Privacy Policy

CCWorth · last updated 3 August 2026

CCWorth ("the app", "we", "us", "our") is an independent tool that estimates whether your credit cards earn back their annual fees. This policy explains what personal data we collect, why, and your rights over it. In plain terms: to run your account we store your email and which cards you track; the figures you enter are stored on our servers so they sync across your devices; and you can delete everything at any time.

We do not sell or rent your personal data, show ads, or use third-party advertising trackers.

1. Who we are

CCWorth is operated by CCWORTH LTD, a company registered in England and Wales (company number 17347643), registered office 79 Chorlton Road, Manchester, M15 4AP, United Kingdom. For UK data-protection law we are the "data controller" for the personal data described below. You can reach us about privacy at [email protected] or through the in-app Support feature.

2. What we collect

Account & email. Your email address and an account identifier. Your password itself never leaves your device: it is scrambled on your device and we only ever receive the scrambled result, which we cannot turn back into your password. If you forget it you can reset it by email. We send a one-time code to your address to confirm it's really yours; we record only that it was confirmed and when. Your display name, if you set one, is saved to your account and shown to us when you contact support.
Which cards you track. The card products you add, your plan tier and billing period, your platform (web/iOS/Android), and first/last-seen timestamps.
Product usage. So we can see which features are used and improve the app, we record first-party analytics events tied to your account, for example which screen you're on, that you added a card, or that you started an upgrade. These are enumerable actions only: they never include your card figures or any other sensitive data. This is first-party analytics; it is not shared with advertisers, and there are no third-party or advertising trackers. Only signed-in accounts are counted.
Your card figures. The detailed values you enter (spend, benefit usage, valuations) are stored on our servers so they sync across your devices. We can read this data. It was previously encrypted with a key derived from your password; we changed that in July 2026 so that a forgotten password no longer means permanently lost data, and so we can help you when something goes wrong. It is encrypted in transit (HTTPS) and at rest by our hosting provider, and we only ever look at it to run or support the service. Your password itself is still never sent to us.
Payments. If you subscribe, our payment and subscription providers (Stripe for web checkout; Apple and Google for in-app purchases; RevenueCat, which manages mobile subscription status for us) process the payment: we never receive full card numbers. We keep a record of each transaction (amount, currency, store, product, date, and any promo code used).
Support messages you send us, so we can reply.
Technical logs. Our hosting provider processes limited technical data (such as IP address and request metadata) to deliver and secure the service and guard against abuse. We do not use this to build advertising profiles.

3. How we use it

To provide your account and sync it across your devices.
To identify you, give support, and respond to your requests.
To operate, secure and improve the service, and understand how the app is used through first-party analytics (see "Product usage" above).
To take payment, manage your subscription, and prevent fraud and abuse.
To comply with our legal obligations.

4. Who we share it with

We share personal data only with the providers that run CCWorth for us, acting as our processors under contract, or where the law requires it. These include:

Cloudflare: hosting, database and content delivery.
Stripe: web subscription payments.
Apple and Google: in-app purchases on their platforms.
RevenueCat: managing mobile subscription status.
Resend: sending account emails such as your one-time confirmation code.

We do not sell or rent your personal data. We may disclose data if required by law, to establish or defend legal claims, or to protect the rights, safety and security of our users or the service.

5. International transfers

Some of these providers process data outside the UK/EEA (for example in the United States). Where that happens, we rely on an approved safeguard, such as UK "adequacy" regulations or the provider's Standard Contractual Clauses / International Data Transfer Agreement, so that your data continues to receive an equivalent level of protection.

6. Legal basis & your rights

We process this data to perform our contract with you (running your account and subscription), on the basis of our legitimate interests (supporting, securing and improving the service, and preventing abuse), and to meet our legal obligations. Under UK GDPR you have the right to access, correct, delete, port, restrict or object to processing of your personal data. You can delete your account and all associated data at any time from Settings in the app, which removes your record and your backup from our servers. To exercise any right, contact us using the details in section 1.

If you have a concern we have not resolved, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Retention & security

We keep your personal data while your account is active and remove it on deletion. We may retain a limited set of records for longer where the law requires it (for example, transaction records needed for tax and accounting), and we may keep anonymised or aggregated data that no longer identifies you. Data is hosted on Cloudflare (KV and D1); transport is over HTTPS; your detailed card figures are additionally encrypted in transit and at rest, and access is limited to running the service. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

8. Children

The app is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

9. Changes

We may update this policy; the "last updated" date will change, and material changes will be highlighted in the app.