Privacy Policy

Overview

Honest Expenses is operated by German Bayatyan, Karl-Krull-Straße 18b, 17491 Greifswald, Germany ("we", "us", or "our"; see the Impressum), who is the controller of your personal data. This Privacy Policy describes how we handle personal data when you use the website and web app at honestexpenses.app, the installable app, our iOS and Android apps and the Telegram bot @honestexp_bot (the "Service"), and the rights you have in relation to that data.

We do not sell your personal data. Analytics and advertising cookies are used only if you allow them in the cookie banner; before that, Google's tags send only cookieless pings (see Cookies).

You can sign in with Telegram, or — if you don't use Telegram — with Apple, Google, GitHub or an email address and a password.

Definitions

• Personal Data — Any information that identifies or can identify a natural person.
• Cookies — Small text files stored on your device by your browser.
• Data Controller — German Bayatyan, who determines the purposes and means of processing personal data in the Service.
• Data Processor — Third-party service providers that process data on our behalf.

Data We Collect

Account Data

Telegram. If you sign in with Telegram, we receive and store your Telegram user ID, your first and last name, your username and your profile photo (a copy is kept so the app can show it). We do not receive your phone number.

Google. If you sign in with Google, Google confirms your identity to us and we receive and store your Google account ID, your email address (only when Google has verified it), your name and your profile picture (a copy is kept so the app can show it without loading it from Google). We do not receive your Google password or access to anything else in your Google account. Nothing from Google is loaded on our pages: only when you choose Google are you redirected to Google's sign-in page, where Google processes the data of that interaction under its own privacy policy, and then back to us.

GitHub. If you sign in with GitHub, we receive and store your GitHub user ID, your name or username, your avatar (a copy is kept so the app can show it without loading it from GitHub) and your primary email address if GitHub has verified it. We ask GitHub only for your profile and email addresses (read-only) and do not keep any GitHub access token after sign-in.

Email and password. If you sign up with an email address, we store your name and your email address. We send you an email to confirm the address; you choose your password when you confirm it, and we store your password in a hashed form only (we never see or store the password itself). Until you confirm the address, you cannot sign in. A sign-up that is not confirmed within 7 days and was never used is deleted.

One email address belongs to one account: if you sign in with Google (or with GitHub's verified primary address) using an address that already has a confirmed account here, you sign in to that account.

Connecting Telegram. If an account created with Google, GitHub or email is connected to Telegram, it becomes a Telegram account: from then on you sign in with Telegram only, and the Google, GitHub or email sign-in is removed from the account. So that signing in the old way tells you to use Telegram (instead of creating a new, empty account), we keep a pseudonymised one-way hash of the former sign-in (the email address or account ID is not stored in readable form; the hash is still personal data) for as long as the account exists.

Apple. If you sign in with Apple, Apple confirms your identity to us and we receive and store your Apple account ID, your email address — which may be an Apple private relay address that forwards to your own — and, only at the first sign-in and only if you share it, your name. We keep Apple's sign-in token in encrypted form only to revoke the sign-in at Apple when you delete your account. We do not receive your Apple password or anything else from your Apple ID.

Your Records

The data you enter — in the app, through the Telegram bot or by importing a CSV file: accounts and their balances, income and expense transactions (amount, date, category, note), transfers and categories. This data is necessary to provide the Service and is only visible to you.

Settings

Your language, time zone, the currency sign you chose, your accent color and your theme.

Billing Data

Payments are collected and processed directly by Stripe, our payment processor. Stripe also collects your billing address and, if you enter one, your VAT ID, to calculate the correct VAT. We do not store card numbers. We keep the purchase and subscription history needed to manage your plan (product, amount, date, status, receipt link, the Stripe customer ID).

Purchases inside our iOS and Android apps are paid to Apple (App Store) or Google (Google Play), not to Stripe. From the store we receive and keep with your account the product, the store's transaction or order IDs, the purchase and renewal dates, the status (paid, renewed, refunded, cancelled), whether it was a test purchase, and a random account token that ties the purchase to your account. We never receive your card or payment details. Refunds and the management of an app subscription are handled by the App Store or Google Play.

