Privacy policy

Last updated: November 2026

kto-zaplacil.pl runs entirely in your browser. The bank statements and invoices you load never leave your device.

We do not collect data

The tool does not collect, store or process your personal data. Statements (MT940, CAMT.053, CSV) and invoices (KSeF XML, CSV) are read and compared only by JavaScript code in your browser.

Files do not reach any server

The page has a built-in block on network connections (the Content-Security-Policy header default-src 'none'). Once loaded, the browser does not let it send anything to any server, including ours. You can check this in your browser's developer tools, in the "Network" tab.

We do not save anything on your device: results disappear when you close or refresh the tab.

Cookies and analytics

We do not use cookies, browser storage (localStorage) or analytics tools. We do not track visits or clicks.

Hosting

The site's files are served by Cloudflare. Like any web server, when delivering the page Cloudflare processes technical data (e.g. IP address and browser type) to serve it and protect it from attacks. It does so under the terms of the Cloudflare privacy policy. This data does not include the contents of your files.

The link to ksef.podatki.gov.pl leads to the Polish Ministry of Finance website, which has its own privacy rules.

No account needed

There is no registration or login. All features work without giving any data.

Open code you can check

All of kto-zaplacil.pl's code is public under the GNU AGPL-3.0 licence: github.com/stloyd/kto-zaplacil.pl. It is the same code that runs in your browser.

Who runs the site

The site is run by Joseph Bielawski, contact: kontakt@kto-zaplacil.pl.

Changes to this policy

We will publish every change on this page with a new date. Keeping your files in the browser is the foundation of how the tool works, so we do not expect major changes.

Contact

Send privacy questions to kontakt@kto-zaplacil.pl.