Privacy Policy

Overview

Honest Expenses is operated by German Bayatyan, Karl-Krull-Straße 18b, 17491 Greifswald, Germany ("we", "us", or "our"; see the Impressum), who is the controller of your personal data. This Privacy Policy describes how we handle personal data when you use the website and web app at honest-expenses.app, the installable app and the Telegram bot @honestexp_bot (the "Service"), and the rights you have in relation to that data.

We do not sell your personal data, we do not show advertising, and we do not use analytics or tracking tools.

Definitions

• Personal Data — Any information that identifies or can identify a natural person.
• Cookies — Small text files stored on your device by your browser.
• Data Controller — German Bayatyan, who determines the purposes and means of processing personal data in the Service.
• Data Processor — Third-party service providers that process data on our behalf.

Data We Collect

Account Data (from Telegram)

You sign in with Telegram. From Telegram we receive and store your Telegram user ID, your first and last name, your username and your profile photo (a copy is kept so the app can show it). We do not receive your phone number and we do not ask for an email address or a password.

Your Records

The data you enter — in the app, through the Telegram bot or by importing a CSV file: accounts and their balances, income and expense transactions (amount, date, category, note), transfers and categories. This data is necessary to provide the Service and is only visible to you.

Settings

Your language, time zone, the currency sign you chose, your accent color and your theme.

Billing Data

Payments are collected and processed directly by Stripe, our payment processor. Stripe also collects your billing address and, if you enter one, your VAT ID, to calculate the correct VAT. We do not store card numbers. We keep the purchase and subscription history needed to manage your plan (product, amount, date, status, receipt link, the Stripe customer ID).

Telegram Bot

Messages you send to the bot are processed to record your transactions. The bot sends you messages about your records (for example the monthly summary) and about your payments (confirmations, refunds, renewals, failed payments).

Technical Data

When you use the Service, our hosting provider processes technical data such as your IP address, browser and device type in server logs, to deliver the Service and keep it secure.

Legal Basis for Processing (GDPR Art. 6)

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases to process your personal data:

• Contract (Art. 6(1)(b)) — Processing your account data, your records, your settings and your billing data is necessary to perform the contract with you and provide the Service.
• Legitimate Interests (Art. 6(1)(f)) — We process technical data and the notifications described in Owner Notifications to keep the Service secure, to support you and to develop the product. Our legitimate interest does not override your fundamental rights and freedoms.
• Legal Obligation (Art. 6(1)(c)) — Payment and invoice records are kept for the periods required by tax and commercial law.

Owner Notifications

When you open the plans page, reach a limit of the Free plan, start a payment or leave it unfinished, the operator of the Service receives a notification about it in Telegram: your Telegram account (@username or name, ID), your current plan, the language of the interface, your country as determined from your IP address (not the address itself), your device type (phone / computer / Telegram Mini App) and where you came from. This is needed to support you and to develop the product. When you start a payment, the country, the device type and where you came from are also stored with the payment session at Stripe. Records of these notifications are kept for no longer than 30 days.

The operator is also notified of purchases, refunds, failed payments and payment disputes.

Cookies

We use only strictly necessary cookies and browser storage — no analytics, no advertising, no tracking. That is why there is no cookie banner.

• Session (sb-*) — keeps you signed in.
• Language (locale) — the language of the interface.
• Accent color (palette) — so the first screen already has your colors.
• Theme (browser storage) — light, dark or like your device.
• Plan choice (plan_intent, 1 hour) — only when you choose Lifetime on the start page before signing in, so that the plans page can show it after sign-in.

The installable app also keeps files of the app itself on your device so that it opens quickly and works offline.

Service Providers

We rely on the following service providers to operate the Service. They process data on our behalf under data processing agreements, except Telegram, which you use under Telegram's own terms:

We do not sell your personal data to any third party.

International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V:

• Stripe (USA) — Processes billing data under Standard Contractual Clauses (SCCs) and is certified under the EU–US Data Privacy Framework.
• Vercel (USA) — Hosts our application infrastructure. Data processing is governed by SCCs. EU traffic is routed to EU edge nodes where available.
• Supabase — Our database and sign-in provider. Data is stored on EU-region infrastructure. Processing governed by SCCs.

You can request a copy of the relevant safeguards by contacting us (see Contact).

Data Retention

We keep your personal data for as long as your account exists. You can delete your account at any time in Settings → Delete account. Then:

• Your account, profile, records, categories, settings and profile photo are deleted immediately and for good, and your Telegram account is unlinked.
• A running subscription is cancelled at once and your customer record at Stripe is deleted.
• Stripe keeps the payment and invoice records that tax and commercial law require to be kept, for the periods the law requires.

Records of payment events and of owner notifications are deleted after 30 days. Nothing is ever deleted because of your plan.

Security

We take the security of your data seriously and implement industry-standard measures:

• All data is transmitted over HTTPS/TLS.
• Data is stored on Supabase (PostgreSQL), which enforces Row-Level Security (RLS) so no user can access another user's data.
• There are no passwords to leak — you sign in with Telegram, and every sign-in is verified.
• Access to production systems is restricted to the operator.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights

Under the GDPR and applicable data protection law, you have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of the personal data we hold about you.
• Rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Erasure (Art. 17) — Delete your account in Settings, or ask us to delete your data, subject to legal retention obligations.
• Portability (Art. 20) — Request your data in a structured, machine-readable format.
• Objection (Art. 21) — Object to processing based on legitimate interests.
• Restriction (Art. 18) — Request that we limit processing of your data in certain circumstances.

To exercise any of these rights, contact us (see Contact). We will respond within 30 days (extendable by two further months for complex requests, with notice).

You also have the right to lodge a complaint with your local data protection supervisory authority. If you are based in the EU, you can find your authority at edpb.europa.eu.

Children's Privacy

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you in the app or through the Telegram bot.

Contact

If you have any questions about this Privacy Policy, please contact us:

• Telegram: @hermanviolin
• Email: info@honest-expenses.app
• Postal address: German Bayatyan, Karl-Krull-Straße 18b, 17491 Greifswald, Germany