Privacy

Privacy policy

Last updated 18 February 2025.

The short version. Your bank statement is opened and converted by JavaScript running in your own browser tab. It is never uploaded to us, never stored, and never seen by anyone but you. You can verify this yourself in your browser's network tab while converting a file.

Your statement files

We do not receive your PDF, OFX or QFX files, or anything derived from them. There is no upload endpoint on this site, no storage bucket and no processing queue. The conversion happens entirely on your device, and the resulting spreadsheet is written directly to your downloads folder by your browser.

Because nothing is transmitted, there is nothing for us to delete, disclose, sell or lose. If you convert a file while offline after the page has loaded, everything still works — which is the simplest possible demonstration that the file is not being sent anywhere.

Analytics

We use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors. It records aggregate page views, referrers, country and basic device information. It cannot identify you, and because it sets no cookies it does not require a consent banner in the EU or UK.

We also use Google Analytics 4. It loads on every page view, like any standard analytics tag, and sets cookies in your browser.

What Google Analytics receives. Page views (the address without any query string), a coarse device and country signal, and events describing how the converter is used — how many pages a PDF had, how many rows were extracted, whether the balance check passed, which export format was chosen. Those events carry counts, booleans and format names only.

What it never receives. Nothing read out of your statement: no transaction descriptions, no amounts, no balances, no dates, no account numbers, and not even the file name. There is no code path that could send them — see the note on enforcement below.

Cookies

Google Analytics 4 and Google AdSense may set cookies in your browser. You can block or delete cookies for this site in your browser settings at any time; the converter works identically without them, and your statement is never affected either way.

How the privacy claim is enforced

"Your statement never leaves your device" is not only a promise here. The site is served with a Content-Security-Policy whose connect-src directive lists every host this page is permitted to send data to, and your browser enforces it. There is no endpoint belonging to us that accepts a file. A browser test in the repository carries out a real conversion and fails if any request is made to a host outside that list, or if any outbound request carries statement data.

Advertising

This site may display advertising supplied by Google AdSense. Where ads are shown, Google and its partners may use cookies or similar technologies to serve ads based on your prior visits to this and other websites. You can control personalised advertising through Google Ads Settings, and you can opt out of third-party vendor cookies at aboutads.info.

Ads personalization is controlled through Google's own settings, linked above; this site has no separate consent flow. Advertising never has access to your statement file, because the file never leaves your device.

Affiliate links

Some links to OCR services for scanned statements are affiliate links, marked with rel="sponsored". If you follow one and buy something, we may receive a commission at no extra cost to you. These links never appear inside the converter, and they never receive data about the file you were working on.

Server logs

The site is served by a static hosting provider, which keeps standard request logs (IP address, user agent, requested URL) for security and abuse prevention. Those logs relate to page requests, never to the contents of any file you convert, which is not transmitted at all.

Children

This site is a tool for handling financial documents and is not directed at children.

Your rights

Because we do not collect personal data from the converter and use no identifying cookies, there is generally nothing to access, correct or erase. If you believe we hold data about you, contact us and we will investigate and respond within 30 days. If you are in the EU or UK, you also have the right to complain to your national data protection authority.

Changes

If this policy changes — for example if a paid batch conversion service is added, which would require sending files to a server — the change will be described here, with the trade-offs stated plainly, before that feature is enabled.

Contact

Questions about this policy: contact us.