Privacy policy

We use a statement you upload for one thing: producing your conversion. Once the statement is in your account, we delete the PDF as soon as its conversion finishes, whether it succeeded or failed. We keep the converted CSV for 1 hour after completion so you can download it, then delete it, and the file's name goes with it: it only names the download. What we keep with the record of the conversion is its first and last dates, how many rows it had and whether its balances added up, so that you can tell your conversions apart in your list. Nothing about an uploaded statement is read by a person, used to train anything, shared, or sold.

A statement you drop in before you have an account comes to us at once, and we hold it encrypted, as described below. We convert up to its first 5 pages and show you the first page that has transactions. Only the browser you dropped it in can open it: we give that browser a cookie, and keep only a hash of it beside the statement. If you sign up or sign in from its page, on that browser, within 1 hour, we add the statement to your account, and the rest of this section applies to it. If your account has no pages left for it, it waits for a plan, and if no plan starts within 1 hour of your sign-in, we delete the PDF. If you do not, we delete the PDF, the spreadsheet we made from it, what we read from it and the file's name.

Until we add the statement to your account, the record of that conversion described above carries the hash of the cookie and the network you sent the statement from (your IP address, or the first half of an IPv6 address). We use the two only to count the statements that one browser and one network send us before they sign up. When we add the statement to your account, we remove them from the record. If we never add it, we delete the record 1 day after you sent the statement.

Every connection to our site uses TLS 1.2 or newer. While we hold them, we encrypt the PDF and the spreadsheet with AES-256 under a key that we keep apart from the database. We store the record of a conversion described above, and the file's name until we delete the spreadsheet, without that encryption. We back up the database every night, and we encrypt each backup. A backup we make while we hold a statement's PDF, or before we delete its spreadsheet, holds that PDF or spreadsheet, still encrypted, for as long as we keep the backup.

A PDF that needs a password waits, encrypted as above, until you type its password, which you can do before you sign up too. We use the password once, to make a copy of the PDF that opens without it; that copy takes the PDF's place, encrypted the same way, and we convert and delete it like any other. We never store, log or share the password itself. If a PDF's password does not come, we delete the PDF after 1 hour.

A statement you email to us because it did not convert is the one exception: the people who build our converter read it, and we use it only to add support for its layout and do not share it or use it for anything else. We delete it from our mailbox and our systems once that work is done. Blank out any figures or details you would rather we did not see; the layout is what we need.

Your account is an email address. There is no password for us to store or for you to lose: when you sign in, we email a one-time code and link to the address, which stop working 15 minutes after we send them, and the session they start lasts up to 30 days or until you sign out. You can also open an account by typing an address at checkout. That signs in only the browser you typed it in; the first sign-in that proves the address (by its code or its link) signs every other browser out and deletes what that account converted before, so a mistyped address never hands anybody your statements. If an account opened that way is never confirmed, bought with or used again, we delete it after 7 days, with the customer record Stripe made for it. We send email only to operate the service: the sign-in code and link, a notice when the ways you sign in change, and billing notices such as a renewal that needs you.

You can also sign in with a passkey. A passkey keeps its private key on your device; we keep only its public key, the browser you made it on and when you last used it. Your fingerprint or face never leaves the device.

Your new account has a free trial of 15 pages, once for each address. To keep one address from getting a second trial, we keep a keyed hash of your email address: a value that nobody can turn back into the address without a key that we keep only on our server and in our encrypted backups. We keep it after your account is deleted, only so that the address does not get a second free trial, and we use it for nothing else. We hash the address without a "+" tag, and for Gmail without its dots, because those reach the same inbox; your account keeps the full address, with any tag and dots, in lower case and without spaces.

Stripe handles payments. Your card details go to Stripe directly and never reach our servers; we keep only your subscription state and what Stripe needs to identify your customer record. Stripe processes them under its own privacy policy.

Like every web service we see the IP address of each request, which we use for rate limiting and abuse protection. We record it with a sign-in request, a session, an audit event, a statement you drop in before you sign up (as described under Your statements), and the log line of a sign-in or of a statement we refuse before you sign up, and it goes when we sweep the row it is on. Your email address is not in the audit trail: for a sign-in request we record a keyed hash of it instead, so that we can still answer "how many links went to this address" while a copy of the trail holds no addresses.

Our audit trail — a plan changed, a conversion refused, a sign-in link sent — is append-only: no query can rewrite it. We sweep it after 1 year. You can read your own account's on its Activity page. We log requests to operate the service, and a log line names the account, the conversion, a request id and, for a sign-in or a statement we refuse before you sign up, the IP address — never the email, the sign-in link, the session token or the filename.

When you arrive by a link from another site, or by a link carrying campaign tags, we set a cookie that remembers for 30 days where you came from: the other site's name but not its page, the tags, the page you landed on and the day. If you drop a statement here before you sign up, our audit trail records it with that statement, and if you go on to open an account, your account keeps it, so we can tell which places bring the people who use our service. It goes nowhere else, and our site works the same without it. The button below deletes it from this browser and stops us setting it again; an account you have already opened keeps what it recorded until the account is deleted, and the audit trail for 1 year.

This browser remembers nothing of where you came from.

Stop remembering it in this browser

We count visits and see which pages people read with Umami, which runs on our own server rather than a third party's. It sets no cookies and stores no IP address; we count nothing from the pages behind a sign-in, and no statement, email address, sign-in link or spreadsheet reaches it. We serve the fonts from our own site rather than from a font network, so no third party sees your address. Our other cookies keep you signed in and protect your forms. Four more remember something for you: which statements you dropped in before you signed up, for 30 days (we keep only a hash of that cookie, as described under Your statements); the plan you picked before you had an account, for a day; a message for the next page you see, for a minute; and that you said "Not now" to a passkey, for 180 days.

You can ask us at any time for a copy of the data we hold about you, or ask us to delete your account and its data. Because we delete statements and results automatically as described above, in most cases the only data we still hold is your account and billing record. When your account is deleted, we keep the keyed hash of its address, for the reason given under Your account.

If this policy changes in a way that matters, we will note the new effective date here.