Privacy

Last updated: 15 October 2026

Your PDF never leaves your browser

This is not a promise about how we handle your file after receiving it. We never receive it.

LedgerDrop is a static website: HTML, CSS and JavaScript files served from a CDN, with no application server and no database behind them. When you drop a statement on the converter page, the file is read by JavaScript running in your own browser tab, using the browser's File API. The text is pulled out with pdf.js, which also runs in your tab. The CSV you download is assembled in memory and handed to your browser as a local blob: download. At no point is there any code on the page that sends the file, its text, or anything derived from it anywhere.

The paid version does not change that. Buying LedgerDrop Pro adds a payment and a licence key, and neither of them touches your statement — the detail is under Paying for the paid version below. There is still no route by which a statement could be sent anywhere, and the browser is still made to enforce it.

How to check this yourself

Open the converter.
Open your browser's developer tools and go to the Network tab.
Convert a statement.
No request appears carrying your file, its text, or anything worked out from it. The only requests are the page itself and the Google Analytics events listed below. Nothing to do with payment is loaded unless you press a buy button.

Convert one file, then disconnect and convert another — it works, because after that first request there is nothing left that needs the network. (The first conversion fetches the PDF library's background worker from this site; it is not loaded until you convert, so a browser that has never converted anything still needs the network for that one request.) A paid key is checked in your browser too, so being offline does not lock a buyer out of the tool they paid for.

What the page loads

Everything the converter itself needs is served from this site, including the PDF-reading library — so reading your statement involves no other party at all. There are no fonts from another domain, no other trackers, and no advertising.

What	From	Why
Page, styles, converter code	this site	To show the page
pdf.js library and its worker	this site (`/assets/vendor/`)	To read the text layer of the PDF
Google Analytics	googletagmanager.com, google-analytics.com	The ten counters described below, and nothing else.
Paddle's checkout	paddle.com	Only after you press a buy button. Nothing from Paddle is loaded otherwise.
The licence service	license.tekiba.app	Only if you have bought: to fetch your key after a purchase, and to check about once a month that it has not been refunded.
The licence service, test builds only	tekiba-license-sandbox.metluno.workers.dev	The same two requests, against a sandbox copy used to rehearse a purchase without a real payment. This page never contacts it. The address is chosen by hostname, and only a test deployment picks the sandbox one.

What is recorded

LedgerDrop counts ten things, so that we know whether the converter actually works on real banks, whether people get from the guides to the converter, whether the test statements are wanted, and whether buying it works at all. All nine are anonymous and none contains anything out of your statement.

Event	The complete contents
`convert_result`	`status` — one of `ok`, `mismatch`, `unknown`, `no_table`, `scanned`, `too_many_pages`, `not_pdf`, `error` `pages` — how many pages the file had `rows` — how many transactions came out `batch_size` — how many files were dropped together, as a band: `1`, `2-5`, `6-10` or `11+` (one per file, so a batch of three sends three, each saying `2-5`)
`feedback`	`vote` — `up` or `down`, only if you press one of the two buttons
`upgrade_click`	`where` — which buy button was pressed: `limit`, `batch`, `preset`, `report`, `pricing` or `header`
`license_activated`	`source` — `claim` (the key arrived with the purchase) or `manual` (you pasted one in)
`export`	`product` — always `ledgerdrop` `format` — which kind of file was saved: `csv`, `qbo`, `ofx2`, `ofx1`, `qif` or `report` (the reconciliation report). Not the file's name and nothing in it
`paywall_view`	`product` — always `ledgerdrop_pro`, sent once when the “this one is LedgerDrop Pro” box appears `reason` — `pages` (the file is longer than the free version writes a CSV for) or `files` (more than one file was dropped). One of those two words: not the number of pages or files
`pricing_view`	`product` — always `ledgerdrop_pro`, sent when /pricing/ is opened
`guide_to_tool`	`from` — the address of the guide you were reading, as in `should-debits-be-negative-in-bank-csv` `to` — `convert` or `convert_pro`, which part of the converter the link went to (only on the guides, only when you follow a link to the converter)
`pack_interest`	`product` — always `statements_pack`, sent when you press “Request the full pack” on /datasets/. Your mail program then opens; what you write in it goes to us by email, not through this counter
`dataset_sample`	`dataset` — which free sample CSV you downloaded from /datasets/: `sections-no-year-medium`, `multi-currency-trailing-minus-medium` or `decimal-comma-brackets-short` (anything else is sent as `other`). These are fictional test statements; nothing of yours is in them or in the count