Telegram Bot

Messages you send to the bot are processed to record your transactions. The bot sends you messages about your records (for example the monthly summary) and about your payments (confirmations, refunds, renewals, failed payments).

Accounts without Telegram receive no messages from the bot and no notifications; the bot becomes available after connecting Telegram.

Service Emails

If you sign up with email, we send you only service emails: the link to confirm your address and, when you ask for it, the link to reset your password. We do not send newsletters or marketing emails. To protect these forms from abuse we keep, for 24 hours (deleted at the latest with the next email request after that), a keyed one-way hash of the address and of the network address that asked for an email (not the address itself), to limit how many emails can be sent. Payment receipts are sent by Stripe.

Technical Data

When you use the Service, our hosting provider processes technical data such as your IP address, browser and device type in server logs, to deliver the Service and keep it secure.

Legal Basis for Processing (GDPR Art. 6)

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases to process your personal data:

• Contract (Art. 6(1)(b)) — Processing your account data, your records, your settings and your billing data is necessary to perform the contract with you and provide the Service.
• Legitimate Interests (Art. 6(1)(f)) — We process technical data and the notifications described in Owner Notifications to keep the Service secure, to support you and to develop the product. Our legitimate interest does not override your fundamental rights and freedoms.
• Consent (Art. 6(1)(a), § 25(1) TDDDG) — Analytics and marketing cookies and the tools that set them (Google Analytics 4, Google Ads, Meta pixel, TikTok pixel) are used only if you allow them in the cookie banner. You can withdraw your consent at any time (see Cookies).
• Legitimate Interests (Art. 6(1)(f)) — Google Consent Mode — Before or without your consent, Google's tags send cookieless pings without identifiers for an aggregate measurement of how our website is used (see Before you choose). You can object at any time.
• Signing in without Telegram — Signing in with Google, GitHub or email and sending the confirmation and password reset emails are necessary to provide your account (Art. 6(1)(b) GDPR). Limiting how many emails a form can send is based on our legitimate interest in keeping the Service secure (Art. 6(1)(f) GDPR).
• Sign in with Apple and app purchases — Signing in with Apple and recording the purchases made in the App Store or Google Play is necessary to provide your account and your plan (Art. 6(1)(b) GDPR). Keeping the purchase records is a legal obligation where tax law applies (Art. 6(1)(c) GDPR) and our legitimate interest in proving which plan you have (Art. 6(1)(f) GDPR).
• Legal Obligation (Art. 6(1)(c)) — Payment and invoice records are kept for the periods required by tax and commercial law.

Owner Notifications

When you open the plans page, reach a limit of the Free plan, start a payment or leave it unfinished, the operator of the Service receives a notification about it in Telegram: your Telegram account (@username or name, ID), your current plan, the language of the interface, your country as determined from your IP address (not the address itself), your device type (phone / computer / Telegram Mini App) and where you came from. This is needed to support you and to develop the product. When you start a payment, the country, the device type and where you came from are also stored with the payment session at Stripe. Records of these notifications are kept for no longer than 30 days.

When you create an account, the operator is notified as well: your Telegram account (@username or name, ID), how you signed in (the Telegram bot, the Telegram Mini App or the sign-in button on the website), the language of the interface and — in the Mini App — of your Telegram app, your country as determined from your IP address (not the address itself), your device type and which plan you chose on the start page before signing in, if any. The record of this notification is also kept for no longer than 30 days.

The operator is also notified of purchases, refunds, failed payments and payment disputes.

For an account without Telegram (Google, GitHub or email), these notifications name the account by how you sign in, your profile name and a masked email address (for example j***@gmail.com) instead of a Telegram account. When such an account is connected to Telegram, the operator is notified of the move: the former sign-in method, profile name and masked email address, your Telegram account (@username or name, ID), your plan and the language of the interface. These records are also kept for no longer than 30 days.

AI Features

When you use an AI feature — a voice message, a photo of a receipt or a typed description, in the app or in the Telegram bot — we send that recording, photo or text, together with the names of your accounts and categories and today's date, to Google's Gemini API. It returns suggested operations (drafts). Nothing is saved until you confirm a draft; you can edit or discard every draft.

