HonestSpend
Privacy Policy
- Your money data stays on your device by default.
- We do not operate a cloud ledger or bank password vault.
- Optional features that talk to the internet use keys you supply (bring your own key / BYOK).
- The free import path (CSV / OFX / PDF) works offline after install.
This Privacy Policy describes how information is handled when you use HonestSpend, including Microsoft Store builds and related optional features. It applies to the desktop application and to this website (honestspend.net).
HonestSpend is designed as a local-first product: the primary copy of your financial books lives on hardware you control. Please read this policy carefully. If you do not agree, do not use the app or optional online features.
1. Who we are
“HonestSpend,” “we,” “us,” and “our” refer to Agency in Box 42, the publisher of HonestSpend on the Microsoft Store, and this product website. There is no separate HonestSpend cloud account system that holds your ledger for you.
Privacy questions: contact the publisher through the Microsoft Store product page for HonestSpend (publisher Agency in Box 42), or via the support channel listed on that Store listing when available.
2. Scope
This policy covers:
- The HonestSpend Windows desktop application (WinUI client and local Python engine).
- Default and user-chosen local data folders on your computer.
- Optional internet features you explicitly enable (for example BYOK Plaid or BYOK AI).
- Installation and updates via the Microsoft Store.
- This marketing website (honestspend.net) and the privacy page itself.
This policy does not control:
- Your bank’s website, mobile app, or statement exports.
- Microsoft’s processing when you use the Microsoft Store or Windows diagnostics.
- Third parties whose keys or services you optionally configure (e.g. Plaid, xAI), once data leaves your machine under those relationships.
- Cloudflare or other hosts of this website under their own policies.
3. What we store locally on your device
By default, application data is stored under your Windows user profile at
%USERPROFILE%\.financial-os (or an equivalent path documented in the app).
In Settings you may choose another folder (for example a path under OneDrive or another drive).
Typical local data includes:
- Accounts, balances, transactions, categories, rules, and related bookkeeping records you enter or import.
- Entity / household scope settings and UI preferences (e.g. Simple vs Full books).
- App settings such as API URL for the local engine, data folder path, and optional backend root.
- Local backups you create through the app or scripts.
- Engine and client logs used for troubleshooting (may include error messages and technical paths; avoid pasting logs publicly if they contain personal detail).
- Optional encrypted or unencrypted backup archives you choose to create.
Uninstall note: Removing the Microsoft Store package or deleting the app folder may not delete the data directory. That is intentional so your books can survive reinstalls. Delete the data folder manually if you want a full wipe.
4. What we do not collect
In normal use of HonestSpend as a local app, we do not:
- Store bank website usernames or passwords in HonestSpend.
- Operate an HonestSpend cloud ledger that receives your full transaction history by default.
- Sell your financial data to advertisers.
- Require an HonestSpend online account to use CSV / OFX / PDF import and local Safe to spend.
- Use advertising identifiers for ad networks inside the desktop app.
We cannot see the contents of your local database unless you voluntarily send files, screenshots, or logs to support. Please redact account numbers and personal identifiers before sharing.
5. How money gets into the app (import path)
The primary money-in path is files you download from your bank or card issuer (CSV, OFX/QFX, or PDF statements) and import into HonestSpend—or drop into a local inbox folder. HonestSpend does not log into your bank for you on that path.
After install, that path is designed to work without continuous internet access to HonestSpend servers (there is no HonestSpend-hosted ledger). Your machine still needs whatever connectivity your bank’s site requires when you download exports yourself.
6. Optional internet features
Some features send data off your device only when you enable them and supply configuration. You can use HonestSpend without these features.
| Feature | What may leave your device | When |
|---|---|---|
| BYOK Plaid (optional bank link) | Credentials and tokens for your Plaid application; bank link tokens and account/transaction data as mediated by Plaid under your agreement with Plaid and your institution. | Only if you enable bank link and configure your Plaid client id/secret (or equivalent). |
| BYOK AI / Grok (optional categorization help) | Text you allow for suggestions (e.g. payee / memo strings) via the provider API using your API key. | Only if you enable AI categorize and set your key (e.g. xAI). |
| Microsoft Store | Standard install, update, purchase, and Store diagnostics processed by Microsoft. | If you install, update, or purchase from the Microsoft Store. |
| This website | Standard web server / CDN logs (IP address, user agent, referrer, pages requested). See section 10. | When you browse honestspend.net. |
Third-party privacy terms apply to those services when you use them. Review Plaid, xAI (or other AI providers), Microsoft, and Cloudflare policies as relevant.
