Privacy policy
This policy explains what happens to data when you use TieOut (www.tieout.in), a bank statement converter that turns statement PDFs into Excel, CSV and Tally XML.
The short version
Your bank statement never leaves your device. TieOut has no backend that receives files. The PDF you drop in is read by JavaScript running inside your own browser tab, converted there, and the result is written straight to your downloads folder. We never receive the file, so we cannot store it, read it, share it or lose it.
You do not have to take our word for it. Disconnect from the internet, then convert a statement — it still works, because there is no server involved. Or open your browser's DevTools → Network tab while converting and confirm that no request carries your file.
What we do not collect
- Your statements. No upload, no copy, no retention.
- PDF passwords. If your statement is password-protected, decryption happens locally in your browser. The password is not transmitted and is not stored.
- Accounts. There is no sign-up, no login and no email collection to use the converter.
- Session recording and fingerprinting. There are no session-replay tools, fingerprinting libraries or data brokers here, and we build no profile of you ourselves. Two third-party Google scripts do load — Analytics, which counts page visits, and AdSense, which serves the ads that pay for the site. Both are described below, including what they can and cannot see.
What is processed in your browser
Statement contents — dates, narrations, amounts, balances, account details — are held in your browser's memory only for as long as the tab is doing the conversion. Closing or reloading the tab discards them. Nothing is written to local storage or a database, and the exported Excel, CSV or XML file is created on your machine and saved by your browser.
What our host necessarily sees
Serving a web page requires a request. Like any website, our hosting provider processes standard technical request data — IP address, browser user-agent, the URL requested, the timestamp and referring page — in server logs used for security and to keep the site running. These logs are about page requests, not about statement contents; the statement is never part of a request. We do not use this data to build profiles, and we do not combine it with anything else.
Analytics
We use Google Analytics to see how many people visit, which pages they read and which search or link sent them. It sets two first-party cookies (_ga and _ga_…) so that a returning browser is not counted as a new one, and it records the page viewed, the referring site, device and browser type, and an approximate location derived from your IP address — country and city, never a street address. Google processes this as our analytics provider; IP addresses are not exposed in our reports, and the data is not used for advertising personalisation.
Analytics never sees your statement. The conversion runs entirely in your browser and emits no analytics event of any kind — not the file name, not the bank, not the page count, not a single amount. It measures pages, not conversions. Any content blocker or privacy browser that blocks the script stops this collection, and the converter keeps working exactly as before, because the two have nothing to do with each other.
Advertising
This site carries ads served by Google AdSense, and that is how a free converter with no account and no upload gets paid for. Google's ad script runs in your browser, reads and writes cookies or similar identifiers, and uses them together with your IP address, device and browser type and the page you are on to choose which ads to show and to measure whether they were seen or clicked. Depending on your Google account and your location, that can include ads personalised from your activity on other sites. Google sets the rules for this as an advertising business in its own right, not merely on our instructions: what it collects is described in its advertising policy, and you can review or switch off personalisation at My Ad Centre.
The ads are told nothing about your conversion. We pass the ad script no data at all, and converting a statement fires no ad or analytics event of any kind — not the file name, not the bank, not the page count, not a single amount. Your statement is still never uploaded to us or to anyone else.
One caveat we would rather state than bury: the ad script is JavaScript loaded into the same page as the converter, and the converted rows are drawn on that page for you to check. Any script on any page is in principle capable of reading what is on screen. Google does not do this and its ad code is not built to, but the honest description of the boundary is "we send it nothing", not "it could not possibly see anything". If that residual risk matters for the client data you handle, a content blocker or a browser with tracking protection removes the ad script entirely and the converter keeps working exactly as before — the two have nothing to do with each other.
If you send us a statement
We ask people to send sample statements when a bank isn't supported or converts badly. That is entirely voluntary and separate from using the tool. If you email us a file, we use it only to fix or extend the parser, we ask you to redact or use a sample rather than live client data, and we delete it once the fix ships. If you would like it deleted sooner, ask and we will.
Third parties
We do not sell or rent personal data, and there are no data brokers or marketing automation tools connected to this site. Three third parties are in the chain: the hosting provider that serves the pages, Google Analytics, and Google AdSense. The host and Analytics act on our instructions as our processors; AdSense is different, because Google determines for its own advertising purposes what it collects there, which is why the section above points you at Google's policies and controls rather than ours. None of the three ever receives a statement.
Your rights
Indian data protection law (the Digital Personal Data Protection Act, 2023) gives you rights of access, correction, erasure and grievance redressal over personal data a service holds about you. In practice we hold almost nothing: no account, no statement data and no profile of our own. If you have emailed us, you can ask what we still hold and have it deleted by writing to support@tieout.in. We aim to respond within 30 days.
Children
TieOut is a tool for accounting and bookkeeping work and is not directed at children. We do not knowingly collect personal data from anyone under 18.
Changes to this policy
If the product changes in a way that affects this policy — for example if an optional server-side feature is ever added — we will update this page and change the date at the top before that feature ships. The no-upload guarantee applies to the converter as described here; any future feature that works differently will say so plainly and be opt-in.
Contact
Questions about this policy, or about data we may hold: support@tieout.in.