• We do not store your recordings and photos — not in our database, not in file storage, not in our logs. They are processed in the memory of a single request and then discarded; in the bot, the file stays only in your Telegram chat.
• Drafts are kept temporarily until you save or discard them: in the app, the draft and its recording or photo stay only on your device (browser storage) for up to 24 hours, and are removed when you sign out or delete your account; in the bot, the suggested operations (amounts, dates, categories and a short note — never the file) are kept on our server for up to 12 hours.
• The note of a draft is written by the AI from your input; we remove links, e-mail addresses and phone numbers from it, and you see and can change it before anything is saved.
• We use Google's paid Gemini API, under which Google does not use your content to train its models. Google may keep requests for a limited time to detect abuse, as its terms describe.
• For each AI action we keep a record without any content: its type (voice, photo, text, assistant message), the time, your plan, the AI model used, the amount of data processed (tokens) and its cost. We need it to count your AI credits and to understand our costs. It is deleted with your account.

AI Assistant

When you ask the AI assistant in the app something — typed or as a voice message — we send Google's Gemini API your message or recording, the recent conversation (up to the last 10 messages), the names of your accounts and categories, today's date and the screen you have open, and what the assistant reads from your records to answer you: amounts, dates, categories, account names, balances and short excerpts of transaction notes (links, e-mail addresses and phone numbers removed).

• The chat is not stored on our server. It stays only on your device (browser storage) for up to 24 hours, and is removed when you start a new chat, sign out or delete your account. A voice message is not kept at all.
• The assistant only reads. Changes it suggests to your categories or transactions (for example creating, editing, moving or deleting) are made only after you confirm them, and can be undone for up to 24 hours.
• Each message to the assistant counts as one AI action, like the other AI features.

Apple Pay and Google Wallet

If you connect Apple Pay / Google Wallet and keep "Determine the category of new places with AI" on, the name of a place you haven't paid at before (and the amount) is sent to our AI provider (Google Gemini) to pick one of your categories; nothing else from the payment is sent.

Connected AI Apps

You can connect an AI app of your choice — for example Claude or ChatGPT — to your account (Settings → Connected apps). Only you can connect one: you sign in and confirm on our consent screen what the app may do (read your data, and optionally propose changes).

• What the app reads is sent to that AI service — account and category names, balances, amounts, dates and notes of your transactions — whenever it asks us on your behalf. That service is not our processor: it acts for you, under its own terms and privacy policy, and we do not control what it does with the data.
• Changes it proposes run only after you confirm them in that app, and can be undone; deletions and large changes you also confirm in our Telegram bot. We notify you in Telegram whenever a new app is connected. Transaction notes are sent only when the app asks for them.
• Your records may contain text written by others (for example a note you pasted). An AI app may treat such text as instructions; review what it proposes before you confirm.
• We keep a log of the app's requests without their content — which tool, when, the result and how long it took — for 30 days, to protect the service and to show you when the app was last used.
• For each app you connect we keep a record of the connection: the app's name, the address it returns to (its host), the permissions you gave it, and when it was connected and last used — so that you can see and disconnect it in Settings. The keys the app uses are stored only as one-way hashes. A connection lasts at most 90 days; after you disconnect it, or it expires, its record is deleted 30 days later. A connection you never completed is deleted after 10 minutes.
• With your account we also keep when you first connected an AI app and when one was last used. They are deleted with your account.
• A change waiting for your confirmation in Telegram is kept, with what it would change, for up to 1 day.
• You can disconnect an app at any time in Settings; signing out everywhere disconnects all apps.

Mobile Apps (iOS and Android)

Our iOS and Android apps show the same Service as the website, so everything in this policy applies to them too. In addition, the apps process the following.

No tracking in the apps

The apps do not show the cookie banner and do not load any analytics or advertising tags, whatever the website does. They contain no analytics, advertising or crash-reporting libraries, and we do not track you across other companies' apps or websites. Requests from the apps carry the app's version and platform (iOS or Android) in the browser identification (User-Agent), which our hosting provider processes in server logs like the other technical data.

