Skip to content
Honeypod
DE
Request beta

Privacy policy

Last updated: 11 November 2026

This is a translation for your convenience. Only the German version is legally binding.

Honeypod is a bookkeeping app that runs on the user’s computer. For data protection, this is the most important point, which is why it comes first: Bookkeeping data does not leave your own computer. Invoices, receipts, bank transactions, customer data and reports are stored locally only. There is no Honeypod server that stores, views or analyses them.

This policy therefore describes two separate things: what happens on this website and the few places where the app connects to the outside world at all.

1. Controller

Tim Schenk, sole trader (Einzelunternehmen). The full address and contact details are in the legal notice.

2. This website

Server logs

When the website is accessed, the server processes the technically necessary connection data: IP address, time, requested address, amount of data transferred, browser identifier. This is required for operation and serves to fend off attacks. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure operation.

No cookies, no tracking

This website sets no cookies and does not embed any fonts, maps or scripts from third-party servers. That is why there is no consent banner here either. If you choose the light or the dark appearance at the top, your browser remembers this choice in its own storage. It does not leave your computer.

Visitor counting

So that we know which pages are read and how people find the website, our server counts the page views. This happens on our own server, no third-party service is involved. No script runs in the browser for this. Nothing is stored on your device and nothing is read from it. The server only uses what your browser sends with every page request anyway: IP address, browser identifier, the preferred languages, the requested page and the page you came from.

From the IP address and the browser identifier, the server creates a hash with a key that is newly generated every day. This makes it possible to count how many people visited on a given day without recognising anyone. The IP address itself is not stored. Without the key, a hash cannot be traced back. The server deletes the key and the hashes of a day with the first request of the following day.

Only daily totals are kept: page views, visits and visitors, per page, per source, per country, per language, per device type and operating system. Of the source, only the name of the website you came from is kept, such as a search engine, without the path and without search terms. Of the languages, only the first one your browser names is kept, without the region. These figures do not show who visited the website.

The server derives the country from your IP address when a page is requested, using a list on our own server that maps ranges of IP addresses to countries. Your IP address is not sent to anyone for this. All that is kept is how many visitors came from which country on a given day. The list comes from IP Geolocation by DB-IP and is licensed under CC BY 4.0.

If you request an address where there is no page, the server counts that too, so that we can find broken links. It keeps the requested address without any parameters attached and the page you came from: for one of our own pages its address, for another website only its name. Here, too, only daily totals are kept.

If your browser sends the “Do Not Track” or “Global Privacy Control” signal, the server does not count you. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in understanding which content is read and how the website is found. You can object to the counting at any time (Article 21 GDPR), most easily with one of the two signals.

Beta requests

Anyone who asks to join the beta using the form on this website submits their name and email address and, optionally, their business, macOS version and a message. The language of the page, German or English, is also transmitted so that our reply and the invitation are in that language. The request is stored on our own server, no third-party service is involved. We use the details to answer the request and to send an invitation. The legal basis is Article 6(1)(b) GDPR, taking steps at your request prior to entering into a contract.

To prevent misuse of the form, the server accepts at most five requests per hour from the same address. For this, it keeps a hash of the IP address for one day, created with a key that is newly generated every day and deleted afterwards. Without the key, the hash cannot be traced back. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure operation.

Feature suggestions

Anyone who suggests a feature using the form on this website submits the suggestion and, optionally, its background, that is, what it is needed for. The language of the page, German or English, is also transmitted so that any question we have comes in that language. We do not ask for a name and we do not store an IP address with it. The suggestion is stored on our own server, no third-party service is involved. We read it and use it to develop Honeypod further. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in developing Honeypod further according to the wishes of its users.

You can optionally give an email address. We only use it for questions about your suggestion. The legal basis is Article 6(1)(a) GDPR, the consent given by submitting the form. You can withdraw it at any time. The suggestion and the address remain stored for as long as we need the suggestion for further development. Some things can only be implemented months later. We would still like to be able to reach you then. On request, we delete the address or the entire suggestion immediately. A message to the address given in the legal notice is all it takes.

To prevent misuse, the server here too accepts at most five suggestions per hour from the same address, using the same hash of the IP address as for beta requests. It is deleted after one day. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure operation.

