Does this file or store reports on a server?
No. Checks do not file. Report bodies are not sent. This is not a FINTRAC, FinCEN, or AUSTRAC system. It is not legal advice.
What runs in this browser
Check one, Batch check, Scan transactions, Scan clients, and the reject decoder run in this tab. Deadline radar stays in this browser’s localStorage. The Reject log stays in IndexedDB — file hashes, finding counts, and statuses you type, not the report body. Your region choice is stored as fiuready.region. A purchase email you type to unlock paid downloads stays in this browser. What you paste or load on Check one or Batch check lives in memory for this tab. Close the tab and it is gone. There is no last-form draft.
What still leaves
Notify me on paid-plan screens, Contact, Feedback, and pack-change alerts on Rule packs send the email and message you type to Formspree — never a report. Pack-change alerts are a subscriber list only; this app does not email people when a pack version changes. Page views go to Vercel Analytics (query strings stripped); Speed Insights measures load time. Check one, Batch check, and Reject log call our license API with a stored purchase email, if any. Stripe Checkout is not open. Unlock is the purchase email plus a live Stripe lookup — not a signed license token. Anyone who knows a paying email can unlock paid features.
How to verify
Open DevTools → Network during a Check one run or a scan. The report payload is not POSTed. License lookup (/api/v1/license) appears on Check one, Batch check, and Reject log when those screens check a stored purchase email. Analytics and Speed Insights requests appear on page views. This is not a zero-XHR product.
Browser / transport hardening
Document routes set CDN-Cache-Control and Vercel-CDN-Cache-Control to public, max-age=0, must-revalidate so a new deploy is not served from a stale HTML shell. This repo does not set Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy.
PII on screen
Names, dates of birth, addresses, and identifiers display as [MASKED]. Checks still use the in-memory original on your machine. We do not run free-text identifier scanners.
How to wipe
Clear this site’s data in the browser to remove everything stored here. On a shared or public PC, do that before you leave.