What we do with your statements — and what we never do

Where your data lives

• Private storage, never public

  Uploaded statements go to private object storage with public access blocked. Nothing can read a file without a short-lived signed link that is tied to your account and expires in about a minute. Every link we issue is written to an audit trail.

• Checked before anything reads it

  Every upload is scanned for malware before the parser is allowed near it. If the scan cannot run, the file is not processed — the system fails closed, never open. Files that fail are removed without being opened, and the event is recorded.

• Your financial values stay out of our logs

  Amounts, merchant descriptors, and file contents are kept out of application logs, error reports, and analytics by design, with a redaction layer that strips sensitive values and a lint rule that keeps stray logging out of the codebase.

• Isolation between accounts

  Every record carries its owner, every request re-checks ownership, and a request for someone else’s data returns the same "not found" response as a record that never existed — so the API cannot be used to discover what exists. Cross-account access is covered by automated tests.

How the numbers work

The audit is deterministic: the same statement always produces the same result. No model decides what you are paying.

• Exact arithmetic, in whole cents

  Totals are integer-cent sums of the charges shown on the page. Nothing is rounded for effect, projected forward, or averaged into a friendlier number.

• Evidence on every charge

  Each recurring charge shows how many times it was seen, the dates it was seen between, and the basis for calling it recurring — so you can check our work against your own statement, line by line.

• Honest labels instead of confident guesses

  A charge we are confident about is labelled "Recurring". One we are not is labelled "Needs your review" and waits for you. If we identify a merchant wrongly, you can correct it, and your correction wins over our catalogue on every future re-run.

• AI cannot touch your figures

  The optional AI summary — switched off for now — never computes anything. It would receive only limited facts LowScout has already read or calculated (merchant names, amounts, cadence), never your uploaded documents, and every number it states is checked against LowScout’s figures before display. A response that fails that check is blocked and replaced with the plain facts rather than shown to you.

Your account and your controls

• Sign-in with a password, a verified email address or Google

  You verify your email address when you sign up, and you sign in with your password, a one-time code sent to that address, or your Google account. That is one check, not two-factor authentication — LowScout does not currently offer an authenticator app or any other second factor. A LowScout account can show someone a map of your recurring finances, so use a password you do not use anywhere else and protect the email or Google account you sign in with: two-step verification there protects your LowScout sign-in too. Your password, email addresses and connected accounts are managed in Settings → Account & security.

• Consent per capability, never bundled

  The privacy policy and terms are what you accept to use the product. Optional capabilities — AI summaries, cancellation tracking — ask separately, at the moment you first use them, and each can be withdrawn on its own with immediate effect. Withdrawing one never costs you your account or your audit.

• Delete a statement whenever you like

  Deleting a statement removes the stored file and takes its transactions out of your audit. The confirmation tells you exactly what will change before you do it.

• Delete everything yourself; export by email

  Settings → Delete account permanently deletes your files, everything computed from them, and your account — after re-confirming it is you. A copy of your data is still sent by a person: email support from your account address, and we reply within two business days.

What we deliberately do not collect

These are architectural rules in the codebase, not settings someone can quietly change for a growth experiment.

• No advertising pixels on signed-in pages

  No advertising or ad-network pixel runs on any page you see while signed in — from any network, for any purpose.

• No session recording on signed-in pages

  Session replay is disabled on every authenticated route. Financial screens are never recorded, and masking is not treated as an acceptable substitute for not recording them.

• A fixed, reviewed event list

  Inside your account, product analytics is limited to a documented list of events carrying low-cardinality counts and category codes. No amounts, no merchant names tied to a person, no file names, no free-form text. Adding an event means changing the documented list, not adding a line of code.

• How you found us

  We record how you first arrived: the campaign tags on the link you followed and the referring website’s domain, never its full address. It is kept with your account in our product analytics so we can tell which channels work.

Who else is involved

LowScout runs on a small number of infrastructure providers. None of them are advertising companies, and none receive your statements for their own purposes.

• Authentication

  Sign-in and email verification are handled by a specialist authentication provider. Your password is never stored by us.

