It uses the Chrome download API[1] and only listens to the downloaded files. If a file is from a specific bank site, contains the token and is in .csv format it

It uses the Chrome download API[1] and only listens to the downloaded files. If a file is from a specific bank site, contains the token and is in .csv format it will try to validate it. No user information is stored on my server. Edit: I view it as similar as synchronising bank data with an external app. [1]: https://developers.chrome.com/extensions/downloads https://developers.chrome.com/extensions/downloads