Security & Architecture

1. What Runs Locally

• PDF parsing: Performed in-browser via Pyodide + pdfminer.six
• Data extraction: Transaction rows are extracted in browser memory
• CSV generation: CSV files are produced locally and downloaded directly
• Caching: Service Worker caches runtime assets for faster/offline use

At no point is the original PDF uploaded to the application server.

2. External Services Used

For full transparency, this site calls a small set of third-party services:

• Google Analytics: Anonymous page-level usage analytics (can be blocked)
• Google Fonts: Font files from fonts.googleapis.com and fonts.gstatic.com
• Pyodide CDN: WebAssembly runtime files from cdn.jsdelivr.net

These services do not receive your bank statement file contents or extracted transactions from this converter workflow.

3. What Is Not Collected

• PDF files
• Transaction line items
• Account numbers or balances
• Financial statement content of any kind
• Error or crash telemetry from conversion failures

4. Privacy Proof: Verify It Yourself

1. Open browser DevTools and go to the Network tab.
2. Load a statement PDF and run conversion.
3. Confirm there are no network requests containing PDF or transaction data.

Offline verification:

1. Load the site once while online.
2. Disconnect Wi-Fi or disable internet.
3. Convert a statement. The conversion still works because processing is local.

5. Technical Stack

• Pyodide v0.24.1: Python runtime in WebAssembly
• pdfminer.six: PDF text extraction library
• WebAssembly sandbox: Isolated execution in the browser
• Service Worker: Runtime caching for reliability and offline support