The problem
Every expense tracker asks you to choose between two bad options.
Option one: type everything in yourself. We've all tried this. It works for about nine days, then you forget a coffee, then a week, then you give up and the app becomes another graveyard icon.
Option two: hand a third-party aggregator full read access to your bank account. Now some company you've never met has a permanent, itemized feed of everywhere you eat, who you pay rent to, and what you buy at 2am. That's not a tracker — that's surveillance you opted into.
We wanted the automation of option two with the privacy of a notebook you keep in your own drawer. HushMoney is that notebook — it just writes itself.
What it does
Your bank already sends you a notification for every transaction — an email, an SMS, a "you spent $45,000 at RAPPI" alert. HushMoney reads those, not your account.
The flow is simple:
- Bank sends a notification (email or SMS)
- A forwarder strips every sensitive detail — OTPs, account numbers, recipient names — and extracts only
{ amount, merchant, date, type } - An AI agent categorizes it, stores it, and spots recurring charges
- You get a clean daily / weekly / monthly summary on Telegram
Zero manual entry. You never type a transaction. You just read the summary.
The core idea: a hard privacy boundary
The whole project is built around one architectural rule: the AI never sees your raw financial data.
Redaction happens in the forwarder, before anything reaches the model. By the time the agent is involved, an OTP is already [REDACTED] and the account number is gone. The agent operates on a sanitized CleanPayload and nothing else. The SQLite database that holds your history lives on your own machine and never leaves it.
This isn't a disclaimer bolted on at the end — it's the shape of the system. The forwarder is a privacy firewall, and everything downstream is untrusted-by-design.
How we built it
- Agent runtime: Hermes Agent (NousResearch), running inside an NVIDIA OpenShell sandbox with a filesystem + network policy, so the agent can only reach the endpoints we allow.
- Models: NVIDIA Nemotron served on Nebius Token Factory. This is where the hackathon's model tiering actually earned its keep — we use Nemotron Super for the reasoning-heavy work (categorizing an unknown merchant, inferring a new bank's format) and keep the fast everyday calls cheap. Token Factory's OpenAI-compatible endpoint meant we pointed one
OPENAI_BASE_URLat it and everything worked. - Skills: the agent's abilities are modular skills —
expense_tracker,categorizer,debt_tracker,summaries,export, andbank_learning. - Ingestion: a Python 3.12 forwarder polls Gmail over IMAP for email alerts, and a Pyrogram (MTProto) listener handles SMS.
- Delivery & gateway: a Starlette/Uvicorn gateway receives the clean payload and hands it to the agent; Telegram is the one channel in and out.
- Storage: SQLite, local, single-user.
The part we're proudest of: banks teach the system themselves
Every bank formats notifications differently, and we can't pre-program all of them. So HushMoney learns. When a message doesn't match any known pattern, the bank_learning skill kicks in: it asks which bank sent it, uses Nemotron to infer the structure (field positions, delimiters, date format) from the already-redacted text, confirms the amount and date with the user, and stores the new pattern. From then on, that bank is parsed deterministically and never touches the model again.
The subtle constraint: the model infers structure from redacted text only — it sees word order and delimiters, never real values. That's why the skill has to ask the user to confirm the amount; it genuinely can't recover it from the message. Privacy and learning coexist because the learning path was designed around the redaction, not in spite of it.
Challenges
- There's no clean API for "my iPhone's bank SMS." We solved it with an iPhone Shortcut that drops the SMS text into Telegram Saved Messages, and a Pyrogram listener that watches that self-chat and forwards it in. Unglamorous plumbing, but it works without jailbreaks or paid SMS gateways.
- Letting an LLM learn new formats without breaking the privacy boundary. The temptation is to just show the model the raw message. Resisting that — and proving the redacted-only path still works — was the hardest design call and the one we're happiest we got right.
- Deciding what not to build. The transaction path is deliberately stateless and drops on failure: financial alerts are ephemeral, and a dropped message is better than a buggy retry queue double-counting your spending. Knowing where to stop kept the system honest.
What we learned
- Model tiering is a real design lever, not a cost footnote — matching Nemotron Super vs. the fast tier to the job kept the thing responsive and cheap.
- A privacy guarantee is only as strong as the point where you enforce it. Push redaction to the edge and everything behind it gets simpler to reason about.
- The best personal-AI UX is the one you forget is running.
What's next
Multi-currency summaries, a community pattern library so banks learned by one person work for everyone (patterns only — never data), and budget alerts that nudge before, not after.
Log in or sign up for Devpost to join the conversation.