Security & privacy
How we handle your files
A bank statement lists where you shop, who pays you and what you earn. We treat it accordingly. Here is exactly what happens to it — not a policy summary, the actual mechanics.
The mechanics
Where your statement goes, step by step
Reading happens in your browser
A digital statement carries a text layer, and we read it where it already is — in your browser. Nothing is sent to be read unless the layout defeats the local parser, or the statement is a scan with no text to read at all. Where the file itself is kept afterwards is a separate question, and the card beside this one answers it.
We never train on your data
Your statements are not used to train, fine-tune or evaluate any model, ours or anyone else's. This is not a setting you have to find and switch off.
Your statements are stored, and you set for how long
A converted statement is kept — the rows and the original PDF — so you can reopen it from any of your devices. You choose how long: 24 hours, 7 days, 30 days, a year, or not at all, and “not at all” covers the file as well as the rows. Deleting a statement deletes both immediately, and deleting your account takes everything with it — not 90 days later.
When text is sent to our servers
Two cases. A scanned statement is an image with nothing for the browser to read, so its pages go to our processing layer over TLS. And when a bank's layout defeats the local parser, the text already extracted in your browser is sent to be structured — the text, not the file. Both are held in memory for the request and discarded. The screen says which is happening while it happens.
Sub-processors
Who else touches your data
The same list as in our data processing agreement. Each one is named with what it sees, so you can judge the chain rather than take it on trust.
Vercel
Hosting for this application. Sees requests and IP addresses, not statement contents beyond what passes through a request.
Supabase
Database and authentication, hosting your account record and your extracted transactions.
Cloudflare R2
Object storage for the original PDF, when you choose to keep it.
OpenRouter
Routes scanned statements to a vision model. Requests are sent with data collection denied, so they are only served by providers that do not retain or train on what is sent.
Paddle
Merchant of record for payments. Paddle, not us, is the seller on your invoice, and it handles card details end to end.
Resend
Transactional email, such as sign-in links.
Google (Gmail)
Receives the messages you send through the contact form.
Google Analytics, Microsoft Clarity and PostHog
Analytics on the public website only (pages such as the homepage, bank guides, blog and pricing). Clarity and PostHog can record how a page is used, with form inputs masked. None of them runs in the signed-in workspace, where statements are shown, so none of them sees a statement.
FAQ
Straight answers
Is it safe to upload bank statements to an online converter?
It depends on what the converter does with them, so ask four things: where the file is read, what is kept and for how long, who else processes it, and whether it is used to train anything. Here, digital statements are read in your browser, scans are processed for one request and discarded, you choose retention down to none, every sub-processor is named below, and nothing is used for training.
Do you see my transactions?
Often not. When your browser can read the layout on its own, nothing is transmitted and there is nothing for us to see — a stronger guarantee than a promise not to look. When the layout defeats it, or the statement is a scan, the text goes to our processing layer for the length of one request and is then gone.
What do you store?
The extracted transactions, the original PDF, and the metadata that lets you find them again — filename, institution, period, row count. All of it is governed by your retention setting, including the PDF, and “do not store” means none of it is kept. Storing the file is what lets you reopen a statement with its pages beside its rows, on any device you sign in from.
Where is the PDF kept?
In object storage we control, reached only through short-lived links this app signs for you, one file and one action at a time. Your browser also keeps a copy of statements converted on it, so reopening one is instant — you can clear those from Account › Your data at any time.
What happens to the password of a password-protected statement?
It is used in your browser to unlock the file and goes no further: it is not sent to us, not logged and not stored. What carries on is the unlocked copy, which is handled like any other statement, including your retention setting. Deleting the statement deletes that copy.
What happens when I connect QuickBooks?
You approve the connection at Intuit, and Intuit grants access to accounting data only. We keep that access encrypted on our server; it never reaches your browser. Nothing is sent to QuickBooks until you press Send on a statement, and then only its reviewed rows. Disconnecting revokes the access at Intuit straight away.
Will you sell or share my data?
No. There is no advertising on this product and no data sharing arrangement behind it. Revenue comes from subscriptions.
Can I get a Data Processing Agreement?
Yes. Our data processing agreement is published on this site, covering scope, sub-processors, security and deletion, for practices that convert statements belonging to their clients.
Is the reconciliation check a guarantee my data is correct?
No, and we will not claim it is. It verifies arithmetic: that amounts, balances and totals agree. It cannot detect a wrong description or a wrong date, and two errors that cancel each other out will pass. It is a strong detector, not a guarantee.
Questions this page does not answer?
Ask us anything about how statements are read, stored and deleted.