Privacy policy

Draft of 27 October 2026

Draft — to be reviewed before launch. Written from Rowsmith’s code on 27 October 2026. It isn’t legal advice: a qualified lawyer reviews it before the first sale. The highlighted blanks and notes are for the owner.

Effective date: [Effective date]

This policy covers the Rowsmith web app and website at https://rowsmith.app, and buying Rowsmith Pro.

The short version

• Your statements never leave your device. Rowsmith reads them in your browser, and its security policy stops its code from sending data with fetch, XHR, web sockets or beacons.
• Rowsmith has no account, no ads, no analytics and no third-party code.
• We only receive personal information if you buy Rowsmith Pro (your name, email address and order number) or if you write to us.
• We do not sell or share your personal information.

Who we are

Vardan Verma, trading as Rowsmith, India, is responsible for the personal information described here (the “controller”).

• Contact: support@rowsmith.app
• EU representative (if required): [EU representative]
• UK representative (if required): [UK representative]

What stays on your device

Your statements

• The PDFs you open, the rows Rowsmith finds, your edits and the files you export stay on your device. Rowsmith reads each PDF inside your browser, in a separate worker that can’t open connections.
• Statements are held in the tab’s memory only. Closing or reloading the tab discards them. Nothing about them is saved to storage.
• Exports (CSV, OFX, QBO) are saved where you choose.
• Passwords for encrypted PDFs are used in memory to open the file, and never stored.
• When you check a year of statements, Rowsmith works out each PDF’s SHA-256 (a fingerprint of its exact bytes) in your browser, and reads what the PDF says about itself: the program that made it, its created and modified dates, whether it was saved again, and whether it carries a digital signature. A reason you give for marking a finding “not a problem”, and the day you gave it, are kept in the tab’s memory with the check. All of it is discarded with the tab.

The year pack

“Download the year pack” makes one ZIP file on your device and saves it where you choose. Nothing is uploaded, and Rowsmith keeps no copy. It holds:

• the statements’ file names, each PDF’s SHA-256, its period, balances and page count, and what the PDF says about itself (its producer and creator, its created and modified dates, and whether it was saved again or signed);
• every row of the year (date, description, amount and balance), with the file and page it came from;
• what was changed by hand (balances typed, rows changed, added or deleted, signs flipped), with what the PDF printed before the change: a row you renamed keeps its original description in the pack, and a row you deleted is listed with its date, description and amount. Balances worked out or taken from other months are marked too;
• each finding, any reason you gave for marking one “not a problem”, and the day you gave it.

So removing or renaming a row before you download a pack doesn’t take it out of the pack: the pack records what the PDF said. A year pack carries your clients’ financial data. Share it as you would the statements themselves.

“Check a pack you received” reads a pack’s ZIP or manifest.csv in your browser, matches the PDFs you add by their SHA-256, checks the year again from those PDFs, and sends nothing anywhere. Any “not a problem” reasons in the pack are shown as the sender’s, in that tab only.

“Copy the request” puts only the drafted email to your client on your clipboard, and only when you click it: a subject line, the bank, the last four digits of the account number (never the whole number, even where a statement prints it in the account’s name), the missing dates, and the closing balance of the statement before each gap, so your client can find the right one. “Open in email” hands the same text to your email program as a new message. Rowsmith sends nothing: you paste it, or send the new message, yourself. On some devices the clipboard is shared with your other devices (for example Apple’s Universal Clipboard).

If you’re a bookkeeper or accountant converting clients’ statements, those statements stay on your own device too. We never receive or process them, so there’s nothing for us to process on your behalf.

What Rowsmith stores in your browser

What “nothing leaves your device” means exactly

• The page’s own content security policy, set in the page itself, stops its code from opening connections (connect-src 'none': fetch, XHR, web sockets, server-sent events and beacons), and the worker that reads your PDFs is served with the same rule. The page still loads its own scripts, styles, font and images from Rowsmith’s own address, and links you click open other pages; none of them carries your data. The policy our host sends with Rowsmith’s files allows connections to Rowsmith’s own address, and no other, only so the service worker can update its offline copy of the app.
• The only network traffic is your browser downloading Rowsmith’s own files from our host, and the service worker refreshing that copy.

These are the only times information leaves your device, and each one is started by you:

1. Opening Rowsmith. Your browser downloads its files from our host, like any website. The host sees your IP address, your browser’s details and the file requested. It never sees your statements.
2. Buying Rowsmith Pro. You pay on our payment partner’s checkout page, and we email you a licence key.
3. Writing to us. We receive what you send.
4. Sharing a layout. If a statement doesn’t convert, “Share the layout” saves a file to your device. Nothing is sent: you choose whether to email it to us. The file keeps the page layout (where each line and column sits), column titles and common statement words. Other words are replaced with placeholder letters, every number gets random digits, and all dates move by the same random number of days. The random values aren’t saved, so the original can’t be recovered. Word lengths and the layout itself remain, which may hint at which bank issued the statement.
5. Files you export, and year packs. They go wherever you save them.

What we receive

If you buy Rowsmith Pro

[Not live yet. Confirm when licensing is switched on, since the licence service for Rowsmith isn’t deployed.]

Lemon Squeezy sells Rowsmith Pro for us as the “merchant of record”. It runs the checkout and collects what it needs to take payment, charge the right tax and prevent fraud: typically your name, email address, billing country and address, payment details and IP address. It acts as an independent controller for that data, under its own privacy policy. We never see your full card details.

