Privacy Policy

1. Who we are

Pennyway is a personal finance application developed and maintained as an independent project. The application is distributed free of charge and the releases are published on GitHub. Questions about this policy can be directed via the GitHub issues page.

2. Data stored on your device

Pennyway stores the following data locally on your computer only. None of this is transmitted to any server:

• Bank account credentials (encrypted with AES-256, key derived from your password)
• Downloaded transaction history (stored in a local SQLite database)
• Your Google Gemini API key, if provided (encrypted at rest)
• Gmail OAuth tokens, if connected (encrypted at rest)
• Application settings and preferences

You have full control over this data. A Factory Reset option in Settings permanently deletes all of it from your machine.

3. Data collected by Pennyway servers

Our license server (hosted on AWS) stores the following minimal data when you register:

• Email address — used only to verify your identity and link your registration
• First and last name — provided during registration
• A cryptographic hash of your installation fingerprint — used to identify the device the app is installed on. This is a one-way hash; the original value cannot be recovered
• Device name — your computer's hostname, used to label your registered devices in the app
• Registration and last-seen timestamps — used to display device activity in the app

We do not collect payment information, IP addresses, usage analytics, or any behavioral data.

4. How we use your email address

Your email address is used for one purpose only:

• Account verification (OTP): When you register, we send a single one-time password to confirm you own the email address. This is a transactional message, not a marketing one.

We do not send newsletters, product announcements, promotional emails, or any other unsolicited communications. You will never receive an email from Pennyway unless you explicitly requested a verification code.

5. Third-party services

• AWS (Amazon Web Services): Our license server and OTP email delivery run on AWS infrastructure (DynamoDB, Lambda, SES) hosted in the EU/US. AWS Privacy Policy
• Google Gemini API: If you provide a Gemini API key and use the AI Insights feature, anonymized spending summaries are sent to Google's API for analysis. This is optional and only happens when you explicitly trigger it. Governed by Google AI Terms.
• Your bank's website: Pennyway scrapes your bank accounts using credentials you provide. This interaction is between the app on your machine and your bank — Pennyway servers are never involved.

6. Data retention

Your registration record (email, name, device fingerprint hash) is retained on our license server as long as your account is active. Temporary OTP verification codes are automatically deleted within 10 minutes of creation.

To request deletion of your registration data, please open an issue on our GitHub page.

7. Security

All sensitive data in the application is encrypted using AES-256. Your encryption key is derived from your password and never transmitted anywhere. The license server uses HTTPS for all communication. OTP codes are stored as SHA-256 hashes, never in plaintext.

8. Children's privacy

Pennyway is not directed at children under 16. We do not knowingly collect data from anyone under 16 years of age.

9. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and note the change in the GitHub releases page.

10. Contact

For any privacy-related questions or data deletion requests, please open an issue on GitHub.