Last updated 2026-09-06. BrightCode LLC, operating FillStub.
On /app your file is read by your own browser and never sent anywhere. There is no account, no cookie for it, and no upload: you can watch the network tab stay empty. Nothing on that page reaches us, including the file name.
| What | Why | Kept |
|---|---|---|
| Your email address | it is your account, and where a password link is sent | until you delete the account |
| A password hash | so you can sign in; the password itself is never stored | until you delete the account |
| Your imported events | the ledger, the forms and the statistics are computed from them on every request | until you delete the account |
| The original export files | so a parser correction can be replayed over the original rather than over our reading of it | until you delete the account |
| Stripe's customer and subscription ids | to know what you are entitled to | until you delete the account |
| Sign-in attempt counters | to stop password guessing and mail flooding | 15 minutes to an hour |
Broker exports contain your account number. They sit in a private bucket that is not readable from the internet, and they are deleted when you delete your account.
Three processors, and no one else. Stripe takes the payment and holds the card details, which never reach us. Cloudflare runs the site and the database. Resend sends the two emails there are: the link to choose a password, and the link to reset it. Your ledger is never sent to any of them, and never to an advertiser, a data broker or an AI vendor. We do not sell anything about you, and there is nothing to sell.
Cloudflare Web Analytics, which sets no cookie and builds no profile: page, referrer, country, and nothing that identifies a person. There is no Google Analytics, no advertising pixel and no third-party script of any kind on these pages.
On your account page, and it is immediate and complete: the subscription is cancelled, the original files are erased from storage, and the account row goes with every event, import, token and tax mark attached to it. There is no copy left afterwards to restore from, by you or by us, which is why it asks for your password and your address typed out.
Anything else, including a copy of what is held: hello@fillstub.com.