GlidePath Money

Browser extension

Skip the monthly “export, find the file, drag it in” ritual.

Install it once. On bank sites you enable, the extension catches qualifying CSV/PDF downloads and files generated by the page, then sends them to the GlidePath app address in Settings. The default is your local app at localhost:5000; a remote address you choose receives the file over the network. The extension does not ask for your bank password or use an aggregator.

Add to Chrome — free Get the app first

Free, and it works with the GlidePath desktop app on your machine. Chrome & Edge.

What the extension does

Three pieces, working in the background. You won’t see most of this happening — that’s the point.

Catches your bank's CSV download

On enabled bank sites, the extension watches browser downloads and qualifying CSV/PDF blobs made by the page. Version 1.2.1 forwards a page-generated blob only after you use an export or statement control and Chrome confirms a matching download. Opening an inline viewer alone does not forward its PDF. Version 1.2.0 could capture a qualifying blob without that action.

Prepares the account for your review

A card hint or saved mapping can suggest an account. Every captured file waits in Import Center for holder review before transactions enter the ledger.

Goes to your configured app

Files go to localhost:5000 by default. If you set a remote app address, it receives the file and bank-page metadata over the network. An optional, off-by-default bank-support diagnostic is a separate request to our API.

Supported banks today

Four banks work the moment you install. Eight more are one checkbox away — your browser asks permission for that single bank's site, and nothing is granted until you say yes. And a bank that isn't listed at all still gets the same import quality through the universal paths in the last rows. Here's the honest coverage ladder:

Coverage Banks What happens
Works out of the box Chase · American Express · Citi · Bank of America Installed means active. Click Download on the bank's site and the export lands in GlidePath — per-bank behavior in the fine-print table below.
One checkbox away Discover · Capital One · Wells Fargo Turn the bank on in the extension's Settings; your browser prompts for that one site. From then on exports capture and parse on arrival — GlidePath already knows these formats.
One checkbox, then map once U.S. Bank · PNC · Truist · Ally · Marcus Same opt-in capture. The first file lands on the in-app Import page, where you match the bank's columns once — every export after that is remembered.
Any other bank Everything else Two universal paths: drop the export onto the extension popup (any bank, one extra click), or flip on "Watch my Downloads folder" on the in-app Import page and new exports get noticed for you. Either way, you review before anything saves.
PDF statements Any enabled bank Statements route to the app's assisted PDF reader. GlidePath reads what it can locally, then you confirm every save.
Brokerages Schwab, Fidelity, Vanguard & co. Not yet — honestly. GlidePath imports positions files on the Import page today, so holdings can come in by hand. What's missing is brokerage coverage in the extension, so nothing captures on arrival the way a bank export does.

The out-of-the-box four, in detail

Bank Auto-capture? What to expect
Chase ✓ Silent A card's last-four can suggest an account. Review the captured file and its destination in Import Center before saving.
American Express ✓ One-time setup A saved card mapping can suggest the account on later captures. The holder confirms each file in Import Center.
Citi ✓ One-time setup A saved card mapping can suggest the destination on later captures. Each file still needs holder review.
Bank of America ⚠ Popup-flow BoA's anti-automation defenses prevent silent auto-capture. Download as usual, then drop the file into the extension popup with the card's last-four. One extra click per download.

Want us to add your bank? Tell us at [email protected]. If you choose to send a sample export, it can help us build support for a new bank. If you enable the optional "Help improve bank support" diagnostic (off by default), a failed capture at a bank you've enabled can also alert us to a problem. That alert alone does not show us the file's shape or add a bank automatically.

Review each captured file

The extension sends the file to your configured GlidePath app address. GlidePath stages it in Import Center. A card hint or saved mapping can suggest the account, but the license holder reviews the rows, destination, and money effects before confirming a save.

  1. Download the CSV normally from your bank's site.
  2. Open Import Center when the capture notification appears. It says the file was captured for review, not imported.
  3. Review the preview, format mapping, and proposed account. Correct anything that is wrong.
  4. Confirm the import as the license holder. Only then can transactions enter your ledger.

Saved card mappings

A saved mapping can suggest an account on the next capture. It never skips the holder's review.

When auto-capture doesn't work

Sometimes you'll see a notification like "auto-capture didn't work — the file is in your Downloads folder, drop it into the extension popup to send it." Here's what that means and what to do.

Why it happens

  • Bank security defenses. Banks like Bank of America use POST-only download endpoints with single-use CSRF tokens that can't be replayed from a background context. This is intentional on their part.
  • Bank UI changes. Banks redesign their sites periodically. If a download URL changes, our extension may not recognize it until we ship an update.
  • Session expired. If your bank session times out mid-download, the re-fetch may return an auth error.

What to do

  1. The file is already in your Downloads folder.
  2. Click the GlidePath extension icon in your browser toolbar.
  3. The popup opens. Click "Choose File" and pick the CSV.
  4. Optionally enter the card's last 4 digits in the Account last 4 field. That can suggest an account in Import Center; you still review and confirm the file before it changes the ledger.
  5. Click "Send to GlidePath".

Same import quality, same dedup. The popup is the universal escape hatch for any CSV from any bank — even ones we don't have a built-in capture path for yet.

Installing the extension

It’s live on the Chrome Web Store — one click to add it, and Chrome keeps it updated automatically. (You’ll need the GlidePath desktop app running on the same computer for it to have somewhere to send your files.)