Hosting

The website is hosted by a provider in Germany. We have a data processing agreement with this provider in accordance with Article 28 GDPR.

3. The app

What stays local

All bookkeeping data is kept in a database on your own computer, along with the imported receipts as files. None of it is transmitted. Text recognition for scanned receipts also runs locally.

Updates

The app checks whether a newer version is available and downloads it if you wish. This creates the usual connection data on the server. No identifier is transmitted that would allow conclusions about a specific person.

Licence and computers

For every licence issued, we keep a register with the licensee’s name and email address, the edition and the term. The licence key is sent to this address.

When a licence is activated, the app reports the following to the server:

  • the licence key. Only a checksum of it is stored (SHA-256), not the key itself,
  • a device identifier, so that a key cannot be redeemed any number of times,
  • the name of the computer, if one has been set in the app, otherwise only its model, such as “MacBook Air”, so that an individual computer can later be recognised and signed out,
  • the app version.

After every update, the app reports its new version once with the same details, provided there is an internet connection. It also states, in one word, whether it carries the Honeypod signature, that is, whether it is unchanged from the app we shipped. If this changes, it reports it once more. The version, this finding and the date of the report are stored. This lets us see whether a computer is still working with an outdated or a modified version. If errors occur, we can then help in a targeted way. Bookkeeping data is never transmitted. Without a connection, the app keeps working as normal.

The legal basis for the register and the activation is Article 6(1)(b) GDPR, the performance of the user contract. For the report after an update, it is Article 6(1)(f) GDPR, our legitimate interest in an up-to-date, working and unmodified app.

Feedback

Anyone who uses the built-in feedback function decides for themselves what is transmitted. The text entered, the type of report, the app version, the app’s language and the operating system are submitted. Optionally, an email address for questions, a screenshot and the app’s technical log can be added. The log contains program flows, no receipts and no amounts. The legal basis is Article 6(1)(a) GDPR, the consent given by submitting.

To prevent misuse, the server accepts at most thirty reports and thirty licence activations per hour from the same address, using the same hash of the IP address as for beta requests. It is deleted after one day. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure operation.

Sending invoices

Anyone who sends invoices from the app does so through their own outgoing mail server. The message goes directly from there to the recipient. It does not pass through our servers and we see neither its content nor its recipient.

Submission to ELSTER

The provisional VAT return (Umsatzsteuer-Voranmeldung) is generated and checked on your own computer and submitted directly to the tax authorities with your own ELSTER certificate. We are not involved in this. This processing is governed by the data protection notice of the tax authorities, which the app shows before the first submission.

Bank connection

Anyone who uses the bank connection sets up their own access with a provider of account information services. The connection then exists between your own computer, this provider and the bank. The processing there is governed by that provider’s privacy policy. We receive no account data in the process.

4. Storage period

Server logs are deleted after a short time. The hashes of the visitor counting and their key are deleted with the first request of the following day, the daily totals remain. Details of the licence and the computers are kept for as long as the licence exists. A declined beta request is deleted after thirty days, the details of an accepted one are transferred to the licence register. A suggestion, together with any address given, remains stored for as long as it is needed for further development or until you request its deletion. Feedback, together with its attachments and our replies, remains stored for as long as we need it for troubleshooting and further development or until you request its deletion. Bookkeeping data is kept on your own computer and managed there by you.

5. Disclosure

Data is not passed on to third parties. The only exception is the service providers used for technical operation, who receive it solely within the scope of processing on our behalf. No data is transferred to countries outside the European Union.

6. Your rights

Under the General Data Protection Regulation, you have the following rights:

  • Access to the data processed (Article 15)
  • Rectification of inaccurate data (Article 16)
  • Erasure (Article 17)
  • Restriction of processing (Article 18)
  • Data portability (Article 20)
  • Objection to processing (Article 21)
  • Withdrawal of consent given, with effect for the future (Article 7(3))

For all of this, a message to the address given in the legal notice is enough.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible is the one at your place of residence or at the controller’s place of business.

7. Changes

If what the app or the website does changes, this policy will be updated. The version published here is the one that applies.