Privacy policy

WorthGraph is a financial-life management platform operated by Tapforce LLC ("we", "us"). This policy explains what we collect, why, who can see it, how we protect it, and how to get it back or have it erased.

It applies to the WorthGraph web application at worthgraph.app and to the background jobs that keep your connected accounts in sync. Questions, requests and complaints all go to support@worthgraph.app, and a person answers them.

WorthGraph is not affiliated with, endorsed by, or sponsored by Intuit Inc. QuickBooks and QuickBooks Online are trademarks of Intuit Inc.

Information you give us when you create an account and use the service:

• Your name, email address and the phone number or authenticator you register as a second factor.
• The records you build in WorthGraph: entities, people, accounts, liabilities, transactions, documents, books and tax records.
• Sensitive identifiers you choose to store — Social Security numbers, ITINs, EINs, and full account, card and routing numbers. These are encrypted before they are written down and are masked everywhere in the interface until you deliberately reveal one.

Information from services you connect, and only after you authorize the connection:

• QuickBooks Online. We request the accounting scope (com.intuit.quickbooks.accounting) and nothing else. Within it we read your chart of accounts, transactions and journal entries, and your company profile, and we write back the changes you make in WorthGraph. We also store the company (realm) identifier and the OAuth access and refresh tokens that let us do so. We do not request or receive payroll or payments data.
• Bank and card accounts you link through Plaid, and Mercury business banking, on the same principle: only what the connection you authorized returns.
• Documents you upload, email in, or import — including the text we recognize inside them.

Information the software records about itself:

• An append-only audit trail of who did what and when — sign-ins, permission changes, connections, document downloads, and every reveal of a sensitive value.
• Operational logs and error reports, scrubbed of personal information before they leave the application.

We use your information to operate WorthGraph: to show you your financial position, to keep connected accounts in sync, to produce books and reports, to process the documents you give us, to authenticate you, to notify you about your own account, and to investigate problems you report.

We want to be unambiguous about the things we do not do, because these are the questions worth asking of anyone holding this data:

• We do not sell your information, and we do not share it with anyone for their own marketing.
• We do not use your information, or anything we receive from QuickBooks Online, for advertising or ad targeting.
• We do not use your information, or anything we receive from QuickBooks Online, to train machine-learning models — ours or anyone else’s — and our providers are not permitted to do so either.
• We do not combine one customer’s data with another’s, and we do not build cross-customer profiles or benchmarks from it.

Your data belongs to your workspace and is visible only inside it. Each workspace is isolated at the database level as well as in the application, and every query we run is scoped to the workspace of the person making the request.

Three categories of people can see a given record, and no others:

• You, and the people you invite to your workspace — each limited to what their role permits.
• An accounting firm, but only for the entities you have explicitly granted it access to, and only for as long as that grant lasts. You can revoke a grant at any time; access ends immediately. Notes the firm wrote for itself stay with the firm and stop being visible to you.
• A small number of our staff, when it is necessary to operate the service or to answer a support request you raised — under the same audit trail as everyone else.

We disclose information to a government or law enforcement body only where we are legally required to, and we will tell you unless we are prohibited from doing so.

WorthGraph can use AI to read documents, suggest transaction categories, and match records to one another. This is a per-workspace setting, and it is off unless someone with the authority to do so turns it on. While it is off, no document content and no transaction data is sent to any AI or OCR provider — the request is refused before a provider is even contacted, and the refusal is recorded.

When it is on, this is exactly what happens:

• Text recognition runs on our own machines. Document images and the text recognized from them are not sent to any recognition service.
• Before any text is sent to an AI provider, Social Security numbers, ITINs, EINs and long account and card numbers are masked out, keeping only the last four digits. The remaining content — which is the substance of the document — is what the provider sees.
• Transaction data, including transactions synced from QuickBooks Online, may be sent to an AI provider to propose a category or a match. A proposal is a suggestion; a person accepts or rejects it.
• Every AI run is recorded in your audit trail: what was attempted, whether it was allowed, and what came back.

Decrypted sensitive identifiers are never sent to an AI provider under any setting. Turning the setting off stops all of this immediately and permanently for your workspace.

