--- title: "Privacy Policy — Crossfooted" description: "How Crossfooted collects, uses, stores and protects your information and bank statements, and the choices you have." url: "https://crossfooted.com/privacy" --- Legal # Privacy Policy Last updated: October 15, 2026 This Privacy Policy explains how Crossfooted (“Crossfooted”, “we”, “us” or “our”) collects, uses and protects your information when you use crossfooted.com and its services (the “Service”). ## 1\. Information we collect - **Account information:** your name, email address and password. Passwords are stored only as a secure hash, never in readable form. - **Statements and results:** the PDF statements you upload, the transactions we extract from them, and any edits you make. - **Billing information:** if you subscribe or buy a page pack, our payment provider Polar processes your payment. We receive your plan, subscription status, billing dates, the price of your next renewal, order references and a customer reference. We never see or store your card details. - **Usage information:** for each conversion, the file name, page count, status and time; the bank’s name, the account’s last four digits and the statement period, read off the statement so History can name your batches; any name you give a batch; and the pages you’ve used each month. Never the transactions themselves. - **Technical information:** your IP address and browser type, used to keep your account secure. - **Communications:** messages you send us, for example by email. ## 2\. How we use your information We use your information to: - Provide the Service: convert your statements, check them against their balances, and let you review, edit and download the results. - Run your account, plan and monthly page allowance. - Send service emails, such as confirming your email address, resetting your password, a reminder before your plan renews or before your pack pages expire, and important changes to your account or these policies. We don’t send marketing emails. - Keep the Service secure and prevent fraud and abuse. - Answer your questions and support requests. - Meet our legal obligations. We do not sell your personal information. We do not use your statements for advertising or credit scoring, or to train AI models. ## 3\. How your statements are processed Nothing is uploaded until you press Convert. Your file is then sent over an encrypted connection (TLS) and stored encrypted with AES-256-GCM, on top of our storage provider’s own encryption. Each statement and its results can be opened only from your account. To extract the transactions, your PDF is sent to an AI model provider. We only use AI providers with a zero data retention policy: they process your statement to complete the request, and don’t store it or use it to train their models. Our own code then checks the extracted transactions against the balances on the statement. ## 4\. Cookies and local storage We use one essential cookie to keep you signed in. Your browser’s local storage holds a few preferences, such as whether the PDF panel is shown, and lets an unfinished conversion resume. We don’t use advertising or analytics cookies, or third-party trackers. A few of our guides include a video hosted on YouTube. It loads only if you press play, from YouTube’s no-cookie address, and from then on YouTube’s own privacy policy applies to that video. ## 5\. How we share information We share information only with service providers that help us run the Service, and only what each one needs to do its job: - **Hosting, database and file storage** - **AI model providers**, with zero data retention (see section 3) - **Email delivery**, for account emails - **Payments:** Polar (Polar Software, Inc.), our merchant of record, which handles payments, tax and receipts A list of our service providers is available on request. We may also disclose information if the law requires it, or to protect the rights and safety of our users or the Service. If Crossfooted is ever sold or transferred, your information may move with it, and we’ll tell you before that happens. ## 6\. How long we keep information - **Statements and results:** deleted automatically 24 hours (Free) or 30 days (paid plans) after the conversion finishes. If a conversion fails, the PDF is deleted within 24 hours. You can delete them sooner at any time. As a safety net, any stored file older than 31 days is removed. - **Account information:** kept until you delete your account. - **Conversion history** (each statement’s file name, page count, status, time, bank name, last four digits and period, and batch names): kept until you delete the statement or remove it from History, or delete your account. Deleting a statement removes its line in History too; the count of pages you’ve used stays, because your plan’s limit depends on it. - **Sign-in sessions:** deleted once they expire, 7 days after you last used them. - **Abuse-protection records** (an IP or email address with a count): deleted within about an hour. - **Billing records:** Polar keeps these for as long as tax and accounting law requires, even after you delete your account. - **Messages you send us:** kept as long as needed to help you. - **Recovery history:** our database keeps a rolling 30-day history so it can be restored after a failure. Records you delete, including conversion results and account details, leave it after 30 days. Nobody uses it except to recover the service. Uploaded PDFs aren’t in it. ## 7\. Security We protect your information with encryption in transit and at rest, hashed passwords, access limited to your own account, and limits on repeated attempts. No service can promise perfect security, and the Service isn’t end-to-end encrypted, because it has to read your PDF to convert it. If we learn of a breach that affects your information, we’ll tell you promptly. ## 8\. Your rights and choices Depending on where you live, for example in the EU, UK or California, you may have the right to access, correct, delete or export your personal information, and to object to or restrict how we use it. - Delete any statement or result from the result page or History, and remove any line from History. - Delete your account and everything in it from Account → Plan & billing → Delete account. - For anything else, email [hello@crossfooted.com](mailto:hello@crossfooted.com). We’ll reply within 30 days. If you’re in the EU or UK, we process your information to provide the Service you signed up for (contract), to keep it secure (legitimate interests) and to meet legal obligations. You can also complain to your local data protection authority. ## 9\. International processing Our service providers may process your information in the United States and other countries, which may have different data protection laws from yours. ## 10\. Children The Service isn’t meant for children under 16, and we don’t knowingly collect their information. If you believe a child has given us information, email us and we’ll delete it. ## 11\. Changes to this policy We may update this policy from time to time. We’ll change the date at the top, and if the changes are significant, we’ll email you before they take effect. ## 12\. Contact Questions about this policy or your information: email [hello@crossfooted.com](mailto:hello@crossfooted.com). [← Back to home](https://crossfooted.com/)