That is the entire list. Specifically, none of the following is read for analytics, sent, or stored: the file name, the bank, account numbers, account holder names, dates, amounts, descriptions, balances, or any other text from the document. Nor is your licence key or your transaction ID — license_activated carries one word, and that word is not the key.

A script this site does not use

Cloudflare, which serves this site, adds its own analytics beacon (static.cloudflareinsights.com) to pages it hosts. This site's Content Security Policy does not allow it, so your browser refuses to load it and it collects nothing. If you look at the developer console you will see it being blocked — that is the policy doing its job, and it is the same policy that stops this page sending your statement anywhere.

The code that sends these is one short file — /assets/analytics.js — and it accepts nothing but the fields above. You can read it in a minute.

Google Analytics

Google Analytics 4 is loaded on this site and receives the ten events above along with the standard information any web request carries: your IP address (which we ask Google to truncate), your browser and operating system, the page address, and the referring page. Google's handling of that is covered by Google's privacy policy. If you would rather not be counted at all, any content blocker or the browser's own tracking protection will stop it, and the converter works exactly the same with it blocked.

One exception is worth spelling out. After a purchase, Paddle sends you back to a page whose address carries your transaction ID, and that ID can be exchanged for your licence key. Google Analytics would ordinarily put the whole page address into its first event. So analytics refuses to start at all while a transaction ID is in the address bar, the ID is removed from the address before anything else runs, and that page is served with Referrer-Policy: no-referrer so the ID cannot travel to the next page either. The cost is one uncounted page view. The alternative was handing Google a working credential.

What that does not do, and we would rather say so than imply otherwise: the very first request for that page is made by your browser before any of our code runs, so the address — transaction ID and all — reaches the service that hosts this site in the ordinary way any web address does. We do not run a server and do not keep request logs of our own, but we cannot make a claim about our host's. The ID is in your receipt email and is treated as a secret here; it is not something we are able to promise has never been written down anywhere. Nothing else on this site ever puts it in an address.

Paying for the paid version

Payment is handled by Paddle, who are the merchant of record. Your card details go to Paddle and never to this site — LedgerDrop has no server to receive them and no form that could send them. Paddle is the data controller for what you give them: name, email address, billing country, card details and tax status. What they do with it is covered by Paddle's privacy policy. We can see that a purchase happened and its transaction ID; we never see a card number.

There is no account. You are not asked for an email address by us, there is no password, and nothing is stored about you on any server of ours — because we do not run one. What a purchase produces is a signed licence key, saved in this browser's local storage, and that is the whole of it.

What the licence service is sent, and when

When	What is sent	To
Straight after a purchase, and again every couple of seconds until the key arrives or a minute passes	Your Paddle transaction ID (`txn_…`)	`license.tekiba.app/claim`
If you paste a transaction ID in to get a lost key back	The same	The same
At most once a month, and only if you have a key	Your licence key	`license.tekiba.app/verify`, to find out whether it has been refunded
Once more, straight away, if the licence service tells us the purchase this tab is looking at was refunded	Your licence key	The same. This is the one exception to "once a month", and it exists so that a refunded key stops working now rather than in up to thirty days — and so that a key from a different purchase is not thrown away by mistake

Test builds of this site talk to a sandbox copy of the licence service instead, at tekiba-license-sandbox.metluno.workers.dev. It exists so that buying, refunding and losing a key can be rehearsed with Paddle's test cards rather than a real one. Which of the two is used is decided by the hostname you are on, in one place in /assets/config.js: this site uses the live service, and a deployment preview uses the sandbox. Both are named in the policy because a policy is attached to a response, not to a hostname.

