Privacy & how to verify

Your statements are read inside your browser. We never upload, receive, see or store them. You don't have to take our word for it: this page shows you how to check it yourself in a few minutes.

The short version

Your statements never leave this device. PDF, CSV, OFX and QFX files you open are read by code running in your browser tab. They aren't sent to us or to anyone else.
The page is locked. Every Pennyrow page comes with a security policy that tells your browser to block the page from sending anything anywhere: no uploads, no background connections, not even to our own site.
Nothing to sign up for. Pennyrow is free. No accounts, no email sign-up, no payments.
No cookies, no analytics, no ads, and no code from other sites on any Pennyrow page. The one part we didn't write ourselves, Mozilla's open-source PDF reader (pdf.js), is served from our own site, unchanged.
On your device we save settings only (your rules, merchant confirmations, account labels and, if you type it, your own name for matching transfers to yourself), never your statements or transactions. You can delete them with one button.
Our host keeps ordinary web server logs, like every website: your IP address, browser type and which file was requested.

Who we are

Pennyrow is free bookkeeping software made by @minsoesantun and published by SoeSan Holdings LLC, a limited liability company in Indiana, USA. In this policy, “we” and “us” mean SoeSan Holdings LLC.

This page covers the Pennyrow pages under getpennyrow.com/books/. Other pages, such as the bank guides on getpennyrow.com and the tools on shiplog-min.vercel.app, are separate and work differently.

Pennyrow used to be at shiplog-min.vercel.app/books/. That address now forwards to getpennyrow.com/books/.

What we never receive

Pennyrow has no upload feature, no accounts and no database. Everything it does happens in your browser, so none of the following ever reaches us:

your statement files, or anything in them: transactions, balances, account numbers, names, addresses;
the categories, business/personal choices, rules and account labels you set;
the files you export (Excel, CSV, QuickBooks® Online CSV, QuickBooks Desktop .iif, OFX) or your saved settings file;
File history results for your PDFs;
PDF passwords. If a statement is password-protected, you type the password in Pennyrow; it's used only to open that file in this tab and is never stored.

Because we never have your statements, we can't sell, share, lose or recover them. We don't sell or share personal information of any kind.

What our host logs

Pennyrow's files are hosted by Vercel Inc. When your browser loads a page or file from getpennyrow.com, it sends an ordinary web request, and Vercel's servers see what every web server sees:

your IP address;
your browser type and version (the “user agent”);
the page or file requested, and when.

These are standard web server logs. Vercel keeps them under its own privacy policy, and our hosting dashboard can show us basic information about the requests our site received. We use it only to keep the site running. These requests are plain downloads of our own files: they carry nothing from your statements, because your statements never leave your browser.

What's stored on your device, and how to delete it

Saved settings

Pennyrow saves your settings in your browser's local storage on this device, under the key pennyrow.v1, so you don't have to set things up again next time:

rules you write (for example “description contains PRINTER INK → Business, Supplies”);
merchants you've confirmed: the merchant name, the category you picked and business or personal. For Zelle or Venmo payments the merchant name is usually a person's name (for example “ZELLE JORDAN LEE”);
account labels, account types and business/personal settings. A label can include a bank name and the last 4 digits of an account number;
your own name, if you type it on Catch-up so Pennyrow can spot Zelle or Venmo transfers to yourself;
transfers you un-matched or marked “Not a transfer”, saved as coded ids with no amounts or descriptions.

It never stores your statements, transactions or balances. We can't see or recover anything stored on your device.

Your statements, while you work

Files you open are held in this tab's memory only. Close or reload the tab and they're gone; open your files again to pick up where you left off (your saved settings are applied automatically).

Files you download

Exports and your settings file are made on your device and saved by your browser like any other download. They contain your financial details, so keep them somewhere safe.

How to delete

In Pennyrow: open Profile and tap Delete all local data twice (the second tap confirms). This removes the saved settings from this browser.
In your browser: use its setting for clearing website data (look for “site data” or “website data”) and remove getpennyrow.com. If you used Pennyrow at its old address, settings you saved there stay with shiplog-min.vercel.app, so remove that one too. Removing shiplog-min.vercel.app also clears data saved by the other tools there.
Private window: in a private or incognito window, everything is cleared when you close the window.

Check it yourself: the Network tab

Your browser can show every request a page makes. This works in Chrome, Edge, Firefox and Safari on a computer (phones don't have these tools; use the airplane-mode test below on a phone).

