Privacy Policy.

We try to collect only what the service actually needs. In practice that is five things:

• Account and contact info — your name and email, and your password (stored only as a secure hash). We use this to run your account, sign you in, and email you about your statements and your account.
• The logins you choose to connect — the username and password (and any similar credentials) for each bank, credit card, e-commerce, or buy-now-pay-later account you ask us to fetch from. More on how these are handled below.
• The statements we fetch — the PDF statements we download for you, and the CSV files we create from them for QuickBooks. This is the whole point of the product.
• Sign-in recordings — masked recordings of you signing in to an account, which teach us how to sign in to it for you. Section 04 covers exactly what they hold and who reads them.
• Basic app and usage data — things like which pages you visit, your browser and device type, and error logs, so we can keep the service working and secure. We do not use this to build advertising profiles.

StatementKeep is not for anyone under 18, and we do not knowingly collect information from children.

To download your statements, we have to log in to your accounts the same way you would. That means we store the credentials you give us — but carefully:

• They are encrypted the moment you enter them and kept in a dedicated secrets vault, never in plain text.
• They are reversible by design — we have to be able to decrypt them at fetch time to type them into your bank's login page. There is no way around that; a login has to be usable.
• They are used only to fetch your statements, and for nothing else.
• We never sell them, share them, or hand them to anyone outside the service.

You can remove a connected login at any time, which deletes its stored credentials.

The statements we download and the CSVs we generate from them are yours. We store them so you can come back and get them, and we process them only to do the job you asked for — downloading, converting to CSV, and filing them in your account. We do not sell them, share them, or mine them for anything else.

To learn how to sign in to an account for you, we ask you to sign in to it yourself, twice, in a secure browser, and we record each sign-in.

• What a recording holds. For each screen, a recording holds a picture of the screen, a description of the buttons and boxes on it, a cleaned copy of the page’s code, and where you clicked. For what you typed, it holds only how many characters you typed and how quickly, never the characters themselves.
• What is masked. Before anything is saved, every text box in every picture is blacked out, whether or not you typed in it, and so is any text with four or more digits in a row. In the descriptions, every run of four or more digits is replaced with dots, and every email address is masked. In the page code, every run of four or more digits is replaced with dots, and the values of form fields and the contents of inline scripts are removed.
• AI processing. Recordings are processed by our AI providers, with personal information masked first: what you typed is never recorded, and text boxes and long numbers are blacked out before a recording is saved. Only the masked version of a recording is ever sent. A picture can still show other things on the screen, such as your name on a welcome page.
• What we learn from it. The sign-in automation we build from it is code for that institution, so it can also sign in for other customers who use the same institution. Your recordings themselves are never shown to another customer.
• Who can read it. Three AI agents read recordings: a scout, an author and a supervisor, which together build and check the sign-in for your account. Each gets its own access to one account’s recordings for one run, and that access expires within 24 hours. Our support staff cannot open a recording unless you give one named support person access, for one support ticket, for 24 hours at most. Being on staff opens nothing by itself. On a team, admins who manage accounts can view recordings; read-only members see only small previews. The automation that fetches your statements never reads a recording. Every read of a recording is written to an access log.
• Encryption. The pictures, descriptions and page code in each recording are encrypted with that recording’s own key, and that key is locked with your account’s own encryption key in our secrets vault, so one customer’s recordings are cryptographically separate from another’s. Click positions and typing counts, which contain nothing you typed, are stored without that extra layer of encryption.
• How long we keep it. We keep the current recording for each account until you finish recording that account again, remove the account, or delete your StatementKeep account. When you finish recording an account again, we delete the recording it replaces 30 days later. A recording you start but do not finish is kept until you remove the account or delete your StatementKeep account. When you delete your StatementKeep account, we delete all of your recordings with it and destroy the encryption key that protected them. We keep the access log for as long as you have your account, plus 1 year after you delete it, and then delete it. The log says who read a recording and when; it holds no pictures and nothing you typed.

