GlidePath Money — Bank Import Helper Chrome extension security report

GlidePath Money is a desktop personal finance app that lives on your own computer. This extension is the bridge: when you click "Download transactions" or "Download statement" on your bank's website, the extension catches the file and hands it directly to your local GlidePath install — without sending it through any third-party server. WHAT IT SUPPORTS - Auto-capture for Chase, American Express, Citi, and Bank of America (more banks coming) - Both CSV transaction exports and PDF statements - Manual upload for any other bank: drop your CSV into the extension popup, and it'll route it to your local app the same way WHAT MAKES THIS DIFFERENT - No aggregator account. The extension does NOT use Plaid, Yodlee, MX, or any other aggregator. Your bank login credentials never leave your browser. - No data on our servers. Captured CSV and PDF files go directly from your bank tab to your local GlidePath Money install on your own machine. We never see your financial data. - Works only with the local app. The extension is a pipe between your bank and your computer. If GlidePath Money isn't running locally, there's nowhere for the data to go. We can't read it; we don't have it. HOW IT WORKS 1. Install GlidePath Money on your Mac or Windows PC (from glidepathmoney.com) 2. Install this extension 3. Visit your bank, download a CSV or statement as you normally would 4. The extension catches the file and POSTs it to localhost:5000 — your own machine, your own data 5. GlidePath Money imports it using the same format detection it uses for manual CSV uploads REQUIREMENTS - GlidePath Money installed and running on the same computer (Windows or Mac) - A supported bank for auto-capture, or any bank for manual upload via the popup PERMISSIONS We request the minimum set of permissions needed for capture: - "downloads" — to read filenames so we can auto-route by account last-4 - "storage" — to remember your local-app URL and one-time card-to-account mapping - "activeTab" — to log which bank page each capture came from - "notifications" — to show import confirmations - "webRequest" — to catch the original download URL when banks pre-cache the file before our content script runs - Host permissions on chase.com, americanexpress.com, citi.com, and bankofamerica.com — only for the banks we currently auto-capture Banks beyond those four are listed as OPTIONAL host permissions — they're not granted until you opt in. PRIVACY This extension does not collect, transmit, or store personal data on any server we control. The full privacy policy is at glidepathmoney.com/privacy. OPEN SOURCE The extension source is on GitHub (link in the homepage URL) so you can audit exactly what it does. Local-first deserves to be auditable. QUESTIONS hi@glidepathmoney.com