Cleanrow
Privacy policy
Last updated 4 October 2026.
This policy covers Cleanrow, the bank statement converter at whitehatharbor.com/statements/ ("the converter") and the Cleanrow extension for Chrome ("the extension"), built and supported by Michael Costa, trading as White Hat Harbor ("we"). In short: your statements are read and converted inside your browser and are never uploaded. We never see your files, their contents or their names. The only network service the converter talks to is Polar, and only to check a pass key you enter.
Your files
When you add a PDF or CSV, the converter reads it inside the browser tab, using code that ships with the page or the extension (including Mozilla's pdf.js for PDFs). Everything it works out (the transactions, the balance check, your edits, the files you download) stays in that tab's memory and is gone when you close or reload it. Downloads are made in the browser and saved by it, like any other download.
The converter sends no file, file name, row, description, amount, balance or account number anywhere: not to us, not to Polar, not to any analytics, error-reporting or advertising service. The page's Content-Security-Policy enforces this: it lets the converter connect only to its own site and to Polar's license check, so even a bug couldn't send your data elsewhere.
What is stored, and where
| Data | Where |
|---|---|
| A pass key you activate, whether it was valid and when it expires | Your browser's local storage for whitehatharbor.com, or the extension's local storage. Remove it with Forget this key. |
| Column mappings you choose to save: a name you give it, the CSV's header names and which column is which | The same local storage. No rows or values are saved. Delete them under Saved mappings on this device. |
| A fingerprint of the file you downloaded for free: a SHA-256 hash of its bytes, so the free download stays with that one file | The same local storage. A hash is a 64-character code that can't be turned back into the file; it holds no name, row or amount. Clearing this site's data (or removing the extension) clears it. |
Nothing else is stored, and none of it leaves your device except the pass key, as described next.
The pass and Polar
The 7-day pass is sold by Polar, the merchant of record. If you buy one, you give your email address and payment details to Polar on its own pages, under its own terms (Polar privacy policy). We receive your email address, what you bought and the payment status from Polar, to support you and handle refunds. We never see your card details.
When you activate a key, and each time you open the converter with a key saved, the converter sends the key to Polar's license-key check (api.polar.sh) together with our organization and product ids, and Polar answers whether it is valid and when it expires. Polar receives your IP address and browser details with that request, as with any web request. Nothing from your files is part of it.
The website
whitehatharbor.com is hosted by Cloudflare, which receives your IP address and browser details when you load a page. Other pages on the site count visits with Cloudflare Web Analytics, which sets no cookies; the security policy of the converter and its guides (every page under whitehatharbor.com/statements/) doesn't let that script load, so those pages aren't counted.
The extension
The extension asks for one permission, storage, for the pass key, saved mappings and free-download fingerprint above. It has no access to the websites you visit, reads no web pages, and runs nothing in the background: its toolbar button opens the converter in a tab of its own, where it works exactly as described here. Links to this site open in a normal tab.
What we don't do
- No uploads, no accounts, no bank logins.
- No analytics, tracking, advertising or telemetry in the converter or the extension.
- We don't sell, share or transfer data about you, except as needed for payments above.
Contact
Questions about privacy: contact us.
Changes
We'll update this page and its date if the converter's data handling changes.