Is it safe to upload your bank statement to a spending app?

Before you upload a bank statement anywhere, ask what happens to it after you click the button. A statement shows where you shop, what you pay for, who you send money to and often where you live. Here’s what’s in the file, what you can take out yourself first, and what to check in any app, ours included.

What a statement gives away

Open a statement and you will usually find more than spending:

• Your name and address, in the header of a PDF or on the account page.
• Account and card numbers, often partly shown and sometimes in full.
• UPI or payment IDs such as name@bank, which identify you and the person you paid.
• The names of people you paid, from rent to a friend who split a bill.
• Phone numbers, emails and reference numbers inside the transaction descriptions.
• Your employer, from salary credits.

You don’t need any of that to see where your money went. The merchants and the amounts are enough.

Remove what you can before you upload

The less personal detail in the file, the better. This takes a few minutes.

1. Use CSV if your bank offers it. A CSV has rows of dates, descriptions and amounts and usually no header with your address. Open it in a spreadsheet and delete any columns you do not need, such as account number or customer ID.
2. If you only have a PDF, black out the personal parts. Use a PDF editor or your computer’s markup tool to cover your name, address, account and card numbers, and any IDs. Keep the rows and amounts visible.
3. Keep the months you need, not your whole history. One to six full months shows clear patterns. There is no reason to share years of records.
4. Remember the password. Many emailed PDFs are locked. You can unlock your own file before you upload it, or type the password when an app asks for it.

If you’d rather not do it by hand, you can ask an AI you already trust to clean the file first. There’s a link for that on our homepage.

What we do with your file

Here’s exactly what happens to it:

• Your file is sent to our server, where the text is read out and account numbers, card numbers and contact details are removed. This happens in memory, and the file is not kept.
• The cleaned lines are sent to Google Gemini, which turns them into a tidy list of transactions. Account and card numbers are removed before this step. Names stay, because the report needs them to tell a payment to a friend from a payment to a shop.
• A summary of totals and top places is sent to xAI Grok, which writes the wording of the report. It does not receive your raw file.
• Your report is kept for 48 hours, then deleted. There is no account, so there is nothing to log into and nothing kept after that.

Cleaning is done by pattern matching, and it is not perfect. It removes account and card numbers, bank codes, phone numbers, emails and UPI IDs made from a phone number. It keeps the names of people and businesses, so they appear in your report. If there are names you don’t want us to see, type them in the box before you continue and we hide them, or remove them from the file before you upload.

A checklist for any app, including ours

• Does it ask for your bank login or net banking password? You should not need to. Never share a password or a one-time code with anyone.
• Does it say what it sends, and to whom? Look for named AI or cloud providers in the privacy policy, not just “trusted partners”.
• How long is your data kept? The answer should be a number of hours or days, not “as long as needed”.
• Can you use it without an account? If it needs an account just to show a report, ask why.
• Does it promise perfect removal? No automatic tool removes everything. Be wary of anyone who says otherwise.
• Who runs it? There should be a real company, a contact address and terms you can read before you pay.

The short answer

It’s reasonable to upload a statement when the app tells you plainly what it keeps and for how long, and you’ve taken out what you don’t need to share. Black out the personal bits, spend two minutes on the privacy policy, and never give anyone a password or a one-time code.

Upload a statement

This guide is general information, not financial or legal advice. Read our privacy policy for the full detail.