Privacy at a glance
You decide whether analysis remains temporary or is kept in your profile. No uploaded statement enters a publicly accessible file collection.
Temporary analysis
Temporary output is tied to the session; both it and the encrypted claimable file expire in 30 minutes unless deleted earlier.
Account file retention
Files saved to free profiles last 30 days, while Premium files have no scheduled expiration. Either can be downloaded or removed earlier.
Google sign-in
Sign-in uses basic profile identity only, without asking for Gmail, Drive, contacts, or financial-account access.
Uploaded statements
An upload is used to produce the requested analysis, never to populate a public library. Depending on its format, processing may read statement text or page images. Submit a statement only when you have authority to process it.
Synthetic statement generator
The synthetic statement form operates entirely within the visitor's browser. Entries such as fictional labels, dates, descriptions, directions, and amounts are not sent to this server. A page reload erases the form. Generated output always carries a fixed demonstration account reference and lasting synthetic-record notices.
Temporary results
To allow profile creation from a result page, the analysis, user notes, and an encrypted upload copy are held briefly under restricted server permissions. This material belongs to the same browser session, is excluded from indexing, expires in 30 minutes, and may be erased immediately.
Saved account files
Original statements retained in a profile are encrypted while stored. Free files expire after 30 days; premium storage has no automatic deadline. Users may remove either kind sooner.
Choosing Save while signed in retains extracted transactions, the tax year, analysis totals, statement and transaction notes, review confirmations, reviewer comments, and the latest review time. When a statement expires or is deleted, its analysis, notes, workpaper, and transaction records are removed with it. Maintain independent copies needed for accounting, legal, or tax duties.
Accounts
Through Google sign-in, only the OpenID identifier, email, and display name are requested. Permissions for Gmail, Google Drive, contacts, bank accounts, and Google payment information are not requested.
Usage allowances and category rules
Monthly upload totals and brief request-rate windows are recorded to enforce plan allowances during simultaneous processing. Activity from signed-in users is associated with their profile identifier. Guest requests use a random session identifier retained only as a one-way hash. Allowance records exclude statement contents. A category rule is stored only when a signed-in user asks to remember a correction, and contains just a reduced description pattern plus the chosen category.
Budgets, goals, reports, and recurring reviews
Private profile data may include saved category budgets, savings targets, account labels, decisions about repeated payments, and generated summaries. Forecasts rely on simple historical baselines; they neither predict investment returns, promise results, nor transfer funds. Reports stay connected to the profile until account deletion or the relevant retention process removes their underlying data.
Household collaboration and shared budgets
Household owners invite signed-in participants with a private link that expires and works only for the specified email. Its token is retained as a one-way hash. Active members decide whether their calculated monthly totals contribute to the household. Views never reveal another participant's source statement, personal notes, or full transaction wording. Shared budgets count opted-in debits after excluding duplicates and transfers, with currencies kept apart. Members can stop sharing or leave; owners can remove them.
Recorded currency conversions
A conversion record can contain an original amount, source and destination currencies, rate, rate source, optional URL, date, note, and calculated value. Signed-in users may keep it private or share it with an active household. The record documents arithmetic without changing extracted rows or merging currencies automatically. Household-linked conversions are visible to members, but deletion remains available only to the creator.
Referral program
Referral records connect the referring profile, new profile, qualification state, and reward month. Reward review begins only after a valid analysis is completed by the new account. Existing profiles, self-referral, repeated qualification, and activity over the monthly cap are ineligible. These records hold profile identifiers and event timestamps, not statements, transaction wording, balances, values, or results.
Optional reminders
Missing-statement and monthly-summary emails remain disabled until a signed-in user turns them on. Messages exclude transaction descriptions, balances, totals, and attachments. Either option can be switched off in Account Settings. Delivery logs retain the profile identifier and job state needed to avoid duplicates and diagnose failures.
Operational events and audit records
A small set of operational events is logged, including completed uploads, report creation, and exports. Properties use approved labels and exclude statement text, transaction wording, amounts, uploaded names, and email addresses. Separate private audit entries use action names and internal identifiers to trace profile changes. Permanent deletion of an eligible account removes both kinds of record.
Subscription and report billing
Billing operations are performed by Stripe, including subscription and single-report checkout, payment methods, invoicing, renewals, refunds, and portal access. Bank-Statement.net keeps only the customer and purchase references, plan price and interval, status, cancellation choice, payment reference, and report-credit use needed for access. Complete card numbers are never retained here. Stripe governs billing information under its own privacy terms.
Merchant identification
After extraction, merchant matching can process reduced wording independently of the statement file. The input removes digits, long references, emails, URLs, card endings, and routine bank text. Neither document nor transaction date, value, balance, account identifier, or profile is sent. Returned identities, categories, rationales, and links are suggestions; unsupported or uncertain results remain open.
Dashboard calculations
Using saved extracted transactions, the private dashboard derives spending groups, monthly inflows and outflows, recurring candidates, balance ranges, possible tax items, period coverage, reconciliation state, and exception counts. Premium comparisons measure differences across chosen months, quarters, or years. Missing-month notices rely on readable periods belonging to the same identifiable account, so absent dates or identifiers can make them incomplete.
Tax worksheet calculations occur in the browser. The chosen country, year, rate, transactions, and allowable percentages are not sent to this site. Compare all calculated values with the original statements.
Advertising and cookies
Once approved and enabled, advertising on public information pages may use Google AdSense. Google and other vendors may then place cookies and select ads using visits to this or other websites. Depending on visitor choices and applicable requirements, Google and its partners can deliver personalized or non-personalized advertising.
Personalized advertising controls are available through Google Ads Settings. This policy will name any additional enabled vendor and provide its opt-out details. Where required, personalized advertising for visitors in the EEA, United Kingdom, or Switzerland will not run until a Google-certified consent platform is active.
Service subprocessors
Approved subprocessors receive only what is required for analysis or merchant identification. Statement work may use readable content or rendered pages. Merchant requests contain reduced descriptors, excluding the uploaded file, dates, amounts, balances, account identifiers, and profile information. Service settings and contracts restrict access.
Security and limits
Controls include secure transport, encryption for stored profile files, private result addresses, session binding, permission checks, size limits, and automatic removal of temporary output. Absolute security cannot be guaranteed by any online service. Remove unneeded information before upload. If a recipient needs only certain fields, use the bank statement redaction workflow. Before transferring a copy, follow the secure statement transfer checklist. The secure-sharing and redaction guides cover minimization, redaction checks, delivery methods, and disposal.
Contact and rights
Requests to access, amend, or erase profile information should use the contact and privacy request page. Email must not contain a statement or full account details. Applicable rights vary by jurisdiction, and service requirements appear in the Terms of Use.
Account deletion
After confirming the profile email, an eligible signed-in user may permanently erase the account through Account Settings. Removal includes encrypted documents, analyses, entries, notes, confirmations, budgets, goals, summaries, recurring decisions, reminders, operational and audit events, usage data, category rules, private conversions, household participation or ownership, and referrals. Cancel active paid subscriptions in billing management beforehand to clarify later charges and remaining access.