Add to Chrome — free Get the desktop app

Works in Chrome and Chromium browsers (Edge, Brave, Arc, Opera). In Edge, install from the Chrome Web Store and accept “Allow extensions from other stores.” There’s no Firefox version today.

Prefer to sideload a build manually? (advanced)

You don’t need this — the Chrome Web Store is the easy, auto-updating path — but if you’d rather load an unpacked build yourself:

  1. Email [email protected] and we’ll send the latest extension zip.
  2. Extract it to a folder you’ll keep around (don’t delete it after install).
  3. In Chrome, open chrome://extensions/.
  4. Toggle Developer mode ON in the top-right.
  5. Click “Load unpacked” and select the extracted folder.
  6. Click the pin icon to keep the GlidePath icon in your toolbar.
  7. The first time you visit a supported bank, accept Chrome’s prompt to allow that bank’s domain.

Troubleshooting

The extension icon shows the wrong version after an update

Chrome doesn't auto-refresh extension code in already-open tabs. Go to chrome://extensions/, click the reload icon (⟳) on the GlidePath card, then hard-refresh any bank tabs (Ctrl+Shift+R) so the new content scripts inject.

I got a "new permission needed" prompt after updating

That happens when we add a new bank to the supported list — Chrome asks you to grant access to that bank's domain. Click "Accept" or "Enable" to allow. We never request domains beyond the banks we actually capture exports from.

Where is a file the extension captured?

Open Import Center in GlidePath. A successful handoff stages the file there for holder review; it does not import transactions automatically. If the app address was unreachable, check the extension popup for a held CSV or choose the file from Downloads. If the extension says GlidePath may already have the file, check Import Center first.

My antivirus is blocking the GlidePath installer

The installer is signed with Microsoft Trusted Signing (Authenticode certificate chain rooted at “Microsoft Identity Verification Root Certificate Authority 2020”), so SmartScreen and the major AV tools should recognize the QuickTech LLC publisher on first download. If you’re still seeing a warning, you may have grabbed an older unsigned 0.9.x build — re-download from /download to get the current signed 1.x release. If the warning persists on the fresh download, email [email protected] with a screenshot and the exact AV name; that’s a real-world false positive we want to track.

How do I uninstall?

Open chrome://extensions/, find GlidePath Money — Bank CSV Helper, click Remove. The extension stores no data outside Chrome's per-extension storage (which Chrome wipes on uninstall), and the app on your computer keeps working without it — you can still drag CSVs into the /Import page manually.

Privacy boundaries

  • Your bank login stays with the bank. The extension does not ask for, store, or transmit your bank password. You log in on the bank's own site.
  • Captured files go to your configured app address. By default that is http://localhost:5000 on your own machine. If you choose a remote address in Settings, it receives the captured file and bank-page metadata over the network. A CSV download request URL can contain an authentication token.
  • No diagnostic telemetry by default. The extension can re-fetch a bank download URL and POST the captured file to your configured app address, which may be remote. The diagnostic is fully opt-in and off by default — a “Help improve bank support” setting that, if you turn it on, may send a diagnostic when a bank you’ve enabled provides a file the extension can’t recognize. In version 1.2.0, published in June 2026, that diagnostic includes the file’s first line, the download address and the full name of the site. We keep only fixed facts from it (such as the bank’s domain and file type, plus counts when a later version supplies them), never any text from your file or the bank’s page. See the privacy policy for exactly what it does and doesn’t include.
  • Capture runs across enabled bank hosts. Content scripts run on all HTTPS pages of enabled bank hosts, including sign-in and account pages. Version 1.2.1 forwards a qualifying blob only after a real export or statement action and a matching Chrome download. Opening an inline viewer alone does not forward it. An installed 1.2.0 copy can capture a qualifying blob without that action. To recognize an action, scripts inspect the activated control's label, title and button value, which can include balance text. They do not inspect login/password entries or scrape separate balance elements.
  • Undelivered CSVs can be held during this browser session. If GlidePath is closed or locked at the configured app address, version 1.2.1 can keep a CSV and its filename, bank name, bank-page URL and title, download request URL, and account last four only in memory-backed browser-session storage. The extension sends a held CSV only after GlidePath answers that it is running, and keeps holding it if a locked GlidePath refuses it. If a send's result is unknown, the extension attempts to remove its held copy and retries cleanup if browser storage refuses. The held copy itself is marked attempted in the same browser-session record as its bytes, with a separate random attempt ID in browser-local storage. Either marker blocks an automatic resend after a worker restart; only removing both outside the extension while the bytes remain could allow another send. Check Import Center before choosing the downloaded file if it is not there. Retry eligibility ends after seven days; expired copies are removed on the next queue check, which Chrome can delay. Restarting Chrome or reloading, updating or disabling the extension clears it sooner. The 26th held file displaces the oldest; expiry and displacement show a manual-import notice. If needed, choose the downloaded file in GlidePath Import. On its next run, 1.2.1 removes older persistent held copies from 1.2.0 and shows a manual-import notice. You can clear queued copies or disable holding in the extension; a request already sent may still reach GlidePath. PDFs are not held for retry.
  • Host permissions are bank-only. The extension declares access only to bank domains it can capture exports from (chase.com, americanexpress.com, citi.com, bankofamerica.com today). Adding a new bank is a permission update you have to approve.
  • Source available by request. If you want to read the extension's source before installing, ask us.