• Storage and database

  Uploaded files live in private cloud object storage; your parsed transactions and audit live in a managed PostgreSQL database. Both are access-controlled to the application.

• Processing and hosting

  Statement processing runs on a dedicated background service separate from the website, so a slow or failed job never takes the product down.

• Error monitoring

  Crashes and errors are reported to a hosted monitoring service so they get fixed. Reports carry identifiers and error types — never your financial values or file contents.

• Product analytics

  A hosted product-analytics service records a fixed list of events — which screens get used, where people get stuck — so the product can be improved. It runs on our servers: on sign-in, sign-up and every page inside your account, no analytics script is loaded into your browser, so there is no session recording, no automatic click or form capture, and nothing watching the page you are on. You are identified to it only by a scrambled code derived from your account id, never your email, and it never receives amounts, merchant names, or anything from your statements.

• Website analytics (public pages only)

  Our public pages load no third-party website-analytics script. A short, fixed list of events — such as the pricing page being viewed — is sent from your browser to our own servers, and you can switch that off on the Privacy choices page. Until October 2026 a pseudonymous website-analytics script from HeyCatch ran on public pages; it has been removed. It never ran on sign-in, sign-up, onboarding or any page inside your account, and it never received your name, email, LowScout account identifiers, bank or account details, transactions, merchants, amounts, balances, Plaid data, or statement contents.

• Affiliate referrals (home and pricing pages only)

  Partners who recommend LowScout are credited through PromoteKit, which is used for affiliate referral attribution only — never for product analytics. Its script loads only on our home and pricing pages, only for a visit that arrives through a partner’s link, and never if your browser sends Global Privacy Control or you have turned it off on the Privacy choices page. It never runs on sign-in, sign-up, onboarding or any page inside your account. If you arrive through a partner’s link, it sends PromoteKit that link’s referral code and stores the referral identifier it gets back in a cookie. If you later subscribe in the same browser, the only thing we add to your Stripe checkout is that referral identifier, as checkout metadata. To attribute the referral, PromoteKit accesses the associated checkout record in our Stripe account, and that Stripe record may contain details collected during checkout, such as your email address. We never send PromoteKit your email, name, statements, transactions, merchants, balances or bank details, and the referral never changes your price or your plan.

• Bank connections (optional)

  If you choose to connect an account, Plaid establishes and maintains the connection. You authenticate in Plaid’s flow at your bank; LowScout receives transaction activity (dates, amounts, descriptions), the account name, type and last four digits, and the account’s balance figures — never your bank credentials or full account numbers. Balances are stored so your Connected accounts page can show them; they are the figures your bank last provided rather than a live reading, and the page says when they were last updated. The access credential is stored only in encrypted form on a separate background service, and disconnecting ends the connection at Plaid and deletes the imported transactions.

An honest gap list is worth more than a polished page that implies everything is finished.

• Self-serve data export. You can delete your account yourself from Settings; a copy of your data is still sent by a person on request today, within two business days.
• A published uptime status page. Incidents are communicated by email to anyone affected, and written up afterwards.
• Automatic alerts across all of your spending, beyond recurring money. Connected accounts already get automatic recurring-money alerts — new charges, price increases, possible endings; whole-spending intelligence across every category is not built. Uploaded statements update your picture when you upload them, not in the background.
• The AI summary. Built, but switched off until our provider’s data terms meet the no-retention, no-training bar.
• A formal third-party security audit or certification. We have not had one, and we will not imply otherwise.

• A wrong figure, or a cancellation wrongly shown as verified, is treated as the most serious kind of bug and stops other work the day it is reported.
• If something breaks in a way that affects your data or your access, we tell you what happened, what it means for you, and what we changed — even when the honest answer is "we do not know yet".
• If a security issue is confirmed, affected people are contacted directly. We do not wait for a fix to be finished before telling you that something happened.
• Good-faith security research is welcome: email us with what you found. We will not threaten anyone for reporting a problem. We do not run a formal bug-bounty program at this time.