We use a small set of providers to run WorthGraph. Each is bound to use the data only to provide its service to us:

• Vercel — application hosting and compute, and the AI gateway through which model requests are routed.
• Supabase — the database, authentication, document storage and the key vault. Hosted in the United States (US East).
• Inngest — the scheduling of background jobs such as overnight syncs.
• Resend — outbound email, and the inbound address you can forward documents to.
• Twilio — SMS, used for authentication codes.
• Sentry — error monitoring, with personal-information scrubbing enabled.
• Intuit, Plaid and Mercury — the financial services you choose to connect. Data flows to and from these only because you authorized the connection.
• Box — electronic signature, for documents you send for signing.

Your information is processed and stored in the United States. If you are outside the United States, connecting to WorthGraph means your information is transferred there.

Security is a design constraint here rather than a policy statement, so these are properties of the system rather than intentions:

• Sensitive values — identifiers, full account numbers, connection tokens, recognized document text and extracted fields — are encrypted before they are stored, with a key unique to your workspace. The encryption is bound to the exact record and column it belongs to, so ciphertext moved somewhere else does not decrypt.
• The key that protects those keys is held in a managed vault, separate from the database.
• Every page that shows your data requires a signed-in session and a verified second factor. Revealing a sensitive value requires you to prove that factor again, and the reveal is written to the audit trail.
• Your browser never holds a database credential. Every read and write goes through our server, which applies your permissions; the database enforces workspace isolation independently as a second line of defense.
• Traffic is encrypted in transit. Audit records are append-only — they cannot be edited or deleted, including by us.
• We do not log request bodies, records, or tokens, and personal information is scrubbed from error reports.

No system is perfect. If we discover a breach affecting your information we will notify you without undue delay, and describe what happened and what we are doing about it. Security issues can be reported to support@worthgraph.app.

You can disconnect QuickBooks Online from inside WorthGraph, on the page for the set of books it is connected to. When you do:

• We tell Intuit to revoke the authorization, and the access and refresh tokens we hold are erased from our database. We cannot reach your QuickBooks company again without a fresh authorization from you.
• All syncing stops immediately, in both directions. No further data is read from or written to QuickBooks Online.
• The disconnection is recorded in your audit trail.
• Records already synced into your workspace remain there, because they are now part of your books and deleting them would destroy work you have done. You can delete them yourself, or ask us to erase everything by closing your account.

You can also remove WorthGraph from the My Apps page in QuickBooks Online. Intuit then revokes our access: the tokens we hold stop working, nothing more can be read from or written to your QuickBooks company, and the next time we try to reach it the connection shows in WorthGraph as needing reauthorization. The revoked tokens stay encrypted in our database until you disconnect inside WorthGraph or close your account, and either of those erases them.

Reconnecting is the same flow as connecting the first time, and requires you to authorize again.

We keep your information for as long as your account is open, and then only as described here.

• Export. A workspace owner can export everything in the workspace — records and documents — at any time, after re-proving their second factor.
• Deletion. Most records soft-delete first, so a mistake is recoverable, and are then removed permanently. A workspace owner can hard-delete records outright once retention rules allow it.
• Closing your account. Ask us and we will erase your workspace. Connection tokens are destroyed immediately.
• The exception. Filed tax returns cannot be altered or deleted, because a filed return is a record of something that happened. Where a retention period applies to one, it is kept encrypted and inaccessible until that period ends, and is then purged.
• Audit records are retained for the life of the workspace, because a security trail that can be trimmed is not a security trail.

To export, delete, correct anything, or ask what we hold about you, write to support@worthgraph.app. We will respond within 30 days. Depending on where you live you may have additional rights over your information; we honour them regardless of whether they apply to us by law.

WorthGraph is a tool for managing financial affairs and is not directed at children. We do not knowingly collect information from anyone under 18. A workspace may contain information about a child — a dependent on a tax return, for example — which is information about them provided by you, not collected from them.

We will update this page when the way we handle information changes, and we will change the date at the top when we do. If a change materially reduces the protection your information gets, we will tell you before it takes effect rather than after. The current version always lives at worthgraph.app/privacy.