Convert a statement

How privacy works

Last updated: November 1, 2026

Rowkeel converts bank statement PDFs inside your browser. The PDF file is not uploaded to our servers. This page explains how that works, how you can check it yourself, and lists every piece of data the site does send.

How local conversion works

  1. When you choose a file, the page reads it in your browser’s memory. Nothing is sent over the network at this point.
  2. A background process in the same tab extracts the text, finds the transaction table and checks the rows against the statement’s opening and closing balances.
  3. The result stays in the memory of that browser tab. When you close the tab, it is gone.
  4. Excel, CSV, QBO, OFX and Xero files are built in the browser and saved straight to your device. Export makes no network request.

There is no server-side file processing. Our servers do not receive the PDF, its password, its text, the transactions, amounts or balances.

Check it yourself

You do not have to take our word for it.

  • Network tab. Open your browser’s developer tools (F12, or right-click and choose Inspect), go to the Network tab, then convert a statement. You will see small requests to our own domain (listed below) and no upload of the file. You can click each request and read its body.
  • Go offline. Load the page, turn off Wi-Fi or mobile data, then convert a statement. Conversion and export still work, because everything they need is already in the browser.

What the browser enforces

Every page is served with a Content Security Policy (CSP) header. It tells the browser which servers the page may talk to:

default-src 'self'; connect-src 'self' https://cloudflareinsights.com;
script-src 'self' https://static.cloudflareinsights.com <hashes>;
worker-src 'self' blob:; style-src 'self' <hashes>; img-src 'self' data: blob:;
font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';
frame-ancestors 'none'

In plain words: CSP blocks our pages from connecting to other domains, apart from our hosting provider’s cookieless page-view statistics. The browser blocks requests to other domains (data requests, beacons, images, fonts, scripts, forms), including any that third-party code in the page might attempt. You can read the header yourself in the Network tab (click the page request, then Response Headers).

CSP has limits, and we want you to know them:

  • It does not block requests to our own domain. That is why the next section lists every field those requests contain. Our server checks each such request against a fixed list of allowed fields and rejects any request with an unknown field, a value outside the allowed list, or a body that is too large.
  • It does not cover top-level navigation (clicking a link, opening a new window) or WebRTC.

Offline cache

The site keeps an offline copy of itself so the converter works without a connection. It stores only our own pages, scripts, styles and fonts in your browser’s cache, not your files, conversion results or the data requests listed below.

What the site does send

Free conversion limit

Before a conversion the page asks our server how many free statements you have left this calendar month (5 a month without an account, 15 when signed in), and after a successful conversion it reports it. A file over 30 pages counts as one statement for every 30 pages or part of them. A file that is not a bank statement does not count. The request contains:

  • pages: number of pages in the file
  • authorization: your account token, only if you are signed in or bought Pass or Pro

To count statements per visitor without storing IP addresses, the server computes a one-way hash of your IP address combined with a random salt that changes every calendar month (UTC). The salt is deleted after the month ends, so last month’s hashes cannot be linked to this month’s or turned back into an IP address. The monthly counters are deleted the same way.

Automatic diagnostic report

When a conversion fails or is only partly successful, and for a random 2% of successful conversions, the page sends a diagnostic summary so we can find and fix conversion problems without asking you for your statement. It is built in your browser from an allow-list. It contains only these fields:

  • schemaV: format version of the fingerprint
  • engineVersion: parser version
  • appVersion: website version
  • bankId: bank layout id from our public list (or "generic")
  • profileVersion: version of that bank layout
  • outcome: ok, degraded or failed
  • recon: balance check result: verified, mismatch or unverifiable
  • codes: up to 16 failure codes from a closed list, with small counters (capped at 999), page rotation, export format and number shapes
  • pages: page count as a range: 1, 2–5, 6–20 or 21+
  • pageSize: A4, Letter, Legal or other
  • rotation: page rotation: 0, 90, 180 or 270
  • itemsPerPage: how many pages fall into each text-density range
  • fontsCount: number of fonts, as a range
  • headerWords: column header words, only words from our public header dictionary (such as Date, Description, Balance)
  • columnCount: number of columns
  • columnX: column positions as a share of page width, rounded to 0.05
  • dateShapes: date formats such as DD.MM.YYYY, from a closed list
  • moneyShapes: amount formats with every digit replaced by 9, for example -9.9 or 9,999.99
  • decimalsHist: how many amounts have 0 to 4 decimals, as ranges
  • currencies: up to 4 currency codes from a closed list
  • rowsFound: number of rows found, as a range
  • datedLines: number of dated lines, as a range
  • skipped: number of skipped rows, as a range
  • lowConfidence: number of low-confidence rows, as a range
  • hypothesis: which parser path was used: bank layout, generic, or bank layout then generic
  • detectScore: bank detection score (two decimals)
  • secondScore: score of the second-best bank match (two decimals)
  • order: whether rows run oldest-first or newest-first
  • breakRowIndex: row number where the running balance first breaks (capped at 999)
  • breakCount: number of balance breaks (capped at 999)
  • deltaClass: type of balance difference: sign, missing row, digit or total only
  • deltaBucket: order of magnitude of the difference, for example 10–99
  • sampled: true when this was a random sample of a successful conversion

