QUICKTECH LLC

Capture supported bank CSV exports and PDF statements in your GlidePath Money app. Optional diagnostics use fixed facts.

GlidePath Money is a desktop personal finance app. On enabled bank sites, this extension detects browser downloads and qualifying CSV/PDF files generated by the page, then sends them to the GlidePath app address you choose. The default address is `http://localhost:5000`; an address you configure for remote access sends the file over the network to that address. WHAT IT SUPPORTS - Works out of the box: Chase, American Express, Citi, and Bank of America — both CSV transaction exports and PDF statements - One checkbox away: Discover, Capital One, and Wells Fargo. Enable each from the extension's Settings page; your browser prompts for access to that one site, and nothing is granted until you turn it on. Exports from these three parse on arrival — GlidePath already knows their formats. - One checkbox, then map once: U.S. Bank, PNC, Truist, Ally, and Marcus. Same opt-in capture; the first file lands on GlidePath's Import page where you match the columns once, and every export after that is remembered. - Any other bank: drop your CSV into the extension popup and it routes to your local app the same way — and the desktop app can also watch your Downloads folder (opt-in) so exports from any bank get noticed without the extension at all. Either way, nothing imports without your review. - Brokerages (Schwab, Fidelity, Vanguard, etc.): not yet — capture is built, but the app can't import a positions file today. Brokerage support is its own milestone on the roadmap; we'd rather say "not yet" than pretend. - Session-only CSV retry: if GlidePath is closed or locked at the configured app address, the extension can hold a CSV in memory-backed browser-session storage and send it once GlidePath is open and unlocked. A send whose result is unknown is not repeated; the extension asks you to check Import Center instead. Retry eligibility ends after seven days; expired copies are removed at the next queue check, which Chrome can delay. A browser restart or extension reload/update/disable clears them sooner; check Import Center before manually importing a downloaded file. The 26th held file displaces the oldest with a recovery notice. When it next runs, version 1.2.1 removes older persistent held copies with a recovery notice. PDF captures are not held for retry. - A green checkmark on the toolbar icon when you're on a bank you've enabled, so you can see capture is active before you download WHAT MAKES THIS DIFFERENT - No aggregator account. The extension does NOT use Plaid, Yodlee, MX, or any other aggregator, and does not ask for bank passwords. A download request URL may contain an authentication token and is sent to the configured app address with a CSV capture. - By default, captured CSV and PDF files go to your GlidePath app on `localhost:5000`, not to a GlidePath-operated import server. If you change the app address in Settings, that configured address receives the file and its bank-page metadata; a remote address sends those details over the network. The separate, optional "Help improve bank support" diagnostic sends only structural facts to `api.glidepathmoney.com` when enabled (off by default). - If GlidePath is closed or locked at the app address, up to 25 CSV captures can wait in memory-backed browser-session storage and be retried at the configured address while Chrome stays running. Before each send the extension checks, without sending file data, that GlidePath is running there, so a held file stays held while GlidePath is closed or locked and is sent once it is open and unlocked. If a send's result is unknown (the request may have reached GlidePath but no answer came back), it is not repeated automatically: the held copy is removed (removal is retried if Chrome refuses it) and a notice asks you to check Import Center, then choose the downloaded file if it isn't there. Retry eligibility ends after seven days; expired copies are removed at the next queue check, which Chrome can delay. Restarting Chrome or reloading, updating or disabling the extension clears them sooner; check Import Center before manually importing a downloaded file. The popup can clear queued copies; a request already sent may still reach GlidePath. Expiry and capacity removal show a manual-import notice. When it next runs, 1.2.1 removes older persistent copies from 1.2.0 with a recovery notice. PDF captures are not held for retry. HOW IT WORKS 1. Install GlidePath Money on your PC (from glidepathmoney.com — Windows and Linux today, Mac in early access) 2. Install this extension 3. Visit your bank and use its export, download, or statement control as you normally would 4. The extension POSTs the captured file to the app address in Settings (`localhost:5000` by default) 5. GlidePath stages the file for the license holder to inspect the format, account destination and money effects 6. A capture notification opens Import Center, where the holder reviews and confirms before any rows enter the ledger REQUIREMENTS - GlidePath Money installed and running at the configured app address (Windows and Linux today; Mac in early access) - A supported bank for auto-capture, or any bank for manual upload via the popup PERMISSIONS We request the minimum set of permissions needed for capture: - "downloads" — to read filenames and suggest an account from a card's last-4 - "storage" — to remember the configured app address and settings, and to hold an unreachable CSV and its bank-page metadata only in memory-backed session storage while Chrome runs; retry eligibility ends after seven days and expired copies are removed on the next queue check, which Chrome can delay; restart or extension reload/update/disable clears it sooner. Each held copy is marked once a send is tried, so it is not sent again automatically. For about one minute it also keeps the download address and bank name seen in a bank tab and, for a bank whose download is a POST that must be replayed, that request's body (either can carry account identifiers or tokens) so the download can be paired or replayed; a timer then removes expired ones, though Chrome can delay it. Locally it also keeps a held-files marker, random IDs of copies a send was tried for, the last capture time, and the last diagnostic for a file it could not auto-match (fixed fields and counts, no text from the file or page), saved even when "Help improve bank support" is off so the popup's Copy diagnostic button can copy it; it is sent to GlidePath only when that setting is on - "activeTab" — to log which bank page each capture came from - "notifications" — to show staged-capture review prompts and capture failures - "webRequest" — to catch the original download URL when banks pre-cache the file before our content script runs, and, for a bank whose download is a POST that must be replayed, its request body; both are kept for about a minute - "scripting" — to turn on capture for an extra bank only when you enable