Privacy Policy

TrueStatement is operated by [to be added: registered name of the business], [to be added: address]. We decide how the personal data described here is used, which makes us its “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023.

Questions about this policy, or about your data: truestatement.support@gmail.com.

We never receive your bank statements. When you convert a statement, the PDF is opened and read by software running in your own web browser. It is not uploaded to us or to anyone else, and there is no server that could store it. You can check this yourself: once the page has loaded, disconnect from the internet and a statement still converts.

The same applies to everything read from a statement — transactions, amounts, balances, names, account numbers and GST numbers — and to the Excel, CSV, JSON and Tally files made from it. They are created on your device and saved where you choose.

If a PDF is password-protected, the password you type is used only to open the file in your browser. It is not stored and not sent anywhere.

We do not ask who you are and keep no account for you. The only record of your visit is the anonymous product analytics described in section 5. There are no advertising scripts on the site, and the fonts are served from our own site rather than a third party's.

Like every website, the company that hosts TrueStatement receives the ordinary technical details of each request your browser makes to load a page — such as your IP address, browser type and the page requested — to deliver the page and keep the service secure. We do not use these to identify you or build a profile of you.

We keep only what running an account needs:

• Your email address, to sign you in and to send the emails that sign-in requires.
• Your password, if you choose to set one — stored only as a one-way hash by our authentication provider. Nobody can read it back, including us.
• If you sign in with Google, the name, email address and profile picture Google shares when you agree to it.
• Your plan — Free, Starter, Professional or Growth — and, once payments open, its status and renewal date.
• A receipt for each full statement your plan counts — a statement longer than 10 pages, counted against a paid plan's billing month or as a free account's one full statement — so that you can check the count on Usage & billing. A receipt holds: when it was counted, the PDF's file name and size, the bank, the account type where the statement prints it, the number of pages, a receipt number and a fingerprint of the file (a one-way code worked out from the PDF's bytes, which cannot be turned back into the file — it lets us count the same PDF only once in a billing month). A receipt never holds anything printed inside the statement — no account number, name, transaction, amount or balance. Your month's count is the number of receipts in it. We also keep whether your free account's one full statement is used.
• Converting a statement of 10 pages or fewer is not recorded in your account, and neither is converting the first 10 pages of a longer one: the daily count of those is kept in your browser (section 6), not by us.
• Sign-in records that our authentication provider keeps for security, such as when you signed in and from which IP address.

If you tell us a bank we do not support yet, we keep the bank's name you typed (and your account ID, if you are signed in) so we know which banks to add next. Nothing from the statement is sent with it.

We use PostHog, a product-analytics service, to learn how TrueStatement is used — which pages people visit, where they stop before finishing something, and how they found us — so that we can fix what gets in the way and build what is missing. It records:

• the pages you visit, and when;
• how you arrived — the website, search engine, AI assistant, video or advertisement that linked to us, and any campaign tag in that link;
• the steps you take, such as starting a conversion, finishing one, choosing a download format, opening the plans or signing up — with a few plain facts about the step: the bank's name, a page-count range, and whether the balances checked out;
• your browser, device type, screen size and approximate location (country and city), worked out from your IP address — the address itself is not kept;
• a random identifier kept in your browser's storage, so that visits from the same browser count as one person — and, if you are signed in, your account ID, so we can see which plans people choose.

It never records anything from a statement — not the file or its name, not a transaction, amount, balance, name or account number, and not the password of a protected PDF. Analytics are not used for advertising, and they are not sold or shared.

You can turn analytics off at any time in Settings, or for every site at once with your browser's Do Not Track or Global Privacy Control setting, which we respect.

A few things are saved in your own browser's storage so that the site remembers them. All but the last stay on your device and are never sent to us:

• whether you chose the light or dark theme;
• how many statements this browser has converted today, and today's date — the daily limit is counted here, not by us. Nothing about the statements themselves is in it;
• if you turn on History (it is off until you do) — what was read from each statement you convert while signed in (its transactions, balances and check results, never the PDF or its password), so you can open it again. It is kept per account, stays in this browser, and does not follow you to another device. You can turn it off, delete any entry, or clear it all in Settings;
• if you are signed in, a list of the statements this browser converted for your account and what each counted — the file's name and size, the bank, account type, page count and result, never anything inside it — shown on Usage & billing beside your receipts. It is kept for 6 months; you can clear it in Settings;
• the name groupings you confirm on the analysis screen — these are names from your statements, which is why they stay on your device. You can clear them with Forget saved groupings;
• your Tally company and ledger names, so you enter them once;
• if you are signed in, the sign-in session that keeps you signed in;
• the random analytics identifier from section 5, and whether you turned analytics off — the identifier is sent with the analytics it describes.

TrueStatement itself does not set cookies. Clearing your browser's site data removes all of the above.

To provide the service: to sign you in, apply your plan and its limits, send the emails your account needs, answer you when you write to us, and keep the service secure — and, through the analytics in section 5, to understand how the service is used so we can improve it. We do not use your data for advertising, and we do not sell, rent or trade it.

• Supabase — accounts, sign-in and the sign-in emails, and the small database described in section 4. It is hosted in Sydney, Australia, so this data is stored outside India. Supabase also keeps short-lived technical logs of requests to it, including IP addresses, for security and troubleshooting.
• PostHog — the product analytics in section 5. It is hosted in the European Union, so this data is stored outside India.
• Google — only if you choose to sign in with Google, under Google's own privacy policy.
• Our website host — see section 3.

We do not take payments yet. When we do, this page will name the payment provider before any payment is taken, and your card or UPI details will go to that provider, not to us.

Your account details, your plan and whether you have used your one free full statement are kept for as long as you have an account, and are deleted with it. Receipts for a paid plan's full statements are kept for 6 billing months — the current one and the five before it — and then deleted automatically; the receipt for a free account's one full statement is kept with the account. All of them are deleted when the account is. Once payments open, a record of each payment — the plan, the amount, the dates, its status and the payment provider's reference — is kept for 8 years, as tax law requires, including after you delete your account; it is then detached from you and holds nothing from any statement. Analytics records are kept for up to 12 months, then deleted. Our providers' technical logs are kept for a short period set by them.

You can ask us, at any time, to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it;
• delete your account and everything linked to it, analytics included — except payment records, which the law requires us to keep (section 9);
• nominate someone to exercise these rights for you if you die or become unable to.

Write to truestatement.support@gmail.com from the email address on your account. There is no self-service account deletion yet, so for now we delete accounts on request. If you are not satisfied with our answer, you can contact our Grievance Officer (section 12), and you may complain to the Data Protection Board of India.

Connections to TrueStatement are encrypted. Access to account data is restricted at the database: you can read only your own records, and nobody signed in to the site can change a plan. The strongest protection, though, is that your statements are never sent to us in the first place — there is nothing of them here to breach.

TrueStatement is not intended for anyone under 18, and you must be 18 or older to create an account.

If we change what we collect or who processes it, we will update this page and its date before the change takes effect.

Grievance Officer: [to be added: name], truestatement.support@gmail.com.

See also our Terms of Service.