OW OwnWorth

Security

You are being asked to type your household's entire financial position into a website. Here is exactly what happens to it.

The structural protection

OwnWorth has no connection to any bank, and no ability to move money. There is no Open Banking link, no payment initiation, no stored bank credentials. Even in the worst case — someone gets into your account — the damage is that they see numbers. They cannot take anything, because there is nothing to take from.

This is a deliberate trade. Connected apps update themselves; OwnWorth asks you to confirm values once a month. In exchange, the category of risk that matters most simply does not exist here.

Where your data lives

On your device	Your figures are stored in your browser. If you never create an account, they never leave it.
In the cloud (only if you sign in)	Supabase, EU region, protected by row-level security so one account cannot read another's.
In transit	HTTPS throughout.
Sign-in	A link emailed to you, or Google. There is no password for us to store or leak.
Market prices	Price lookups send only ticker symbols — never your holdings' size, your totals or your identity.
Payments	Stripe. Card details never reach OwnWorth's servers.

Who else processes it

Supabase — database and authentication (EU region)
Vercel — hosting
Stripe — payments
Resend — the emails you trigger
Cloudflare — domain and email routing

Each processes only what its part of the service requires. None receives your figures for any other purpose, and none of it is sold to anyone, ever.

Getting your data out, and getting rid of it

Export — a full download of everything, any time, from Import & backup. It is a plain file you keep.
Delete — one button in Account. It cancels any active subscription first, then erases your data from the cloud and this device.
What survives deletion — payment records held by Stripe and by us for accounting, which UK law requires us to keep for about six years, and any feedback you sent, stripped of any link to you. Both are stated in the privacy policy.

Reporting a problem

If you find a security issue, email hello@ownworth.app and we will respond. Machine-readable details are at /.well-known/security.txt.

What we don't claim

OwnWorth is a small independent product. It has not been through a SOC 2 audit or a formal penetration test, and saying otherwise would be a lie. What it has instead is a small attack surface: no bank links, no money movement, no passwords, no card data, and a delete button that genuinely deletes. Judge it on that.

OwnWorth is a record-keeping and planning tool, not financial advice, and we are not regulated to give any. Nothing on this page is a guarantee against every possible risk — it is a plain description of how the product is built.