Your statement never leaves your phone.

1. 1

   Your browser opens the PDF

   Pesa Recap uses pdf.js, Mozilla's PDF reader (the one inside Firefox), served from this site. If your statement is locked, it unlocks it with the password you type. The password stays on the page and is never sent anywhere.

2. 2

   Our engine reads every transaction

   It's the statement reader ZuriScore uses for its own reports, compiled to WebAssembly so it runs inside your browser instead of on a server. It works out every figure on your cards, on your phone.

3. 3

   If there's a charge, you pay by M-PESA

   When we charge for a recap, the price shows once your statement has been read, before anything about it is sent. The number on your statement is filled in, on your phone: keep it or change it, then approve the prompt on that phone. The number goes to our server and Safaricom for the payment only, and only when you tap Pay. If your statement can't be read, you're never asked to pay.

4. 4

   Your transactions are sorted

   Your phone sends each kind of transaction once, with every person's name, phone number, account number and amount taken out, and for each shop or paybill its number and the name M-PESA printed. Our server says what each one is, and your phone works out the recap. The lists that sort them stay on our server. Never an amount, a date, a balance, or the people you sent money to.

5. 5

   Your captions are written

   To give each card a little personality, we may be sent rounded facts like “KES 12,000” or “35%”, never an exact amount, a name or a date. An AI model may write the caption. If that's slow or switched off, the page writes it itself. Either way, every number on a card is worked out on your phone.

6. 6

   Your cards are drawn, and shared only if you say so

   Each card is drawn on your phone as an image. Amounts start hidden, no names appear, and sensitive cards stay private unless you add them. Sharing goes through your phone's own share sheet, straight to the app you pick.

7. 7

   Close the tab, and it's gone

   Your statement and everything made from it live in the page's memory. Nothing is written to your phone's storage unless you choose to keep a copy of your cards, and nothing was ever on our server.

The kinds of transactions on your statement

Each kind once, like “airtime purchase” or a transfer to someone, as its wording with the person's name taken out, their phone number cut to its first few digits (the network), and any account number or code removed; for a shop or paybill, its number, the name M-PESA printed and whether money went in or out. Never an amount, a date, a count, a balance, a receipt number or the people you sent money to. A small puzzle your phone solves goes with it, so the service can't easily be used in bulk.

Rounded facts for captions

Amounts at two significant figures, whole percentages, counts, a multiple like 2.3x, a month or weekday, a day of the month, an hour, a category, a way of travelling, and your personality's name. Never an exact amount, a name or a place: a card that names a town gets it filled in on your phone. Private cards are never sent.

Anonymous counts

That a page was opened (which one, never its address), that a file was picked, that cards were shown or shared, that you reached the end, why a statement couldn't be read, or how a payment went, with banded numbers like how many cards. No ID, session or time is attached, we keep only hourly totals, and nothing at all is sent if your browser has Global Privacy Control or Do Not Track on.

Your payment, if there's a charge

The M-PESA number you pay with (your statement's is filled in on your phone, and you can change it), sent only when you tap Pay, which we send to Safaricom for the payment prompt and keep with the payment's record: the amount, the M-PESA receipt and the time. A paid recap then sends a pass, a code that stands for that payment, with the kinds of transactions and the rounded facts. The pass says nothing about your statement.

Like any website, the servers that deliver this one see your IP address and browser when you load it. They never receive your statement. The privacy notice has the details, including who else processes what we're sent.

1. On a computer, open this site and your browser's developer tools, then the Network tab.
2. Make a recap with your statement.
3. Look at the list. You'll see this site's own files and the kinds of request above, and nothing else: no analytics, no trackers, no third-party scripts.

The site also tells your browser, through its security policy, to refuse to load anything from, or send data to, any other website.