Privacy policy

Where a statement is read

A digital PDF — one with a text layer, which is what a bank issues when you download a statement online — is read in your browser. The document is not sent anywhere to be read. What is kept afterwards, the extracted rows and optionally the PDF, depends on your retention setting, described below.

There are two exceptions. A scanned statement has no text to read, so its pages are sent to our server and on to a vision model to be transcribed. And when a bank’s layout defeats the browser’s parser, the text already extracted in your browser — the text, not the file — is sent to be structured. Both are held for the request and discarded, and the screen says which is happening while it happens.

What we collect

Only what the product needs to do its job.

• Your email address, from signing in. There is no password, so we hold no credential.
• Your plan, and how many pages you have converted in the current period. This is what the page allowance is counted against.
• Optionally: your country and which accounting software you use, if you tell us. Both are used to pick sensible defaults and nothing else.
• For each statement you save: the file name, the institution and account number as printed on it, the currency, page and transaction counts, and the extracted transactions themselves.
• The original PDF, in object storage, if your retention setting keeps it.
• If you connect QuickBooks Online: the ID and name of the company you connected, the access Intuit grants (stored encrypted, never shown to your browser), and a record of which statement rows you have sent, so the same row is never sent twice. When you choose to send a statement, its reviewed transactions are sent to Intuit to be created in your company. Disconnecting revokes the access at Intuit and deletes it here.
• Ordinary server logs, including IP address, kept by our host for operational purposes.

How long we keep it

You choose. The setting lives in your account under Your data, and the options run from keeping nothing at all to a year. The default is thirty days.

Set it to keep nothing and the transactions are never written to the database in the first place — only the metadata for your history list is recorded, and the PDF is not stored.

Everything past its retention is deleted by a job that runs daily, and that deletion covers both the transactions and the stored PDF. Deleting a statement yourself is immediate and does not wait for the sweep. If the stored file cannot be removed for any reason, the statement is left in place rather than disappearing from your list while the document survives.

Your account record and your usage counts persist while the account exists, because they are what the account is.

We do not train on your data

Your statements are not used to train, fine-tune or evaluate any model — ours or anyone else’s. This is not a setting you have to find and switch off.

For scanned statements this is enforced rather than merely stated: the request is sent with data collection denied, which restricts it to providers whose terms do not permit retaining or training on what they receive. A request that cannot be served on those terms fails rather than falling back to one that can.

Who else processes it

We use the following services to run this product. Each sees only what its function requires.

• Vercel — hosting for this application. Sees requests and IP addresses, not statement contents beyond what passes through a request.
• Supabase — database and authentication, hosting your account record and your extracted transactions.
• Cloudflare R2 — object storage for the original PDF, when you choose to keep it.
• OpenRouter — routes scanned statements to a vision model. Requests are sent with data collection denied, so they are only served by providers that do not retain or train on what is sent.
• Paddle — merchant of record for payments. Paddle, not us, is the seller on your invoice, and it handles card details end to end.
• Resend — transactional email, such as sign-in links.
• Google (Gmail) — receives the messages you send through the contact form.
• Google Analytics, Microsoft Clarity and PostHog — analytics on the public website only (pages such as the homepage, bank guides, blog and pricing). Clarity and PostHog can record how a page is used, with form inputs masked. None of them runs in the signed-in workspace, where statements are shown, so none of them sees a statement.

We do not sell it, and we do not advertise on it

Your data is not sold, rented, or shared with advertisers or data brokers. There is no advertising on the converter, and no tracking pixel following you off it.

On the public website we use analytics (Google Analytics, Microsoft Clarity and PostHog) to understand which pages people read and where they get stuck. These set cookies on the public pages only. They are not loaded in the signed-in workspace, where your statements are shown, and they are not used for advertising.

What you can do

You can see every statement you have saved, delete any of them individually, change your retention setting at any time, and close your account — at which point your statements and stored files go with it.

If you want a copy of what we hold, or want it erased, write to us and we will do it. Depending on where you live you may have a legal right to this; we do not intend to make you invoke it.

Changes

If this changes materially — a new processor, a different retention default, anything that alters where your data goes — we will say so here and date it. The date at the top is the last time the substance changed, not the last time a word did.