Your statement stays in your browser.
Your bank files stay in your browser. Accounts, quotas and basic usage statistics are handled separately.
Financial files
Selected and pasted files are processed in browser memory. We do not upload or store bank statements, transaction descriptions, amounts, dates, account numbers, institution identifiers, filenames or financial-file hashes. Reloading, closing the tab or choosing Start over clears the current conversion. Downloaded files stay where you save them.
Guest use and sign-in
You can use the Guest plan without an account. A local browser counter stores the month and random export receipts, not file contents. Essential browser storage also remembers your measurement choice and whether you signed in. A signed-in session uses a secure HTTP-only cookie.
If you sign in with Google or GitHub, we store the provider, its account identifier, your verified email and the account creation time. We do not request access to Gmail, Google Drive or GitHub repositories. Provider tokens are used to verify identity and are not retained. Accounts created with different providers are not automatically linked.
Usage allowances and payments
We keep monthly export counts and random export receipt identifiers to deliver your allowance and prevent duplicate deductions. No financial-file content is needed for this check. If you buy Pro, Creem handles payment information. We retain the order and checkout references, product, payment environment, access dates and usage needed to deliver the pass and handle refunds. We do not receive or store payment card numbers.
Account and service records are stored in a separate application schema in Supabase, with a dedicated backend login. Hosting and account endpoints run on Vercel. Essential service counts may be summarized to understand capacity and use of free and paid plans.
Basic usage statistics
Basic usage statistics are on by default to help us improve conversion reliability and understand demand. We send only fixed event types (tool opened, file parsed, conversion error, file exported, allowance reached or Pro checkout selected), converter type, a broad transaction-count band (1–100, 101–1,000 or 1,001–10,000) and a fixed error category.
These requests carry no sign-in cookie or referring page URL. Each event has a new random identifier; we do not create a persistent visitor identifier. Events do not contain your email, account identifier, filenames, financial amounts, descriptions or arbitrary error text. We do not use advertising pixels or session replay. Our hosting provider still processes normal connection information as described below.
You can turn off usage statistics below without affecting your allowance or conversions. We also honor a previously saved opt-out, Global Privacy Control and Do Not Track. The choice applies to this browser. Usage events are pruned after 90 days when new events are processed; dormant data may remain until the next cleanup. Signing in does not subscribe you to marketing emails.
This setting does not change essential account, allowance or payment records.
Security and normal website requests
Vercel hosts the website and Cloudflare manages the domain and mail routing. Providers process normal connection information, including IP address, request time, URL and security events, under their policies. Our abuse controls use a short-lived keyed hash of connection information, not a stored raw IP address. This is separate from bank-file processing. Account and payment responses are not publicly cached.
Retention and your choices
Sessions expire after 7 days and are revoked on sign-out. Short-lived service records are pruned during normal account activity. We retain account information while the account remains active and payment records as needed for delivery, refunds and applicable obligations. Contact support@qfxtoqbo.com to request access or deletion; mandatory financial records may need to be retained. We do not promise removal of provider-controlled logs on a schedule we cannot control.
Support
Messages sent to support@qfxtoqbo.com pass through Cloudflare to our Gmail inbox. Send the error and, for payment help, an order reference. Do not email passwords, card numbers or unredacted bank statements. Ask before sharing a sanitized sample.