Privacy Policy

Effective date: July 22, 2026

This policy describes what information Positive Pay Generator, a sole proprietorship (“we”) handles when you use positivepaygenerator.com (the “Service”). The short version is unusual for a privacy policy: the tool is built so that we never receive your data.

1. Your check data never reaches us

When you use the tool — uploading a check register, mapping columns, generating and downloading a positive pay file — all of that happens locally in your web browser. The contents of your files (check numbers, amounts, payees, account numbers) are:

not transmitted to our servers or anyone else’s by the Service;
not stored by us anywhere; and
not visible to us in any form.

“Upload” in the tool’s interface means loading a file into your own browser’s memory. When you close or reload the page, that data is gone. We could not produce your check data in response to a subpoena, a breach, or a purchase offer, because we never have it.

2. What we do receive

Server logs. Like essentially every website, when your browser requests our pages, our hosting provider, Cloudflare, automatically logs technical information: your IP address, browser type, the pages requested, and timestamps. We use these logs, if at all, for security and to keep the site running. They are retained by the hosting provider per its privacy policy and are not combined with any other data about you (we have no other data about you).

Email you send us. If you email us — for example, to request a bank format or report a problem — we receive your email address and whatever you include. We use it to reply and to improve the Service, and we keep the correspondence as long as it’s useful for that. Please don’t email us check registers or account numbers; we don’t need them.

That is the complete list. We do not have user accounts, and we do not collect names, payment information, or the contents of files you process.

3. Cookies and tracking

The Service sets no cookies. We use one measurement tool: Cloudflare Web Analytics, a cookie-less, privacy-preserving page-view counter served by our hosting provider. It uses no cookies, no cross-site tracking, and no advertising identifiers, does not store IP addresses, and does not fingerprint you across sites; it gives us aggregate counts (pages viewed, referrers, country-level geography) so we can tell which bank-format pages are useful. It never sees the contents of files you process — those stay in your browser (Section 1). Details are in Cloudflare’s Web Analytics documentation.

There are no advertising or tracking scripts and no other third-party embeds on our pages. Because we don’t track individuals, “Do Not Track” and Global Privacy Control signals require nothing extra from us — we honor the spirit of both by default.

Links to external documents (for example, a bank’s published format specification) lead to third-party sites governed by their own privacy policies.

We do not sell or share personal information for advertising, and never have. The only parties that touch the limited data in Section 2 are our hosting provider (as a service provider processing server logs to deliver the site) and our email provider (to deliver mail). We would disclose information if legally compelled — though as noted, for your check data there is nothing to disclose.

5. Security

The most effective security measure in this product is architectural: your sensitive data stays on your machine. The site is served over HTTPS. For the little we do hold (email correspondence), we use reputable providers with access limited to the operator.

6. Children

The Service is a business bookkeeping tool, not directed to children, and we do not knowingly collect information from anyone under 13.

7. Your rights — California (CCPA/CPRA)

Honestly stated: we likely do not meet the CCPA’s thresholds to be a regulated “business” (we are a small operator, well under the revenue and volume thresholds, and we do not sell or share personal information). We nonetheless commit to its substance. California residents may ask us to disclose or delete personal information we hold about them; in almost every case the truthful answer will be “we hold none, or only an email thread you sent us,” and we will confirm or delete it on request at [email protected]. We do not sell or share personal information as those terms are defined in the CCPA, we do not use or disclose sensitive personal information (we don’t collect any), and we will not discriminate against anyone for exercising privacy rights.

The Service is intended for United States businesses and we do not target the EU/UK. If EU/UK law nonetheless applies to you: the limited processing described in Section 2 rests on our legitimate interest in operating and securing the website (Art. 6(1)(f)); check data processed in your browser never constitutes processing by us, because we never receive it. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. Contact: [email protected]. Note that our hosting provider’s servers are located in the United States; requests to our site are therefore processed in the United States.

9. Changes to this policy

If we change what data the Service handles — including launching any feature in Section 10 — we will update this policy before the change takes effect, update the effective date, and note the change prominently on the site. We will never retroactively apply a weaker policy to data collected under a stronger one.

10. Planned features — NOT YET IN EFFECT

The subsections below are published for transparency about what we plan to build. None of it is live. Until a subsection is activated (marked in effect, with a dated changelog entry), the statements in Sections 1–3 remain the complete and accurate description of the Service. When activating any subsection, we must also revise the on-site claims (“check data never leaves your computer”) to remain accurate.

10.1 Analytics [IN EFFECT as of July 22, 2026]

Activated at launch: cookie-less Cloudflare Web Analytics, as described in Section 3. No cookies, no cross-site tracking, no advertising identifiers, IP addresses not stored — aggregate counts only, never file contents, amounts, payees, or account numbers, which stay in your browser.

10.2 Pro accounts and payments [NOT YET IN EFFECT]

If we launch a paid tier, creating an account will involve: your email address and a password credential (stored hashed), and subscription status. Payments will be processed by Stripe; your card number goes to Stripe, not to us — we would receive only non-sensitive metadata such as the last four digits, card brand, and payment status, and Stripe’s own privacy policy governs its processing. Account data will be retained while the account is open and deleted within 90 days of account deletion, except records we must keep for tax and accounting. At that point we will be a “business” holding personal information, and the rights in Sections 7–8 will apply with real substance: export and deletion will be available in-app or by email.

10.3 Saved bank profiles [NOT YET IN EFFECT]

A planned Pro feature would let you save bank profiles — such as bank format choice, account number, and bank-assigned IDs — on our servers so you don’t re-enter them. This would be the first time the Service stores any financial data, and we will treat it accordingly: encrypted at rest and in transit, access-controlled, stored only with your explicit opt-in (the tool will keep working without saved profiles), deletable by you at any time, and never used for anything except pre-filling your own file generation. Bank account numbers are sensitive information under several state laws, including the CPRA; before launch we will update this policy with specifics (storage location, encryption approach, retention, and breach-notification commitments) and, where required, a “Limit the Use of My Sensitive Personal Information” mechanism. Check register contents (the checks themselves) will continue to be processed only in your browser even with saved profiles.

Contact

Privacy questions or requests: [email protected] — Positive Pay Generator