Push Notifications

If you allow notifications, Apple (on iPhone) or Google's Firebase Cloud Messaging (on Android) gives the app a push token for your device. We store the token with the platform, the app version, the language of the interface and when it was registered and last used, to send you as push notifications what you would otherwise see in the app's notification center or receive from the Telegram bot — for example budget alerts, reminders, recorded recurring or card payments and messages about your plan. The text of each notification (which can include an amount, a place or a category name) passes through Apple's or Google's push service to reach your device; a notification waiting to be sent is kept on our server for up to 7 days. The token is deleted when you sign out in the app or delete your account. If Apple or Google tells us that a token is no longer valid (for example because the app was removed), we mark it inactive and never use it again; it is deleted with your account. You can turn notifications off at any time in your phone's settings.

Card Payments: Apple Pay (iPhone)

If you set up the iOS Shortcuts automation for Apple Pay — with our shortcut or, in the iOS app, with its "Record Apple Pay payment" action — your iPhone sends us, for each payment you make with the Wallet cards you selected, the amount, the name of the place (merchant) and the card's name as Wallet shows it (for example "Visa ••1234"). We record the payment as an ordinary expense with the place as its note. No card numbers reach us: Apple does not give them to Shortcuts. If your iPhone is offline, the app keeps the payment on the device for up to 7 days and sends it when it is back online.

Card Payments: Google Wallet and Bank Notifications (Android)

Only if you turn on "Google Wallet & banks" in the app's Settings and allow the app Android's "Notification access":

• The app looks only at notifications of the payment apps that you ticked (Google Wallet by default; you can tick your bank's app from our list, or add another app installed on your phone — its name and its notifications then go through the same steps below, read with general rules). To let you pick such an app, the list of apps you can open on your phone is shown in the app; it never leaves your phone. On some phones Google Wallet's payment notices are shown by Google Play services, so its notifications are looked at too while Google Wallet is ticked. Notifications of all other apps are ignored on your phone — not read, not stored, not sent.
• Of a ticked app's notification the app reads the title and the text. If they contain no amount, the notification is dropped on your phone. A notification with an amount is kept on the phone, encrypted with a key of the Android Keystore, until it is sent to our server (its title, text, the app it came from and the time it was shown); after that only a one-way hash, used for two days to avoid recording it twice, stays on the phone.
• Our server checks whether it is a card purchase. If it is, we keep only the amount, the place (merchant), the card's name and the time, and record an expense exactly as for Apple Pay. The title and the text themselves are discarded right after this check: they are never stored and never logged. A notification that is not a purchase (a refund, a declined payment, an incoming transfer, a top-up, a security code and similar) is discarded without recording anything.
• If an amount was read wrongly, you can choose "Report a wrong amount" for an app. The app then shows you one example — the last payment notification of that app, with every digit except the amount replaced by dots — and sends it to us only if you tap "Send". We receive it as a message to help fix the reading, together with the app's name and a short part of your account ID; it is not added to your data.
• You can turn this off in the app's Settings, or withdraw the notification access in Android's settings, at any time.

The Device Key

So that card payments reach your account while the app is closed, the app creates a random key for your device — on iPhone after you sign in (on plans with Apple Pay recording), on Android when you turn on "Google Wallet & banks". The key stays on your device (in the iOS Keychain, or encrypted with the Android Keystore); we store only a one-way hash of it, its last four characters, the platform, how often it was used and when it was created and last used. It is deleted when you sign out in the app or delete your account.

Categories of Places You Pay At

For card payments from Apple Pay, Google Wallet or your bank, we remember in your account a short normalised form of each place's name (for example "rewe") together with the category it belongs to — taken from your own history, from your changes, or, for a new place, from our AI provider (see AI Features; you can switch this off in the app's Settings); up to 5,000 places. For each recorded payment we keep, for up to 90 days, which category it got and whether you changed it. Against recording a payment twice we keep the amount, the time and a one-way hash of the place's name; entries older than 14 days are removed with your next payment. A payment in another currency that waits for your answer keeps the amount, the currency, the place and the card's name for up to 2 days. All of this is deleted with your account.

