Privacy Policy

Effective 2026-09-22 · Operator: Ripplarity Inc, 39327 Marbella Terraza, Fremont, CA 94538, USA · Contact: advatiya@trilatic.com

1. Your statement stays in your browser

PFIC Ledger is a set of static files (HTML, JavaScript, WebAssembly and a Python engine bundle) served from our own origin. When you open a CAS PDF or CSV:

• The file is read by pdf.js running in your browser. The password you type is used only in your browser to open the PDF.
• The extracted text is processed by our engine running in Pyodide (Python in WebAssembly), also in your browser.
• The file, its password, its text and every result computed from it (funds, lots, estimates, workpapers) stay in your browser tab. The site sends none of them to us or to anyone else.

You can verify this. Open your browser's developer tools, go to the Network tab and run an estimate. The requests you see load site files from our origin, and none of them carries your statement. The site's Content-Security-Policy blocks loading from third-party origins.

2. The only data that reaches our servers

The site makes network requests only in these cases:

1. Loading the site. Your browser requests our files from our origin. As with any website, our host receives standard request data (IP address, user agent, requested URL) to serve them.
2. A form you choose to submit (waitlist or partner-CPA referral). This sends POST /api/lead with only: your email address, the request type (waitlist or cpa_referral), your consent confirmation, and the tax year you selected. Nothing derived from your statement is sent. Our server rejects requests carrying any other fields or more than 2 KB.
3. Paid workpapers, if and when offered. This covers POST /api/checkout (creates a Stripe Checkout session), the redirect to Stripe, where you enter payment details directly with Stripe, and GET /api/unlock (confirms payment and returns an unlock token). These requests carry no statement data. We receive payment status records from Stripe. We do not receive your full card number.

We use no analytics, advertising or tracking scripts, and no third-party fonts.

3. How we use lead data

We use waitlist emails to tell you when paid workpapers are available. We do not sell personal information and do not share it with any third party.

4. Service providers

• Cloudflare, Inc. hosts the site and runs our API and database (Cloudflare Pages/Workers/D1) as our processor.
• Stripe, Inc. processes payments, only if you check out, under its own privacy policy.
• Our partner CPA receives referral details, only if you request a referral.

5. Retention

We keep lead records for 24 months or until you ask us to delete them. We keep payment records for 7 years for accounting and tax purposes. Statement data is never on our servers, so there is nothing to retain or delete. Closing the tab clears it from memory.

6. Your choices and deletion

To access or delete your lead data, or to withdraw consent, email advatiya@trilatic.com from the address you submitted. Depending on where you live, you may have further rights under applicable law, and we will honor valid requests.

7. Children

The service is not directed to children under 13.

8. Changes

We will post changes here and update the effective date.

Technical users can verify the engine: after an estimate, the page footer shows the loaded engine version and the start of its SHA-256 hash (hover for the full value). Compare it with the hash published in the PFICEngine repository, or run sha256sum on /py/pficengine.zip.