PRIVACY POLICY
Effective from 10 October 2026
The short version
WorthMap is operated by HK Managed Services Provider Limited, a company incorporated in Hong Kong with registered office at Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong ("WorthMap", "we", "us" or "our"). We are the data controller for the personal data described in this policy. You can contact us about anything in this policy at [email protected].
This policy applies to the WorthMap apps for iOS and Android, the web app at my.worthmap.com and the related website and services (together, the "Service"). WorthMap is available worldwide. We apply the standards of the EU General Data Protection Regulation (GDPR) to every user, wherever they live, and we also comply with the Hong Kong Personal Data (Privacy) Ordinance and the other privacy laws that apply to you (see section 10).
What we collect
| Data | Why we need it |
|---|---|
| Email address | To create your account, sign you in, send you one-time login codes and security alerts, and answer you if you write to us. |
| Nickname | So the app can greet you. Pick any name you like: it doesn't have to be your real one. |
| Password and sign-in credentials | To protect your account. Your password is stored only in hashed form; we can never read it. If you use a passkey, only its public key is stored — your fingerprint or face never leaves your device. If you sign in with Apple or Google, we use only the email address they share with us. Google may also pass the name and picture of your Google account to our sign-in provider; we don't use them. |
| The wealth data you enter | Assets, liabilities, incomes, expenses, transactions, watchlists and settings. This is the core of the Service: we store it only to calculate and show you your own portfolio. It is labelled by you (for example "Family home" or "Savings account"); we never ask for account numbers. |
| Documents you choose to import | If you import a broker statement, the file is processed only to extract your holdings into your account. Please note such statements may contain your name or account numbers; you can remove them from the file before uploading. |
| What you send to the AI features | If you use the stock chat or voice assistant, the questions you type or speak are processed to answer you (see section 4). |
| Messages to our support | What you write to us in the support chat, including any screenshot you choose to attach, so we can help you and fix problems. |
| Technical and security data | Your IP address, device type and model, operating system and app version, the sessions and devices signed in to your account, and error reports when something goes wrong. We use this only to keep your account secure (for example to detect a sign-in from an unknown device), to show you your active sessions, and to fix bugs. |
| Push notification token | Only on the mobile apps, and only if you allow notifications, so we can send you the alerts you have switched on. |
What we don't collect
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing your account and the features of the Service | Performance of our contract with you (Art. 6(1)(b)) |
| Keeping the Service and your account secure, preventing fraud and abuse, fixing errors | Our legitimate interest in a safe, working service (Art. 6(1)(f)) |
| Answering your support requests and feedback | Performance of our contract, and our legitimate interest in improving the Service |
| Sending the notifications you have switched on | Your consent, which you can withdraw at any time in the app or your device settings (Art. 6(1)(a)) |
| Keeping records the law requires | Legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising, we do not build marketing profiles, we do not sell or rent your data, and we do not share it with anyone for their own purposes. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Some optional features use artificial intelligence: stock analyses, the stock chat, the voice assistant and the import of broker statements. These are provided with the help of AI model providers, currently xAI (Grok). When you use them, only what is needed for that request is sent — for example your question, the stock you are looking at, or the file you chose to import — and it is not used by us to identify you. When you use the voice assistant, your voice is streamed directly from your device to the provider while the conversation is open; we do not record or store your voice. AI answers can be wrong and are never financial advice.
We use a small number of service providers ("processors") who handle data only on our instructions, under contracts that require them to protect it and forbid them from using it for their own purposes:
| Provider | What they do |
|---|---|
| Google (Firebase Authentication, App Check, Google Cloud) | Sign-in, account security and hosting |
| Cloudflare | Web hosting, protection against attacks, and the security check on the support chat |
| xAI | The optional AI features (section 4) |
| Apple and Google | "Sign in with Apple / Google" if you choose it, and delivery of push notifications on the mobile apps |
| Our support chat service (operated on hkmsp.com) | The in-app support chat |
Market data (share prices, exchange rates and company information) is supplied to us by EODHD. This is public reference data: we do not send them any personal data about you. The only exception is technical: company logos in the stock details are loaded directly from EODHD's servers, which, like any website, see your device's IP address when the image loads.
We may also disclose data where the law requires it (for example a valid court order), and in that case only what is strictly required.
We are based in Hong Kong and our providers operate servers in several countries, including the United States and the European Union. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent) and additional safeguards. You can ask us for more information about these safeguards.
| Data | How long |
|---|---|
| Your account and the wealth data you entered | For as long as your account exists. When you delete your account, it is deleted within 30 days. |
| Support conversations | For as long as your account exists, or until you ask us to delete them. |
| Security logs (sign-ins, sessions, devices) | Up to 12 months. |
| Error reports | Up to 12 months. |
| Records we must keep by law | Only as long as the law requires. |
We protect your data with encryption in transit, hashed passwords, secure HttpOnly session cookies, optional passkeys and two-step verification, alerts on new sign-ins and automatic sign-out after inactivity. Access to data on our side is limited to the people who need it to run the Service. No system is perfectly secure; if a breach ever affects your data, we will tell you and the authorities where the law requires it.
The following cookies and local storage are necessary for the Service to work:
We do not use advertising or third-party tracking cookies. Optional first-party interaction analytics run only with your consent, after sign-in on my.worthmap.com. They collect page categories, structural click locations, viewport dimensions, scroll depth, time on pages and error counts to find usability problems. They never capture screen contents, typed text, balances, account details or error messages. Events are grouped with random visit identifiers; we do not store your account identifier in the analytics table. Events stay in Worthmap’s Google Cloud database, accessible only to authorised administrators, and are not sent to Microsoft Clarity or Google Analytics. Events expire after 30 days; automatic deletion and existing database backup expiry can take additional time. Your choice is stored on this browser. You can decline or withdraw consent in Profile at any time without affecting your account; this stops future collection. Visits before consent and native app activity are not collected.
Wherever you live, you can ask us to:
Email [email protected] from the address registered to your account. We answer within 30 days and never charge for it. To delete your account, follow the steps on our account deletion page. You can also export your wealth data yourself at any time from the app.
These rights are given by, among others, the GDPR and UK GDPR (European Economic Area and United Kingdom), the Hong Kong Personal Data (Privacy) Ordinance, the California Consumer Privacy Act (we do not sell or share personal information as defined by that law), the Australian Privacy Act (you may use a pseudonym, as WorthMap allows), Brazil's LGPD, Canada's PIPEDA and China's Personal Information Protection Law. You also have the right to complain to the data protection authority where you live — for example your national authority in the EU, the UK Information Commissioner's Office or the Hong Kong Privacy Commissioner for Personal Data — although we would like the chance to help you first.
The Service is only for people aged 18 or over. We do not knowingly collect data from anyone younger; if you believe we have, contact us and we will delete it.
If we change this policy, we will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.