Widgets

The home-screen widgets show a snapshot the app saves on your device: this month's and today's spending, the spending per day and your latest expenses (title, amount, day and category icon). Widgets have no access to our servers; the snapshot stays on the device and is deleted when you sign out. Widgets can be visible to others on your home screen — with "Hide amounts" on (in the app or on the widget) they show emoji instead of amounts.

Offline Entry

So that you can add an expense without a connection, the app keeps your account and category names and your frequent entries on the device; expenses you add offline wait on the device and are saved to your account when you are back online. Both are deleted when you sign out.

Face ID, Touch ID and Fingerprint Lock

If you turn on the app lock, the app asks your device's own biometric check (or your device passcode). Your biometric data is handled only by iOS or Android and never reaches the app or us: the app learns only whether the check succeeded, and keeps the on/off setting on the device.

Siri, Shortcuts, Quick Actions and Sharing

The app offers actions for Siri, the Shortcuts app and its icon (add an expense, dictate expenses, scan a receipt). They only open the app on that screen; we receive nothing from Siri (Apple processes what you say to Siri under its own terms). A photo you share to the app is kept on the device only until the app opens it (on iPhone at most 24 hours) and is then handled like a receipt photo taken in the app. The app asks for access to the microphone (and, on iPhone, to the camera and photos) only when you use voice entry or receipt photos.

Cookies and Similar Technologies

Cookies are small text files your browser stores for a website. We use them in three categories. Only the first is always on; the other two are used only if you allow them in the cookie banner. Before you choose, Google's tags are loaded but set no analytics or marketing cookies and send only cookieless pings (see Before you choose: Google Consent Mode); nothing from Meta or TikTok is loaded. Inside the Telegram Mini App we use no analytics or marketing cookies and load no Google tags at all.

Strictly necessary (always on)

Needed to provide the service you asked for (§ 25(2) no. 2 TDDDG). They are never used for tracking.

When you choose Google sign-in, Google's sign-in page (on Google's own site) may set Google's cookies under Google's privacy policy; our pages load nothing from Google.

We also use your browser's storage (local storage, session storage and IndexedDB) for the following, never for tracking:

The installable app also keeps its own files on your device so that it opens quickly and works offline.

Analytics (only with your consent)

We use Google Analytics 4, loaded through Google Tag Manager, both provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. They help us understand how the website and the app are used (pages viewed, device type, approximate region, how you found us) so we can improve them. IP addresses are not stored by Google Analytics 4. Data may be transferred to Google LLC in the USA; Google is certified under the EU–US Data Privacy Framework.

Google Analytics data is kept for 14 months, then deleted automatically.

With your analytics or marketing consent we also send one event from your browser when you create an account: that you signed up and how (Google, GitHub, email or Telegram), with a random event ID — nothing else. Google Analytics receives it only with your analytics consent, the advertising tools below (see Marketing) only with your marketing consent. We keep a note on your account that it was sent, so it is never sent twice. With your analytics consent the «Open in Telegram» links on our start page also carry a one-time random code. When you click such a link, we store the analytics identifiers of that visit with the code; when you start our Telegram bot with it, we link the code to that Telegram account. If that Telegram account then creates a new account, our server sends that one sign-up event for the website visit — to Google Analytics only. The code, the identifiers and the link to the Telegram account are deleted at the latest three days after the click (a code nobody clicked after about an hour), and at once if you withdraw your analytics consent while that page is open. Without either consent no sign-up event is sent; without your analytics consent the links carry no code and our server sends no event, and we store nothing for it.

With your analytics or marketing consent we also send one event when you buy a plan through our checkout and come back to our website: which plan, the amount paid and its currency, and the payment's transaction number — never your card or payment details, your name or your email address. Google Analytics receives it only with your analytics consent, the advertising tools below (see Marketing) only with your marketing consent. It is sent at most once per purchase (we keep a short-lived note on your account that it was sent), never from the Telegram Mini App, and not at all without either consent.

