Privacy proof
See where every kind of data goes
Your financial files never leave your browser. The Financial file data sent: 0 B indicator is scoped to uploaded financial-file bytes and parsed transaction content—not to ordinary page, account, or payment requests.
Your browser
File bytes → parser → canonical rows → target generator → independent reader → comparison → download
Financial content remains hereRows to Books API
Email identity, hashed session tokens, Paddle IDs, access period, export reservation status
No file endpoint existsPaddle
Paddle receives payment information, billing email, tax location, and purchased product.
It does not receive your statementCollected fields and purpose
| Data | Where | Purpose | Retention |
|---|---|---|---|
| Financial file and output | Browser memory | Convert and verify | Until refresh or tab close |
| Saved structural mapping | Browser local storage | Reuse Pro column roles | Until you clear it |
| Email and local user ID | Rows to Books API | Passwordless identity | While the account is needed; deletion by support request |
| Hashed magic/session token | Rows to Books API | Authenticate without passwords | Expiry or revocation |
| Paddle transaction/subscription ID and period | Rows to Books API | Grant, renew, refund, or revoke access | Accounting and dispute obligations |
| Target format and random reservation ID | Rows to Books API | Count successful exports | Entitlement and audit period |
How the boundary is enforced
- The converter worker protocol has no network method.
- Reservation requests accept only target format and a random idempotency key.
- Payment resources load only after you explicitly open checkout.
- No advertising, session replay, chat widget, or third-party analytics runs on converter pages.
- Generated output is parsed by a structurally independent reader before download.
Threat boundary
Rows to Books can guarantee its own application behavior and server boundary. It cannot protect a compromised device, malware, a hostile browser extension, screen-capture software, or a modified browser. A local-first design reduces server exposure; it does not make an unsafe device safe.