Privacy Policy

1. Who we are

WealthNest (“we”, “us”) provides a personal and family wealth-tracking application at wealthnest.uk. This policy explains how we handle information about you when you use it.

For any question about this policy or your information, contact privacy@wealthnest.uk.

2. Information we collect

Information you give us. When you create an account and use the app:

• Your name, email address and password. Passwords are never stored — only a bcrypt hash of them.
• Optionally, your mobile number, PAN and a profile picture. These are used for identification within your own account and are never required.
• Details of family members you add: their name, relationship to you, and optionally their email, mobile number, date of birth and nominee. Only add these if you are entitled to.
• Your financial records: holdings, transactions, liabilities, goals, and the metadata of documents you attach to them.

Information created as you use the app. A change log records what was edited, when, and the IP address it came from, so that an unexplained change in your net worth can be traced back. We also keep session records and short-lived rate-limiting counters keyed to your IP address to block brute-force attempts on sign-in.

We do not run analytics, advertising or third-party tracking on this application. There is no advertising network, no behavioural profiling, and no data broker involved at any point.

3. Statement files are read on your device

When you import a consolidated account statement, NPS statement or similar PDF, the file is opened and read inside your browser. Neither the file nor the password protecting it is uploaded to us or stored anywhere. Only the holdings you confirm on the review screen are saved to your account.

A statement reader that uses an AI model exists as a fallback for layouts the built-in parser cannot handle. It is disabled unless the deployment is configured with credentials for it, and when it is enabled the app tells you before you use it. In that case the text of the statement is sent to Anthropic for extraction. Anthropic does not train models on it. If you would rather this never happen, use the standard import, which does not call any external service.

4. Connecting a Gmail account

Connecting a mailbox is entirely optional and is set up per family member. If you connect one, we ask Google only for permission to read messages — we can never send, delete or alter anything in your mailbox. The access and refresh tokens Google issues are encrypted with AES-256-GCM before being stored, and you can disconnect at any time from the member’s page or by revoking access at myaccount.google.com/permissions.

Limited Use disclosure. WealthNest’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs is used only to identify and import your investment statements into your own account. It is never sold, never transferred to others except as needed to provide this feature or as required by law, never used for advertising, and never read by a human except with your explicit consent or where required for security or legal reasons.

5. How we use your information

We use what we collect only to run the service you asked for:

• To show your portfolio, calculate returns, and track progress against your goals.
• To sign you in and keep your session secure.
• To send you transactional email — verification codes, sign-in codes, password resets and alerts you have turned on. We do not send marketing email.
• To detect and prevent abuse, fraud and unauthorised access.
• To meet legal obligations where they apply.

We do not sell your personal information, and we do not share it with anyone for their own marketing purposes.

6. Who processes data on our behalf

We keep the list of third parties deliberately short. Each one is bound to use the data only to provide its service to us:

• MongoDB Atlas — the database your records are stored in.
• Vercel — hosting for the application.
• Resend — delivery of transactional email. Receives your email address and the message.
• Google — only if you connect a mailbox, or sign in with a mobile number (verification is handled by Firebase).
• Anthropic — only if the AI statement reader is enabled and you choose to use it, as described above.

We also fetch published net asset values from AMFI to price mutual fund holdings. This is a one-way public download; no information about you is sent.

7. How your information is protected

• All traffic is encrypted in transit with TLS.
• Passwords are hashed with bcrypt; mailbox tokens and statement passwords are encrypted at rest.
• Sign-in uses a short-lived access token with a separate rotating refresh token, so a stolen token has a narrow window of use. Sessions end automatically after a period of inactivity.
• Every query is scoped to your account. One account cannot read another’s records, and the app is tested against that specifically.

No system is perfectly secure, and we cannot guarantee absolute security. Use a strong, unique password and tell us immediately at privacy@wealthnest.uk if you believe your account has been accessed by someone else.

8. How long we keep it

Your records are kept for as long as your account exists, because a wealth tracker is only useful with its history intact. If you delete your account, your personal and financial records are deleted. Limited records may be retained where the law requires it, and backups are cycled out on a rolling basis.

9. Your rights

You can, at any time:

• See and correct the information held about you, from within the app.
• Export your holdings to CSV from any portfolio or member page.
• Disconnect a mailbox without deleting anything else.
• Ask us to delete your account and the data in it.

Depending on where you live — including under India’s Digital Personal Data Protection Act, 2023 — you may have further rights of access, correction, erasure and grievance redressal. Write to privacy@wealthnest.uk and we will respond within the period the law allows.

10. Cookies

We use cookies only to make the app work. There are no advertising or analytics cookies. Specifically: a secure, httpOnly cookie holding your session, a cookie remembering whose portfolio you are currently viewing, and a short-lived cookie used to complete a Gmail connection safely. Your theme preference is kept in your browser’s local storage and never sent to us.

11. Children

The service is not intended for anyone under 18. We do not knowingly create accounts for children. You may record a child as a family member within your own account; that information is yours and is treated like the rest of your records.

12. Changes to this policy

If we change how information is handled, we will update this page and the date at the top. Where the change is significant, we will tell you in the app or by email before it takes effect.

13. Contact

Questions, requests or complaints about your information: privacy@wealthnest.uk. If you are not satisfied with our response, you may raise the matter with the data protection authority in your jurisdiction.