage. Backup files you exported yourself are deleted like any other file.
“Together”. “Delete Together account” in the app deletes your account, your devices and your sign-in from the server at once. Groups where nobody else has an account are deleted whole. In groups with other people, the expenses and debts stay, under your name, so their balances still add up. A group administrator can also delete a whole group for everyone. To get a copy of what the server holds about you, or to have it deleted without the app, write to the address below.
If this policy changes, the updated version will be posted on this page with a new date above.
Questions about privacy: aleksei_manzhos@icloud.com