Trust centre
Security & Local Processing
What stays on your device, what the website can receive and how to report a concern safely.
Effective and last updated: 23 August 2026
Your statement stays on your device
The current converter loads the PDF into browser memory, extracts text or performs OCR locally, and creates Excel or CSV files on the same device. The application does not intentionally transmit statement contents to its servers.
What local processing means
- No account is required to convert a statement.
- No database stores your PDF or extracted transaction table.
- The output is generated as a local browser download.
- Resetting, refreshing or closing the page ends the working session, subject to browser behaviour.
- Password protection is not bypassed.
What may still leave your device
Like ordinary websites, hosting and security infrastructure may receive technical requests including IP address, browser details and timestamps. Before conversion, a minimal consent receipt is stored with a random identifier, server timestamp, legal versions and pseudonymous browser identifier; it excludes statement contents, filenames, financial data and raw IP addresses. Support emails leave your device when you send them. Google AdSense and its partners may receive advertising identifiers and related website information according to applicable consent choices.
Your responsibilities
Use a trusted, updated device and browser. Protect downloaded files, remove them from shared devices, and confirm that you are authorised to process the statement. Do not email unredacted statements.
Security limitations
No browser, device or website can be guaranteed absolutely secure. We do not claim security certifications, independent audits or encryption standards that have not been formally verified. The local-processing design reduces server-retention exposure but does not eliminate risks on the user’s own device.
Report a concern
Email theonlineentrepreneurship@gmail.com with the subject “Security report”. Describe the issue without including real account credentials or an unredacted statement.