Open Pennyrow at getpennyrow.com/books/. In Safari, first turn on the Develop menu in Safari's Settings, under Advanced.
Open the developer tools: press F12 or Ctrl+Shift+I on Windows and Linux, or Cmd+Option+I on a Mac. Click the Network tab.
Turn on Preserve log (Chrome and Edge) or Persist Logs (Firefox, in the settings menu of the Network tab) so the list isn't cleared, then reload the page.
Look at the list. Every entry should come from getpennyrow.com and sit under /books/: the page itself, books.css, the app's own script files (such as app.js and engine.js) and the PDF reader, /books/vendor/pdf.min.mjs and /books/vendor/pdf.worker.min.mjs. That's pdf.js, Mozilla's open-source PDF reader, which we host ourselves, unchanged; it loads with the page, so PDFs can be read later with no further downloads. To see the site of each request, hover over its name, or right-click the column headers and turn on Domain. Click any entry: the request method is GET, which downloads a file and sends no data of yours.
Click the clear button (a circle with a line through it) to empty the list. Now add your statements, or try the sample statements.
Watch the list while Pennyrow reads them. Nothing new appears, for PDF, CSV, OFX and QFX files alike, however many files you add. (One exception: if your connection dropped while the page was loading, the first time you open a PDF the two pdf.js files load again. They're downloads to your browser; nothing is sent with them.)
Keep going: edit rows, confirm categories, open the year summary, export. The list stays the same. Exports are built on your device; if your browser lists them at all, they show as blob: entries, which are created inside your browser and never touch the network.
Optional: in Chrome or Edge, type -domain:getpennyrow.com in the Network tab's Filter box to show only requests to other sites. It should stay empty. Entries that start with chrome-extension:// or moz-extension:// come from a browser extension, not from Pennyrow.

You can also keep the Console tab open: if anything on the page ever tried to break the rules below, your browser would block it and print a Content Security Policy error there.

If you ever see a request to another site, a request that isn't GET, or a new request after you add files, please tell us: see contact.

Check it yourself: airplane mode

This one works on any device, including phones.

Open Pennyrow and let the page finish loading.
Switch on airplane mode, or turn off Wi-Fi and unplug any network cable.
Keep working: add more statements, edit rows, categorize, look at the year summary, export files. It all keeps working, because all of it happens on your device.

PDFs work offline too: the PDF reader (pdf.js) loads along with the rest of the page, so once the page has finished loading, PDF, CSV, OFX and QFX files can all be read with no connection.

Reloading while offline won't work. Pennyrow doesn't install itself for offline use, so the page itself has to load once while you're online. That's about loading the page, not about sending anything.

The lock: our Content Security Policy

Every Pennyrow page is sent with the header below. Your browser enforces it, not us: if any code on the page tried to send data somewhere, the browser would block it.

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'none'; connect-src 'none'; worker-src 'none'; form-action 'none'; base-uri 'none'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; manifest-src 'none'; media-src 'none'

Pennyrow pages also get these headers:

Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
Permissions-Policy: camera=(), microphone=(), geolocation=()

To see it yourself: in the Network tab, click the first entry (the page, books/), open Headers and find content-security-policy under Response Headers. Each page also repeats the policy in a <meta> tag you can read with View Source (without frame-ancestors, which browsers only accept as a header).

What it means, in plain words

connect-src 'none': Scripts on the page can't open any network connection: no fetch, no XMLHttpRequest, no WebSocket, no beacons. Not even to our own site. This is the rule that stops uploads.
default-src 'none': Anything not allowed by a rule below is blocked.
script-src 'self': Only script files served from getpennyrow.com can run. No inline scripts and no code from other sites. (pdf.js, the one part we didn't write, is served from our own site too.)
style-src 'self' 'unsafe-inline': Styles come from our own site; inline styles are allowed for layout. Anything a style could try to load is still limited by the image and font rules.
img-src 'self' data: blob:: Images only from our own site, or made on your device.
font-src 'none': No web fonts. Pennyrow uses the fonts already on your device.
worker-src 'none': No background workers. The PDF reader runs on the page itself, under the same rules.
form-action 'none': No form on the page can be submitted anywhere.
object-src, frame-src, media-src, manifest-src 'none': Nothing can be embedded or loaded through plugins, frames, audio/video or an app manifest.
base-uri 'none': The page's links can't be quietly pointed at another site.
frame-ancestors 'none': Other sites can't show Pennyrow inside their own pages.
Referrer-Policy: no-referrer: If you follow a link away from Pennyrow, the next site isn't told where you came from.
Permissions-Policy: The page can't ask for your camera, microphone or location.

What a policy like this can't do: no browser rule can stop a page from sending you to another web address. You'd see that happen: you'd leave Pennyrow and the address bar would show another site.

What's outside our control

Browser extensions. Extensions you've installed can read and change any page you open, including this one, if you've allowed them on all sites. For sensitive files, use a private or incognito window with extensions turned off, or a browser profile without extensions.
Browser features. Some browser features can send text to the browser maker, such as cloud spell check for what you type, or translating a page. They're browser settings; avoid them while your statements are open in Pennyrow.
Your device and your downloads. Anyone who can use your device can open the files you export.
Future versions. Each visit loads the current version of Pennyrow from our site, so a later update could change what it does. You can repeat the Network tab check any time; it takes a minute. All our own code files are readable (not minified), so you can read them with View Source. The only exception is pdf.js, which is Mozilla's published build, copied unchanged.

Cookies and analytics

Pennyrow's pages set no cookies, and run no analytics, no ads or ad pixels, no traffic counter and no code from other sites. We don't follow you across other sites, so Pennyrow works the same whether or not your browser sends a “Do Not Track” signal.

Changes and contact

If this policy changes, the effective date at the top changes too. This version is effective 2026-10-13.

Questions, or something here doesn't match what you see? Message @minsoesantun on X. Please don't send us statements or screenshots of real account details; we never need them.