Marketing (only with your consent)

We use the Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland), loaded through Google Tag Manager, to measure whether our ads on Facebook and Instagram work (e.g. that a visit, sign-up or purchase came from an ad) and to show our ads to people who visited our site (retargeting). Meta may combine this with your Meta account and transfer data to Meta Platforms Inc. in the USA (EU–US Data Privacy Framework). For the data collected by the pixel and transmitted to Meta, we and Meta are joint controllers (Art. 26 GDPR); Meta's information: facebook.com/legal/controller_addendum.

We use Google Ads (Google Ireland Limited, address above), loaded through Google Tag Manager, to measure which of our Google ads lead to visits, sign-ups and purchases (conversion tracking; for a purchase with its value, currency and transaction number) and to show our ads to people who visited our site (remarketing). Data may be transferred to Google LLC in the USA (EU–US Data Privacy Framework).

We use the TikTok pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland), loaded through Google Tag Manager, to measure whether our ads on TikTok work (e.g. that a visit, sign-up or purchase came from an ad) and to show our ads to people who visited our site (retargeting). TikTok may combine this with your TikTok account and process data outside the EU, on the basis of the EU Standard Contractual Clauses. For the data collected by the pixel and transmitted to TikTok, TikTok's Business Products (Data) Terms apply; where we and TikTok decide jointly, we are joint controllers (Art. 26 GDPR).

With your marketing consent our tracking server (operated for us by Stape in the Netherlands, EU, see Server-side tagging) also sends the sign-up and purchase events directly to Meta (Conversions API) and TikTok (Events API), so that ad blockers or shortened cookie lifetimes don't break the measurement. It sends: the event (sign-up or purchase), for a purchase its value, currency and transaction number, an event ID (so the event isn't counted twice together with the pixel), the address of the page, the pixel's identifiers of your browser and of the ad click (the cookies above) if they are set, and your IP address and browser user agent as our server received them. We send no email address, phone number or other contact details (no «advanced matching»). Without your marketing consent nothing is sent to Meta or TikTok. Transfers to the USA and other countries as described for the pixels above.

Google Consent Mode: until you allow a category, the corresponding Google storage is set to «denied»; Google Tag Manager is loaded, but Google's tags send only the cookieless pings described above and no other tag runs.

Your choice and how to withdraw

You choose in the banner on your first visit: «Accept all», «Reject all» or «Manage preferences» — rejecting is as easy as accepting. Your choice is stored in the cookie_consent cookie for 12 months; after that, or when we change the purposes, we ask again.

You can change or withdraw your consent at any time, with effect for the future, under «Cookie settings» at the bottom of the start page and of these legal pages, or in the app under Settings → Legal → Cookie settings. When you withdraw, we delete the analytics and marketing cookies set on our domain and reload the page so that no tracking script stays active (Google Tag Manager then loads again with everything denied, as before a choice). Cookies that Google, Meta or TikTok set on their own domains can be deleted in your browser settings. You can also block or delete cookies in your browser at any time; without the strictly necessary ones you can't stay signed in.

Questions: info@honestexpenses.app.

Service Providers

We rely on the following service providers to operate the Service. They process data on our behalf under data processing agreements, except Telegram, which you use under Telegram's own terms:

We do not sell your personal data to any third party.

International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V:

• Stripe (USA) — Processes billing data under Standard Contractual Clauses (SCCs) and is certified under the EU–US Data Privacy Framework.
• Vercel (USA) — Hosts our application infrastructure. Data processing is governed by SCCs. EU traffic is routed to EU edge nodes where available.
• Google and Meta (USA) — With your consent (see Cookies), and for Google also the cookieless pings sent without it: data may be transferred to Google LLC and Meta Platforms Inc., both certified under the EU–US Data Privacy Framework.
• TikTok (outside the EU) — Only with your marketing consent (see Cookies): data may be processed by TikTok group companies outside the EU, on the basis of the EU Standard Contractual Clauses.
• Resend — Sends our service emails from its EU region; processing is governed by Standard Contractual Clauses and a data processing agreement. Google and GitHub — When you choose to sign in with them, they confirm your identity under their own terms (EU–US Data Privacy Framework).
• Apple and Google (USA) — If you use our mobile apps with push notifications, the notifications are delivered through Apple's push service or Google's Firebase Cloud Messaging; both companies are certified under the EU–US Data Privacy Framework.
• Apple and Google (USA) — When you sign in with Apple, Apple confirms your identity; purchases in the apps are made with Apple or Google under their own terms; both companies are certified under the EU–US Data Privacy Framework.
• Supabase — Our database and sign-in provider. Data is stored on EU-region infrastructure. Processing governed by SCCs.

