What happens to your statements, in plain language.

Your browser sends each PDF directly to encrypted storage over a short-lived upload link restricted to that file. Files never pass through the website’s servers.

The statement is read on Amazon Web Services in the US. The results are stored encrypted alongside the file, and your browser shows the PDF by rendering it locally.

By default, everything is deleted 24 hours after upload — the file, the extracted transactions and any edits. Signed in, you can choose to keep a batch for up to 30 days instead; it’s deleted on the date shown on the batch. Expiry is enforced the moment it passes: an expired file can’t be opened even if the cleanup job hasn’t run yet.

You don’t have to wait. Delete removes a file — or a whole batch — and its results immediately. We don’t keep backups or old versions of documents, so deleted means deleted. Every deletion, by you or on schedule, leaves a receipt you can download: dates, file and page counts, never names or contents.

One exception, only if you choose it: when you report a problem you can let us open that file. We then keep a copy of it and of what we read from it for 30 days, readable only by AnyStatement staff, and every time it is opened is recorded. Deleting the file deletes the report and the copy, and you can delete them from your account at any time.

Every connection uses TLS; unencrypted connections to storage are refused. At rest, files, results and job messages are encrypted with a dedicated AWS KMS key.

Without an account, each browser gets a private, anonymous session with a random 256-bit key. Only that session can open its files; we store just a one-way hash of the key, so even a copy of our database can’t be used to open them.

When you sign in, your batches belong to your account instead, and only you can open them. Anything you converted before signing in moves to your account, so nothing is lost.

Requests for anything that isn’t yours are answered as “not found”, so file IDs can’t be probed.

Accounts are optional. Sign-in is handled by WorkOS on its own page, with an email address and password or with Google; we never handle your sign-in password. Multi-factor authentication isn’t available yet.

You stay signed in for at most 7 days, and are signed out after 8 hours without activity. To sign out everywhere, sign out on each device; if you think someone else is signed in to your account, write to support@anystatement.com and we’ll end all its sessions.

Your account keeps your email address (for receipts and support), a display name if you set one yourself (a name from your sign-in provider isn’t stored), your plan, your page usage and your preferences, such as where you usually export to. It never keeps your documents: they’re deleted 24 hours after upload, as without an account, or on the date you chose for a batch you keep.

Payments are processed by Stripe. Card details go straight to Stripe; we never see or store your full card number.

Deleting your account cancels any subscription immediately, deletes your batches, page balance, usage history and profile, and removes your sign-in from WorkOS.

Text in scanned pages is recognised with Amazon Textract. When a statement’s layout isn’t one our parsers know, a model on Amazon Bedrock helps structure the text. Both run in AWS regions in the US; no other company processes your documents.

Your documents are never used to train AI models — not by us and not by AWS.

• Passwords for protected PDFs are used once, in memory, to unlock the file. They are never written to storage, queues or logs.
• Document data in logs. Logs contain IDs, sizes, page counts, timings and error codes — never file contents, transactions, filenames, account numbers or session keys.

Structured account-number fields and saved export preferences keep only the last four digits. Original statements and retained source or OCR text can contain full printed numbers until the file is deleted; we do not redact the original PDF.

The site has no analytics, advertising or tracking scripts. Its Content Security Policy restricts the origins allowed for scripts, frames and connections, including the services needed for checkout. This reduces exposure; it is not a guarantee that data cannot leave the page. Sign-in happens on WorkOS’s own page.

Without an account, your session key is kept in this browser’s local storage. Signed in, your session is a sealed cookie that page scripts can’t read; from it, the page gets an access token valid for five minutes, keeps it in memory only, and sends it to our API with each request. Signing out clears everything we keep in your browser. The full list of cookies and storage says what each item is for and how long it lasts.

The Privacy Policy covers what we collect, how long we keep it and your rights; the Terms of Service cover using the service; and the subprocessor list names every company that handles data for us, and what it receives. Businesses can review our draft Data Processing Addendum.