When your payment succeeds, our licence service receives your order number, payment status, email address and name. It:

1. creates your licence key, which contains your email address, your name, the date it was issued, its end date (or that it’s lifetime) and a random licence number, signed so Rowsmith can check it offline;
2. emails the key to you through [Email provider];
3. records the order number, your email address and the time it was sent, so a repeated notice never sends a second email and so we can resend your key.

If you write to us

We receive your email address, your name if you give it, your message and any attachments, such as a shared layout file. We use them only to answer you, and to improve Rowsmith’s reading of that layout if you sent one. Our mailbox is Cloudflare Email Routing, which forwards each message to Google (Gmail), where it’s kept.

Product news, only if you sign up

[Not built yet. Remove this section until a sign-up form exists.] If you ask for product news, we keep your email address and the time you confirmed it (double opt-in). Every email has a one-click unsubscribe link.

Our website and hosting

Cloudflare (Cloudflare Pages) serves Rowsmith. To deliver the files and protect the site from abuse, it processes your IP address, your browser’s details and the pages requested, and may keep them in its logs for as long as its own privacy policy allows; Cloudflare publishes no fixed period for these logs. We add no logging of our own. Cloudflare’s dashboard shows us totals of requests and visits from those logs; it adds nothing to the page and sets no cookies.

[Include this paragraph only once Footfall runs on the website.] We count visits to the website (never inside the converter) with Footfall, our own analytics, which runs on our server. It sets no cookies and stores nothing on your device. It records the page you visited (without anything after ?, except campaign tags such as utm_source), the referring website’s address, your country, broad browser, system and device labels, and a daily visitor code made from a random daily key that is deleted after two days. Your IP address and browser details are used in memory and never written to disk. The script reads one setting from your browser’s storage, footfall_ignore, which we use to leave out our own visits. It never writes anything.

Why we use it, and our legal basis

We don’t make automated decisions about you, and we don’t profile you.

How long we keep it

Who receives it

We don’t give personal information to advertisers or data brokers. We may disclose it if the law requires it, or to protect our rights in a dispute.

International transfers

Some of these providers are outside the UK and the European Economic Area. Where they are, we rely on [the EU-US Data Privacy Framework for certified providers / standard contractual clauses / the UK International Data Transfer Addendum]. [Confirm for each provider.] Ask us for a copy.

Your rights

Your statements are never with us, so you control them entirely.

For the information we do hold, email support@rowsmith.app. We’ll answer within one month (45 days in California), and may ask you to confirm you control the email address concerned.

In the EU and UK (GDPR and UK GDPR), you can ask for access, correction, deletion, restriction and portability, object to uses based on legitimate interests, and withdraw consent at any time. You can complain to your data protection authority, or to ours, [Supervisory authority]. In the UK that’s the Information Commissioner’s Office (ico.org.uk).

In California (CCPA as amended by the CPRA), and other US states with similar laws:

• In the last 12 months we collected, only from buyers and people who wrote to us: identifiers (name, email address, order number), commercial information (that you bought Rowsmith Pro) and internet activity (hosting logs and anonymous visit statistics). The sources are you and our payment partner. We disclosed them for business purposes only, to the providers above.
• We do not sell or share personal information, as the CCPA defines those words, including for cross-context behavioural advertising. We don’t use sensitive personal information to infer anything about you, and we don’t sell or share the information of anyone under 16.
• You can ask to know, delete or correct your information, through an authorised agent if you like, and you won’t be treated differently for asking. We honour Global Privacy Control signals.
• We may be below the thresholds at which the CCPA applies. We follow it anyway.

Cookies and storage on your device

Rowsmith sets no cookies. It uses your browser’s storage only for what’s listed under “What Rowsmith stores in your browser”: your preferences, your licence key if you add one, and an offline copy of the app. Each is strictly necessary for something you asked Rowsmith to do, so the EU ePrivacy rules and the UK’s PECR don’t require consent, and there’s no cookie banner. We don’t use advertising, tracking or analytics cookies.

Children

Rowsmith is a tool for adults managing financial records. It isn’t meant for children under 13, and we don’t knowingly collect their personal information (in the US, COPPA). In the EU and UK, people under 16 (or the lower age set by their country) should ask a parent or guardian before buying or writing to us. If we learn we hold a child’s information without that consent, we’ll delete it.

How we protect it

• The network lock: the page and its PDF worker run under policies that stop their code from opening connections with fetch, XHR, web sockets or beacons (the host’s policy allows Rowsmith’s own address, and no other, only for the service worker’s updates), and our tests check that the app’s code contains no network calls.
• Hostile files: PDFs are read in a separate worker that’s stopped after 60 seconds, with limits on file size, decompressed data, nesting and rows.
• No HTML injection: text from PDFs is only ever shown as plain text, under Trusted Types; spreadsheet exports guard against formulas.
• No third-party code. Rowsmith’s PDF engine is our own.
• Licence keys are signed with a private key kept offline on our own machine.
• Reviews: an independent security review in October 2026; every finding was fixed with a regression test.

We don’t hold any security certification. No system is perfectly secure. If we learn of a breach affecting your personal information, we’ll tell you and the authorities as the law requires.

Changes to this policy

When Rowsmith’s handling of personal information changes, we update this policy at the same time and change the effective date. If a change matters, we’ll say so on the website. Earlier versions are available on request.

Contact

Name: Vardan Verma, trading as Rowsmith
Country: India
Email: support@rowsmith.app