The short version: we never receive your files.
StatementSheet processes your PDF statements entirely within your web browser, on your device. Your files, and the transactions inside them, are never uploaded to, transmitted to, or stored on our servers or any third party's servers. A Content-Security-Policy header directs your browser to block this site from sending data anywhere other than our payment-verification endpoint (which receives only a Stripe session ID).
What we do receive: if you purchase a download, Stripe (our payment processor) collects your payment details under Stripe's privacy policy. We receive from Stripe only confirmation that a checkout session was paid. Standard web server logs (IP address, page requested, timestamp) are kept by our hosting provider for security purposes.
What we don't do: no analytics trackers on the converter, no advertising pixels, no user accounts, no database of customer data, no cookies other than what Stripe requires for checkout.
Your spreadsheet is generated in your browser and saved directly to your device. We never see it.
Questions: support@statementsheets.com
This site was created by Richard Lichtenstein and is not associated with Berkshire Partners.
What stays in your browser, and for how long. When you convert statements, the parsed transactions are kept in this browser tab's session storage so your results survive the round-trip to Stripe checkout. That data never leaves your machine, is visible only to this tab, and disappears when you close the tab or click "Start over." Your export-format preferences (date style, debit/credit columns — settings only, never financial data) are remembered on your device so repeat batches come out formatted the way you like.
The one thing we can't protect you from. Browser extensions you've installed with "read data on all websites" permission can read anything displayed on any page — this one, your bank's own website, your email. That's a property of browsers, not of this site, and it applies equally to every statement tool. If you're converting especially sensitive statements, use a browser profile with no extensions, or a private/incognito window (where most extensions are disabled by default).
Analytics. We count page visits with Vercel Web Analytics: first-party, cookieless, and aggregate (page URL, referrer, country, device class). It runs from our own domain under the same strict Content-Security-Policy and receives no file contents, transactions, or personal data. Conversion itself makes zero network requests — verifiable in your browser's Network tab.