7. Honesty features and balances
Features such as “books ≠ bank,” “Set Safe to spend from bank,” and month-close checklists operate on data already on your device (imports, balances, and settings you control). They do not require uploading your ledger to HonestSpend servers.
8. Children
HonestSpend is not directed at children under 13. Do not use the app to store a child’s personal data without appropriate parental authority and compliance with applicable law (including COPPA where it applies). We do not knowingly collect personal information from children under 13 through the product.
9. Your choices and controls
- Import only: Use CSV / OFX / PDF without enabling bank APIs.
- Disable BYOK: Do not enter Plaid or AI keys; turn optional features off in Settings.
- Data folder: Change where books are stored (including cloud-synced folders you manage).
- Backups & export: Create local backups; copy or delete files with normal OS tools.
- Wipe: Delete the data folder and uninstall the app for a full local removal.
- Logs: Clear or avoid sharing logs that may contain sensitive paths or payee text.
10. This website (honestspend.net)
The marketing site is a static site intended to describe the product and host this policy. It does not provide a login for your financial ledger.
When you visit the site, hosting/CDN providers (for example Cloudflare Pages) may process:
- IP address and approximate location derived from IP
- Browser type, device type, and user agent
- Pages requested, timestamps, and referrer URL
- Security-related signals (e.g. bot management) as configured by the host
We do not intentionally place advertising cookies on this marketing site for third-party ad networks. Essential hosting and security technologies may still use cookies or similar storage as provided by the CDN. Check your browser settings to control cookies.
11. Third parties
- Microsoft — Store distribution, purchase processing, Windows platform services, and related diagnostics when you use those channels.
- Plaid — only if you configure BYOK bank link; subject to Plaid’s terms and your institution’s terms.
- xAI or other AI providers — only if you configure BYOK AI features with your key.
- Cloudflare (or successor hosts) — website and privacy page delivery.
We are not responsible for third-party practices outside our control. Follow their privacy policies and your agreements with them.
12. Security
Because data is local-first, your device security is the primary control: full-disk encryption, OS user accounts, screen lock, and careful backup handling matter. Optional features that use network APIs rely on TLS as implemented by those clients/libraries and on the secrecy of keys you store on your machine.
No method of electronic storage or transmission is 100% secure. Use strong device credentials and do not share API keys or backup files carelessly.
13. International users
HonestSpend is developed with a primary Windows desktop audience. If you use the app outside the United States, you are responsible for ensuring that local storage and any optional third-party services you enable are lawful in your jurisdiction. This policy is provided in English.
14. Legal bases (where applicable)
If data protection laws that require a “legal basis” apply to any limited processing we control (for example server logs on this website), those bases may include legitimate interests in operating a secure static site and providing product documentation, and consent where you choose optional third-party integrations. Local ledger data processed solely on your device under your control is generally not transmitted to us.
15. Retention
- Local app data: retained until you delete it or wipe the data folder.
- Website logs: retained according to the hosting provider’s defaults and our configuration, typically for security and operations for a limited period.
- Support communications: issues and emails you send may be retained as long as needed to respond and maintain the project.
16. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. The current version will be published at https://honestspend.net/privacy/. Continued use of the app or website after an update means you accept the revised policy to the extent permitted by law. Microsoft Store users may also see listing updates when a new package is certified.
17. Contact
Privacy questions related to HonestSpend:
Publisher Agency in Box 42 via the Microsoft Store product listing for HonestSpend
(support / contact options shown on that page).
Public privacy policy URL for Microsoft Store listing:
https://honestspend.net/privacy/
18. Summary table
| Data | Where | Shared with HonestSpend servers? |
|---|---|---|
| Ledger, accounts, transactions | Your PC (chosen folder) | No (no cloud ledger) |
| Bank website password | Not stored by HonestSpend | N/A |
| CSV / OFX / PDF imports | Processed locally | No |
| BYOK Plaid / AI | Third parties you configure | Only via those third parties when you enable them |
| Website visits | CDN / host logs | Standard request metadata only |
This document is provided for transparency about the HonestSpend product. It is not legal advice. If you need formal counsel for a commercial deployment, consult a qualified attorney.