It does not contain:

  • the PDF file or any part of its text
  • amounts and balances
  • names, addresses and transaction descriptions
  • account, card or IBAN numbers, even masked
  • file names and PDF passwords
  • error messages and stack traces

To count how many different people hit the same problem on a given day, the server stores a short hash of your IP address with that day’s salt. Because the salt is deleted after a day, this cannot be linked across days or turned back into an IP address. It is sent only while “Help improve Rowkeel” is on: off by default in the European Economic Area and Switzerland, and off everywhere if your browser sends Do Not Track or Global Privacy Control, unless you turn it on; see the privacy policy.

“This row is wrong”

If you flag a row, the page sends only:

  • bankId: bank layout id
  • profileVersion: version of that bank layout
  • issue: one reason from a fixed list: wrong amount, wrong date, wrong sign, not a transaction, split row
  • appVersion: website version

No row number, text, date or amount is sent.

“Send page layout”

Only if you click it, see the preview and click Send a second time:

  • skeleton: the masked page layout you saw in the preview (first 3 pages at most): positions and sizes of text pieces, every letter replaced by a or A and every digit by 9, except header dictionary words and the bank name
  • code: which screen the report came from (for example "not a statement")
  • appVersion: website version
  • bankName: bank name, only if you typed it
  • country: country, only if you typed it
  • email: email address, only if you typed it, so we can tell you when the bank is supported
  • markup: beta banks only: for each line of the masked layout, its line number and whether you ticked it as a transaction (no text)
  • issue: beta banks only: one problem type from a fixed list: missing rows, wrong amounts, wrong dates, wrong sign
  • bankId: beta banks only: bank layout id
  • profileVersion: beta banks only: version of that bank layout

Usage statistics

Anonymous product events (for example “a file was converted” or “the pricing page was viewed”) are sent without cookies or sign-in credentials. They have no user id and are turned off the same way as the diagnostic report, which also stops the page-view statistics script from loading. Each event holds at most:

  • ts_hour: date and hour (no minutes or seconds)
  • event: event name, such as file_dropped, parse_ok, export or pricing_view
  • page_type: type of page (home, bank, format)
  • bank_id: bank layout id
  • pages_bucket: page count as a range
  • status: balance check result or error code
  • format: export format
  • plan: free, pass or pro
  • reason: failure code from the closed list
  • product: product chosen at checkout
  • disabled: whether an option was turned off
  • locale: site language
  • country: country code derived from the connection (two letters, not the IP address)

If you have an account

You only need an account to pay for Pass or Pro.

  • Sign-in runs on a separate site, app.rowkeel.com, through our authentication provider, which stores your email address and sign-in details. Its code does not load on the converter pages, so it has no access to your files.
  • Payments are handled by our payment provider, the merchant of record, which stores your payment details; we do not receive your card number.
  • We store your plan and, for Pro, a conversion history with metadata only:
  • user_id: your account id from our sign-in provider
  • created_at: date and time of the conversion
  • file_name: file name (you can turn this off in account settings)
  • bank_id: bank layout id
  • pages: number of pages
  • status: balance check result
  • format: export format

You can turn off file names, clear the history or delete your account in your account settings.

What we do not claim

We have no third-party security certification or audit. This page describes how the site is built; the privacy policy covers your rights and how long data is kept.

Reporting a problem

If you find a security issue, please write to support@rowkeel.com. We usually reply within one business day.