That is every request the paid version can make. Nothing in the code that talks to the licence service can reach the converter, and nothing in the converter can reach your key: what passes between them is a single yes-or-no, in one direction. Checking a key does not use the network at all — the key carries its own signature and the page checks it offline, which is why an unlocked copy keeps working on a plane and keeps working if our licence service is down.

The licence service keeps, per purchase, the transaction ID, the issued key and the date — no name, no email address, no card details, and nothing about what you converted. It is a Cloudflare Worker with a key-value store and no other database.

Cookies and local storage

LedgerDrop sets no cookies. It stores four things in this browser, all of them in local storage, all of them readable and deletable by you, and none of them ever sent anywhere:

What	When	What is in it
Your licence key	If you buy, or paste a key in	The key. Removable from the button on the converter page.
The date the key was last checked	With the above	A timestamp, so the key is not sent more often than once a month (see the exception above).
Saved column mappings	Only if you save one (paid)	The name you typed, the printed headings of the statement's columns, where those columns sit across the page, and which is the date, the amount and so on. No transaction, no amount, no balance, no date, no account number and no file name. An export is a JSON file you save yourself.
How you like the CSV spelled	Once you change the separator or the byte order mark	The separator (comma, semicolon or tab) and whether to add the byte order mark. Nothing from any statement.

While a purchase is being confirmed, the transaction ID is also held in session storage, so that closing the tab by accident does not lose it. Session storage is gone when the tab closes; local storage is not used for it, deliberately, so that a shared computer is not left holding it. “Remove the key from this browser” removes that too — the transaction ID can be exchanged for the key, so removing your access has to remove the means of getting it back.

Google Analytics sets its own cookies.

Who runs this

LedgerDrop is operated by Tekiba, an independent software project. We do not sell data, because we do not have any to sell. Questions about this page can be sent to [email protected].

Changes

If this page changes in a way that affects what leaves your browser, the date at the top changes and the change is described here.

15 October 2026. A counter was added, pricing_view (the pricing page was opened), and paywall_view now says which of the two free limits brought the LedgerDrop Pro box up, as pages or files. Fixed words only; with this the list has ten. No destination was added, and nothing about what happens to a statement changed: connect-src still does not name this site.

13 October 2026. A counter was added, dataset_sample: which of the three free sample CSVs on /datasets/ was downloaded, as the sample's fixed name. The earlier wording on this page said “seven” counters when the list already had eight; with this one it has nine. No destination was added, and nothing about what happens to a statement changed: connect-src still does not name this site.

8 October 2026. convert_result also carries batch_size, how many files were dropped together as one of four bands (1, 2-5, 6-10, 11+), and a counter was added, pack_interest (somebody asked for the synthetic test-statement pack). Fixed words only. No destination was added, and nothing about what happens to a statement changed: connect-src still does not name this site.

2 October 2026. Three counters were added to the list above: export (which kind of file was saved), paywall_view (the LedgerDrop Pro box appeared) and guide_to_tool (a link from a guide to the converter was followed). Each carries fixed words only, from the lists above. No destination was added, and nothing about what happens to a statement changed: connect-src still does not name this site.

19 September 2026. A fourth destination was added to what the page may contact: a sandbox copy of the licence service, used by test builds so that a purchase can be checked end to end without real money. On this site the page never reaches it — the choice is made by hostname and only a test deployment picks it. Nothing about what happens to a statement changed: connect-src still does not name this site, and the new destination is unreachable from any code that can read a statement, exactly like the other three.

16 September 2026. LedgerDrop Pro went on sale. Three destinations were added to what the page may contact — Paddle's checkout, the licence service, and nothing else — and two counters were added to the list above. Nothing about what happens to a statement changed: connect-src still does not name this site, so the page still cannot send your statement back to us, and the three new destinations are unreachable from any code that can read one. As of the date above, nothing derived from your statement has ever been transmitted, because the code to do so does not exist in this site.