Skip to content

Privacy Policy

Last updated: October 29, 2026

The short version

  • Your bank statement is converted in your browser. The PDF is read on your own device and is not uploaded in the normal flow.
  • If you choose the server fallback for a file your browser could not read, the file is processed in memory and deleted as soon as the request ends. It is never written to disk and never stored.
  • We never store the contents of your statements: no transactions, no descriptions, no account numbers.
  • We store only simple usage records so we can count your pages and show your history.

What happens to your statement

  1. Normal conversion. Your browser extracts the text from the PDF and our parser runs on your device. The PDF and its transactions stay on your computer. The files you download are created in your browser.
  2. Scanned statements. If a PDF has no text layer, the first few pages are rendered to images in your browser and sent to our AI provider (OpenAI) so they can be read. You can instead run in-browser OCR, which uploads nothing.
  3. Server fallback (only when you ask for it or the browser cannot read the file). The PDF is sent over HTTPS to our server, parsed in memory and the result is returned to you. The file is not saved, not logged and not shared, and it is deleted when the request finishes.
  4. AI assist. When our rules cannot read a statement (no transactions found, or the balances do not reconcile), or when you click "Try AI read", the text lines extracted from your statement (or, for scanned PDFs, the page images) are sent to an AI provider (OpenAI), which returns the transactions. Nothing is stored by us, and the provider is used through its API, which by default does not train on API data. We never send the PDF file itself, and we keep only usage counters (no content) to enforce fair-use limits.

What we store

We keep a small record for every conversion, and only to enforce page limits and show your history:

  • a SHA-256 fingerprint of the PDF (so the same file is not charged twice) - the file itself is not kept;
  • the file name you gave it, the number of pages and transactions, the detected bank name and currency, whether the balance check passed, and which export formats you downloaded;
  • the date and time, and either your account or a keyed hash of your IP address (for the free daily allowance of visitors without an account).

If you create an account we store your email address and a salted bcrypt hash of your password (or your Google profile name and email if you use Google sign-in). If you buy a plan, Polar processes the payment, and we store the subscription status, plan and purchase identifiers they send us. We never see or store your card number.

Cookies and analytics

We use a session cookie only if you sign in. We use Google Analytics 4 (with IP anonymisation) to count page views and understand which pages are useful. It loads after the page is ready and sets analytics cookies in your browser. It never receives your statement files or their contents. The free public pages also load Google AdSense, which may set advertising cookies and show ads; ads are never shown in the signed-in dashboard, and Google never receives your statement files. You can block both with a browser extension or your browser's tracking settings.

Who processes data for us

  • Cloudflare delivers the site and may process your IP address and request metadata.
  • Polar (polar.sh) processes payments as merchant of record.
  • Our hosting provider runs the server and database.
  • An email delivery provider sends password-reset and support emails, if configured.
  • An AI provider (OpenAI) receives statement text or scanned page images only when AI assist runs, as described above.

Security

All traffic uses HTTPS. Passwords are stored as bcrypt hashes. Because the conversion runs on your device, the data that is most sensitive never needs to reach us.

Retention and your rights

Usage records and account data are kept while your account exists. You can ask us to delete your account and all associated records at any time by writing to . Depending on where you live (for example the EU, the UK, California, Canada or Australia) you may have the right to access, correct, export or delete your data, and we honour those requests whatever your location. Payment and tax records held by Polar are retained according to their policy and the law.

Children

The service is intended for business users and is not directed at children.

Changes

If we change this policy, we will update the date below. Material changes will be announced on this page.

Contact

Questions about privacy: .