Your statements are never stored.
Never sold.

Butter reads the visible text of checkout pages you visit — only to detect if you're on a checkout page and estimate the purchase amount. This analysis happens entirely in your browser. No page content is sent anywhere.

Butter stores a small amount of data in Chrome's encrypted sync storage: your card wallet (the product names of the cards you own); any welcome-bonus deadline and amount-spent figures you enter yourself for reminder tracking; the cards you've hidden from recommendations; your per-site preferences (when you mark a card or network “won't work here” at a store, that rule — the store's website and which card or network — is saved so it's remembered next time); and display settings, such as whether the widget appears automatically at checkout. This is never card numbers, CVVs, account details, statement contents, or a record of the pages you browse. Chrome encrypts this data and syncs it only between your own signed-in devices.

When you click Apply, we may receive a referral fee if you're approved, including through partner networks. This never influences our recommendations, which are based purely on your spending data and publicly available earn rates. Butter provides information and tools, not financial advice — always confirm card details with the issuer before applying.

The reward calculator on our homepage runs entirely in your browser. No data is sent to any server at any point.

When you upload a bank statement at /analyse, we never store the file or your statement data on our servers — processing is stateless and nothing about you is retained after your result is returned. Our fast local analysis runs entirely in your browser, and the file never leaves your device. If you choose AI-assisted analysis, the extracted statement text is sent to our processing endpoint and on to our AI provider (Google Gemini) solely to return your result. Before it leaves your device we strip your name and mailing address as printed on the statement, card and account numbers (including partially-masked forms), postal codes, and phone numbers. What remains — merchant names, dates, and amounts — is the transaction data being analysed. For image-based or scanned PDFs that contain no readable text, we ask for your explicit permission before sending images of the statement pages to Google Gemini for reading, since identifiers cannot be stripped from images beforehand. We use Google's paid Gemini API tier: under Google's API terms, your statement data is not used to train Google's models and is retained by Google only temporarily for abuse monitoring. Nothing is stored by us, and parsed results live only in your browser tab's memory — a refresh or closed tab clears them.

To categorise spending accurately for everyone, we maintain a shared dictionary of merchant names mapped to spending categories (for example, TIM HORTONS is dining). When our AI categorises a merchant we haven't seen before, that merchant-name-to-category pair is saved so future statements categorise instantly. The dictionary contains merchant names and categories only — no amounts, no dates, and nothing linking any entry to you or your statement.

We use Google Analytics to understand site traffic — pages visited and general feature usage. It is deliberately kept away from your financial data: analytics never receives your statement contents, merchant names, dollar amounts, filenames, or the cards in your wallet. Usage events carry only coarse ranges (for example, a spend bracket rather than a figure). Standard Google Analytics collection (a cookie and technical browser data) applies to it like any site that uses GA.