You can request a copy of the relevant safeguards by contacting us (see Contact).

Data Retention

We keep your personal data for as long as your account exists. You can delete your account at any time in Settings → Delete account. Then:

• Your account, profile, records, categories, settings and profile photo are deleted immediately and for good, and your Telegram account is unlinked.
• A running website subscription is cancelled at once and your customer record at Stripe is deleted (for an App Store subscription, see below).
• Stripe keeps the payment and invoice records that tax and commercial law require to be kept, for the periods the law requires.
• So that the free trial of a new account is given only once per Telegram account, we keep a one-way hash of your Telegram ID and the date of your trial. It does not contain your Telegram ID or anything else about you and cannot be linked back to your deleted account.
• The link between your account and your Google or GitHub account (the account ID and email) is deleted together with your account.
• Unconfirmed email sign-ups are deleted after 7 days if they were never used.
• The hashes that limit service emails are deleted after 24 hours (at the latest with the next email request).
• The pseudonymised one-way hash of a former Google / GitHub / email sign-in of an account moved to Telegram is deleted together with that account.
• The push tokens and device keys of your devices, the categories remembered for the places you pay at and the technical records of card payments are deleted together with your account.
• Signing out in a mobile app deletes that device's push token and device key and removes the app's copies of your data from the device (catalog, offline entries, widget snapshot, waiting card payments).
• The records of purchases made in the apps are deleted together with your account. Deleting the account cancels a Google Play subscription, but not an App Store subscription — cancel it in the App Store (Settings → Apple ID → Subscriptions on your iPhone). Apple and Google keep their own purchase records.
• If you signed in with Apple, the link to your Apple ID is deleted together with your account, and the sign-in is revoked at Apple first.

Google Analytics data is kept for 14 months; analytics and marketing cookies expire as listed under Cookies, or when you withdraw your consent.

Records of payment events and of owner notifications are deleted after 30 days. Nothing is ever deleted because of your plan.

Transactions you delete are hidden, not erased at once: they stay in your account so that a deletion can be undone, and are erased together with your account. When you delete a category together with its transactions, a copy of them is kept for about 30 days (at most your 20 most recent such deletions) so that you can undo it, and then erased.

Security

We take the security of your data seriously and implement industry-standard measures:

• All data is transmitted over HTTPS/TLS.
• Data is stored on Supabase (PostgreSQL), which enforces Row-Level Security (RLS) so no user can access another user's data.
• Every sign-in is verified; passwords of email accounts are stored only in hashed form, and Telegram, Google and GitHub sign-ins involve no password of ours at all.
• Access to production systems is restricted to the operator.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights

Under the GDPR and applicable data protection law, you have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of the personal data we hold about you.
• Rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Erasure (Art. 17) — Delete your account in Settings, or ask us to delete your data, subject to legal retention obligations.
• Portability (Art. 20) — Request your data in a structured, machine-readable format.
• Objection (Art. 21) — Object to processing based on legitimate interests.
• Restriction (Art. 18) — Request that we limit processing of your data in certain circumstances.

You cannot change the email address of an account yet; contact us if you need to.

To exercise any of these rights, contact us (see Contact). We will respond within 30 days (extendable by two further months for complex requests, with notice).

You also have the right to lodge a complaint with your local data protection supervisory authority. If you are based in the EU, you can find your authority at edpb.europa.eu.

Children's Privacy

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you in the app or through the Telegram bot.

Contact

If you have any questions about this Privacy Policy, please contact us:

• Telegram: @hermanviolin
• Email: info@honestexpenses.app
• Postal address: German Bayatyan, Karl-Krull-Straße 18b, 17491 Greifswald, Germany