The short version

GravesBook collects nothing and sends nothing anywhere. There is no telemetry, no analytics, no crash reporting to us, no “phone home” of any kind, and no network code in this version of the application at all. Every piece of financial data you enter stays on the device where you entered it, inside a single encrypted database file that only you can open — and in any backup or export files you choose to make, which stay wherever you put them.

What GravesBook does with your data

• All account, transaction, category, scheduled-transaction, reconciliation and import data you enter or import is written to a single SQLite database file, encrypted at rest with SQLCipher, stored at a location on your own computer (by default, a folder under your Windows user profile).
• One small settings file (config.json, in the GravesBook folder under your Windows user profile) records where that database file is, so GravesBook can find it on the next launch. It holds the file path and nothing else — never your passphrase, never any financial data — and is not encrypted.
• If GravesBook hits an error it did not expect, it writes the technical details of that error (the error type, message and the place in the program it happened) to a file named last-error.txt in the same local folder, so you can send it to support if you choose to. That file is written only on your computer and is never transmitted; it does not contain your passphrase or your financial records.
• Spreadsheet import reads a file you pick, on your computer, once, and writes nothing back to it.
• That database is protected by a passphrase you choose. GravesBook does not store your passphrase anywhere, in any form, and cannot recover it if you forget it — there is no backdoor and no “reset my passphrase” path, because there is no server on the other end to ask. If the passphrase is lost, the data in that database is permanently unreadable. This is a deliberate consequence of real encryption, not an oversight, and GravesBook tells you this plainly at the point you set a passphrase, not just here.
• No account, transaction, or personal data is transmitted anywhere. GravesBook does not currently connect to your bank, to GravesWare, LLC, or to any other third party over a network. The application ships with no network code in this version.

What GravesBook does not do

• It does not collect usage analytics, and it does not send diagnostics or crash reports anywhere. (The local last-error.txt described above stays on your machine.)
• It does not include advertising or third-party tracking of any kind.
• It does not share, sell, or otherwise transmit your data to GravesWare, LLC or to any other party, because it has no mechanism to do so.
• It does not require or create any online account.

Backups and exports

If you use either backup feature, the backup files GravesBook creates are stored locally on your own computer (or wherever you choose to copy them) and are encrypted — a portable backup with your database passphrase, an internal backup under a backup key that is itself protected two ways: by Windows Data Protection (DPAPI), which ties it to your Windows user account on this machine, and by a recovery passphrase you choose. GravesWare, LLC never receives a copy of a backup, a backup key, or a recovery passphrase, automatically or otherwise.

CSV files you export from the register or the Reports screen are plain, unencrypted text containing the transactions or figures you exported. They are written only where you choose to save them; protecting them after that is up to you.

Printed pages, like CSV files, leave GravesBook’s encryption the moment they are printed; they are yours to protect. Printing goes through Windows and the printer you choose, the same as printing from any other program.

Purchases

Purchases of GravesBook through the Microsoft Store are processed by Microsoft. GravesWare, LLC does not receive or store payment card details.

Future connectivity

GravesBook’s source includes an interface (GravesWare.Checkbook.Connectivity) reserved for a possible future bank-connectivity feature. As shipped in this version, that interface has no working implementation behind it — it is a placeholder for a future, separately-announced feature, not something active today. This Privacy Statement will be updated, and you will be told plainly, if and when that changes.

Questions

GravesBook is built by GravesWare, LLC.
Support: support@gravesware.com
Website: gravesware.com/gravesbook