Some financial institutions will only let you in from an ordinary home internet connection, not from a data center. Phone helper is an optional feature that lets your own phone route your own statement-fetch traffic through your home internet so those institutions work. Here is exactly how it behaves:

• Only your own traffic. Your phone only ever carries the traffic for your own connected accounts — never anyone else's, ever.
• Your phone cannot read it. The connection to your bank is encrypted end to end. Your phone simply forwards that encrypted traffic along; it never unlocks it, never sees your login or statements, and cannot act as a middleman. It is a relay, not a reader. The data stays encrypted in transit and at rest.
• Used only for your statements. We never use the phone connection for anything other than fetching your own statements, and never on behalf of anyone else.
• Off unless you turn it on. It is opt-in and off by default. The app shows you a specific agreement the first time you enable it, and you can turn it off again whenever you like.
• Minimal operational data. To run this feature we keep a little bookkeeping: whether your phone is currently online and when it was last seen (so we know where to route), and a rough count of how much data has passed through (so we can show it to you). We keep this to the minimum needed to make the feature work.

Security is the core of this product, so this is not boilerplate:

• Encrypted in transit. Everything travels over TLS — your browser to us, and us to your bank.
• Encrypted at rest. Your statements and CSVs are encrypted where they are stored, with keys scoped to your account, so one customer's files are cryptographically separate from another's.
• Credentials in a vault. Your logins live in a dedicated encrypted secrets vault, separate from the rest of your data.

No system is perfectly unbreakable, but this is real, specific protection rather than a padlock icon. You can read more on our Security page.

We do not sell your information — any of it, ever. We do not trade or rent it for marketing, and we do not share your credentials or statements with outside parties for their own use.

The only companies that touch your data are the service providers we use to run StatementKeep — for example, cloud hosting, storage, email delivery, and the AI providers that process masked sign-in recordings (section 04). They act on our instructions, only to help operate the service, and nothing more. We may also disclose information if the law genuinely requires it, or to protect against fraud or a threat to someone's safety.

If you give us your mobile number and tick the SMS-consent box in your account settings, we send you transactional text messages only: sign-in codes, statement-retrieval status, and action-needed alerts. Consent is optional and never a condition of service; message frequency varies, and message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your phone number and SMS consent are used solely to deliver the messages described above, via our SMS delivery provider acting on our instructions.

We keep your account, your connected logins, and your statements for as long as you keep your account, so they are there when you need them. If you close your account, we delete your stored credentials right away and your statements and CSVs shortly after, except for the few records the law may require us to keep for a while.

Sign-in recordings follow their own schedule. We keep the current recording for each account until you finish recording that account again, remove the account, or delete your StatementKeep account. When you finish recording an account again, we delete the recording it replaces 30 days later. A recording you start but do not finish is kept until you remove the account or delete your StatementKeep account. When you delete your StatementKeep account, we delete all of your recordings with it and destroy the encryption key that protected them. We keep the access log for as long as you have your account, plus 1 year after you delete it, and then delete it. The log says who read a recording and when; it holds no pictures and nothing you typed.

Every automatic statement download keeps a masked picture of each step it takes, so we can fix the automation when a download goes wrong. Before a picture is saved, every text box, every number and amount, every email address, and your own name, email, phone and address are covered. We keep these pictures for 7 days after a fully successful download and for 30 days after any other, and then delete them. Only our staff and the automation that repairs downloads can see them.

It's your data, and you're in control:

• See it. You can access your statements and account information from within the app.
• Remove a login. Disconnect any account at any time to delete its stored credentials.
• Delete it all. You can delete your account yourself, from inside the app: Settings → Delete your account. It asks you to confirm, then removes your statements, your stored credentials, your sign-in recordings and your connected institutions, cancels any active subscription, and destroys the encryption key that made your files readable — so nothing left anywhere can be decrypted. The access log of who read your sign-in recordings is kept for the time section 09 states. It cannot be undone. If you would rather we did it for you, just ask.
• Turn off Phone helper. Enable or disable it whenever you want.
• Stop the texts. Untick the SMS box in your account settings, or reply STOP to any message.

Depending on where you live, you may have additional rights — such as requesting a copy of what we hold or asking us to delete it. Just reach out and we'll help, wherever you are.

StatementKeep is operated by [StatementKeep legal entity]. If you have any questions about this policy or your data, or you want to exercise any of the choices above, email us at support@statementkeep.com or call 1-628-888-6331. We'll be glad to help.

If we make a meaningful change to this policy, we'll let you know and update the date at the top of this page.