it in Settings - "alarms" — to retry a held capture shortly after the app comes back online (that retry alarm runs only while a held copy is stored), and to clear short-lived bank download records after about a minute - Host permissions on chase.com, americanexpress.com, citi.com, and bankofamerica.com — only for the banks we auto-capture by default Banks beyond those four are listed as OPTIONAL host permissions — they're not granted until you opt in. PRIVACY By default, captured files and bank-page metadata are sent to the local app. A remote app address you configure receives them over the network. An undelivered CSV and its filename, bank name, bank page URL and title, download request URL (which may contain an authentication token), and account last four may be held only in memory-backed browser-session storage while Chrome runs. It is sent only after a readiness check shows GlidePath is running, and stays held if a locked GlidePath refuses it; a send whose result is unknown is not repeated automatically, and its held copy is dropped with a notice. Retry eligibility ends after seven days; expired copies are removed at the next queue check, which Chrome can delay. Browser restart or extension reload/update/disable clears it sooner. The 26th held file displaces the oldest with a recovery notice. When it next runs, version 1.2.1 removes older persistent held copies from 1.2.0 with a manual-import notice. For about one minute, browser-session storage also keeps the download address and bank name seen in a bank tab and, for a bank whose download is a POST that must be replayed, that request's address, body and content type (the address and body can carry account identifiers or tokens), so a download can be paired or replayed; a timer then removes them, though Chrome can delay it. Content scripts run on all HTTPS pages of enabled bank hosts, including login and account pages. Version 1.2.1 forwards a page-generated CSV/PDF Blob only after a genuine export or statement action and a matching Chrome download; an inline viewer alone is not captured. Version 1.2.0 could capture a qualifying Blob without that action. To recognize an action, scripts inspect the activated control's label, title and button value, which can include balance text; they do not inspect login/password entries or scrape separate balance elements. Separately, the off-by-default Help improve bank support option sends only fixed structural facts and counts to api.glidepathmoney.com when a capture cannot be auto-matched, without file or page text. The extension also saves its last unmatched-file diagnostic on your device (fixed fields and counts, no file or page text) even when that option is off, so the popup can copy it; it is sent to GlidePath only when the option is on. Local storage also keeps a held-files marker, random IDs of copies a send was tried for, and the last capture time. See glidepathmoney.com/privacy. HISTORICAL DIAGNOSTICS AND VERSION 1.2.0 Separately, the extension sends an automatic bank-support diagnostic to our API only if you turn on one optional setting, off by default, called “Help improve bank support.” If you turn it on, an unrecognized file from a bank already enabled in the extension may send us a diagnostic about the failed capture. Banks that are not enabled use the manual popup or Downloads path and do not send an automatic failed-capture diagnostic. To request a new bank, email hi@glidepathmoney.com; you can choose whether to send a sample export. What an automatic diagnostic contains depends on the extension’s version: - Version 1.2.0, published in June 2026 and the first published version with this setting, sends some text from the file and the page: - the first line of the file, up to 500 characters, unless those 500 characters contain a dollar sign directly before a number (such as $12) or a date written like 1/2/2026 or 2026-01-02. It is meant to be the column names, but it can be a line the bank puts above them, such as an account name or number, or, in a file with no header row, all or part of one or more transactions, such as their descriptions or amounts (a file whose lines end in a carriage return alone counts as one line); - the download address. When the extension caught the full address, the value of each query parameter is replaced, and so is any part of its path made only of three or more digits or of a long code using only the digits 0–9 and the letters a–f. When it caught only part of the address, only runs of three or more digits are replaced. Everything else is kept, so it can include a name, an email address, or a code the bank uses for your account or session. If the bank hands over the file as a data: address, which carries the file’s contents in the address itself, the address holds up to the first 1,000 characters of the file, transactions and amounts included; - the full name of the site the file came from (the page’s or the download’s), which can include your name, for example a personal bank address such as yourname.examplebank.com, or a site whose name merely ends in a bank’s; - the file type as the site labels it, which can include extra text such as a file name, the outcome, how the extension caught the file, the extension version and your browser. - Versions after 1.2.0 send no text from the file or the page, only the short list below. Our server allows the same limited fields for every version. It builds what it stores, and the alert email we send ourselves about it, from fixed lists and, when supplied and valid, up to two counts. It ignores everything else a diagnostic carries, including all of the text above. Version 1.2.0 does not supply either count. Our server allows the same limited fields for every version. It builds what it stores, and the alert email we send ourselves about it, from fixed lists and, when supplied and valid, up to two counts. It ignores everything else a diagnostic carries, including all of the text above. Version 1.2.0 does not supply either count. The fields we may keep are: - the bank, named only by its domain as it appears on our own fixed list of the banks and brokerages the extension knows, never by the address itself: a page at yourname.chase.com is recorded as chase.com, and a site not on that list is recorded as no bank at all; - up to two counts, when the extension supplies them: how many columns the file has, and how many parts the path of the download address has; - the file type, the outcome, how the extension caught the file, your extension version and your browser, each from a fixed list or a fixed short form. VERIFY IT YOURSELF You can inspect the network destination. In Chrome, open chrome://extensions, turn on Developer mode, and click this extension's "service worker" link. The bank tab's content scripts detect captures; the service worker POSTs a captured file to the app address in Settings — http://localhost:5000 by default, or a remote address you choose. You can inspect the request in the worker's Network panel. QUESTIONS hi@glidepathmoney.com