Privacy policy

StatementSheet is operated by an individual living in mainland China. StatementSheet is not a registered company. Contact: alexpan@mail.grokbot.com. This page describes the product as it is built. It is not a substitute for advice about the privacy law that applies to you.

The statement file

A text-based PDF is parsed with pdf.js in your browser. The bytes of that file, the extracted table, and the spreadsheet you download are not sent to the server. If you edit a cell, that edit stays in the page.

The exception is scanned or image-only PDFs, and only when OCR is switched on. OCR is off unless the operator has set an Anthropic API key and the OCR_ENABLED flag. In that mode the browser asks before it sends a JPEG of a page to this site, which then sends it to Anthropic's API so Claude can read the table. Do not agree if you do not want that page to leave your computer. Text-based statements never take that path.

What the server does store

License records and page counters are stored in a Supabase Postgres database. They are not written to the server disk.

• A daily free-page counter. The key is a hash of your IP address and the UTC date, plus how many of the 2 free pages were granted. The raw IP is not written into that record.
• If you buy a pack or a monthly plan, a signed license and the email you gave at checkout. The server also stores how many pack pages have been used. The browser copy of the license lives in local storage.
• Hosting logs. Netlify, or whichever host is used, may log IP addresses, user agents, and request paths as part of ordinary web hosting. This site does not add an analytics product.

Payments

Card payments are handled by Creem (creem.io), not by this site. Creem receives the email and payment details you enter on their checkout page. This site receives a webhook with the plan, a request id, and the email Creem reports. The site does not see your card number.

How long, and your requests

The usage file is a local JSON file on the server. On a serverless host it can be wiped when the instance is replaced, so it is not a durable archive. Email the contact address to ask what is still stored for your email, or to ask for a license record to be revoked. There is no account dashboard.

The operator is an individual in mainland China. If you are in the EEA, UK, or another region with its own privacy rules, sending a statement through OCR or an email through checkout means that data is processed by the services named above, which may be outside your country.