Security

Your statements never leave your device

Bank statements contain names, addresses, account numbers and every purchase. The safest way to handle them is not to take them at all. So we don’t.

Your files never leave your device

Your statement is read right on your phone or computer. It is never sent to us. The only thing that can leave your device is a problem report you choose to send, and you see every word of it first.

Locked so it can’t send data

The site tells your browser to block every connection to other websites and to run only our own code. Even if something went wrong, your data couldn’t be sent anywhere.

Nothing is saved

Your statements only exist while the page is open. Close it and they are gone. We keep no files, no transactions and no passwords.

No internet needed once open

Once the converter has opened, you can turn off your internet and keep converting PDF statements. That is the simplest proof that nothing is being sent.

Passwords stay with you

If your PDF has a password, it is only used to open the file on your device, then forgotten.

No trackers or ads

No tracking, no ads, no advertising cookies. Everything the site loads comes from our own website, not from other companies.

Check it yourself in 30 seconds

  1. Open the converter and wait for the page to finish loading.
  2. Turn on airplane mode, or unplug your network cable.
  3. Drop a statement in. It converts and downloads exactly as before.

Developers can also open the browser’s developer tools (F12), choose the Network tab and convert a statement: only the site’s own files appear and no request carries your data.

What the security policy enforces

  • connect-src 'self': the page may only fetch files from this site, never from anywhere else.
  • script-src 'self': only our own published code runs; injected scripts are refused.
  • form-action 'none' and frame-ancestors 'none': the page cannot post forms anywhere and cannot be embedded in another site.
  • Text read from your statement is always displayed as text, so a malicious PDF cannot inject code into the page.
  • CSV exports neutralise cells that spreadsheet programs could treat as formulas.

Responsible disclosure

Found a security issue? Email sheetlark@gmail.com. We respond quickly and credit researchers who report responsibly.