Privacy

Effective November 11, 2026

Your bill data stays on your device

The bills to pay and paid/history files you load (CSV or XLSX), vendor names, invoice numbers, amounts, batch names, file names, results and the history of earlier checks are read, compared and stored only in this browser (IndexedDB), together with the purchase record of a paid batch. Files and vendor names are never uploaded to DuplicateBillCheck or anyone else, and DuplicateBillCheck has no endpoint that accepts them. XLSX workbooks are unpacked in your browser; CSV exports and printable reports are created in your browser.

We cannot restore batches you remove from this browser or lose by clearing site data. Keep your files and, for a paid batch, download the purchase record.

What reaches our server

• Checkout: the payment method you chose, the batch project’s random ID (a UUID that says nothing about your business), a SHA-256 batch fingerprint computed in your browser from the project ID and the cell contents of the bills-to-pay file, and a random checkout attempt ID. The fingerprint is a one-way hash: the file is not sent and cannot be read back from it, although someone who already has the project ID and the exact file could confirm a guess. The server creates the checkout with Square or PayPal and returns a signed ticket that your browser keeps.
• Payment verification: the server keeps the provider order identifier, the project ID, the batch fingerprint, a random per-attempt value and the payment status in a private order ledger (the item is “DuplicateBillCheck Full Batch Report”, $49.00 USD). It checks with Square or PayPal until the provider confirms the payment or the order closes. After a confirmed payment, the return link can restore the unlock in another browser; the server stores only a keyed hash of that return code.
• Unlock check: when you open a paid batch, its ID, batch fingerprint and purchase record are sent so the server can confirm them.
• Rate limits use short-lived in-memory counters per IP address. They are not stored on disk.

Payments are handled on Square’s or PayPal’s own pages under their privacy policies. DuplicateBillCheck does not see or store card numbers or PayPal credentials, and never sends them bill data or vendor names.

Campaign counters

The server counts actual free CSV downloads, hosted-checkout starts and provider-confirmed live sales, with a coarse campaign label from a fixed list (for example duplicatebillcheck_guide, duplicatebillcheck_launch or duplicatebillcheck_agency), the language “en”, payment provider, mode and the integer price paid. No IP addresses, cookies, file names, vendor names, bill data or results are stored with these counts. Order numbers are stored only as a keyed hash to avoid double-counting. Sandbox payments and the demo are never counted.

Local storage

Besides IndexedDB, the app uses local storage for the last batch you opened and a campaign label from the link you arrived by (kept 30 days). No advertising or third-party tracking scripts are used.

Contact

Questions: contact support.