Your data stays on your device. Nothing is uploaded to any server.

Privacy

What GSTSelf does and does not guarantee about your data

The short version

GSTSelf runs entirely in your browser. Your financial data is never sent to any server. We cannot see, access, or transmit your data because the code has no mechanism to do so.

What we verified (and you can verify yourself)

A full automated scan of the codebase was performed. These are the results.

Network activity

  • Zero fetch() calls anywhere in the codebase
  • Zero axios, XMLHttpRequest, WebSocket, or sendBeacon usage
  • Zero analytics, telemetry, error reporting, or advertising scripts
  • Zero Next.js API routes or server actions that handle data
  • Zero environment variables or API keys configured

Data handling

  • All file parsing (CSV, Excel) happens entirely in your browser using client-side JavaScript
  • All GST calculations, validations, and return preparation run in your browser
  • All data is stored in your browser's IndexedDB. No external databases are used
  • No financial data (GSTINs, amounts, invoice numbers, customer names) appears in any URL
  • No financial data is logged to the browser console
  • File downloads (JSON, CSV, TXT) use local Blob URLs. Data stays on your device

What we cannot guarantee

Honest limitations of a browser-based application.

  • Browser-level access. Anyone with physical access to your unlocked device, or access to your browser profile, can see your IndexedDB data. GSTSelf cannot protect against this.
  • Browser extensions. Malicious browser extensions with broad permissions could theoretically read data from IndexedDB or the page DOM. GSTSelf cannot prevent this.
  • Operating system. Your operating system, disk encryption settings, and backup configuration are outside GSTSelf's control. If your OS is compromised, your data is at risk regardless.
  • Exported files. When you download JSON, CSV, or TXT files, those files are saved to your device. How you store, share, or protect those files is outside GSTSelf's control.
  • Third-party dependencies. GSTSelf uses Next.js, React, and Tailwind CSS. While these are well-maintained, a supply-chain attack in any dependency is theoretically possible. You can audit dependencies in package.json.
  • Font loading. GSTSelf loads the Inter font via Next.js's next/font/google system, which downloads the font at build time and serves it locally. No runtime connection to Google Fonts occurs. However, the build step itself involves downloading the font file once.

How your data flows

1

You enter data

Business profile, invoices, and purchases are typed into browser forms. No data leaves your keyboard.

2

Data is stored locally

Saved to IndexedDB in your browser. No server, no cloud, no external database.

3

Processing happens in your browser

GST calculations, validations, and return preparation run as JavaScript in your browser. No server is involved.

4

You download the result

Export files (JSON, CSV, TXT) are saved to your device as local downloads. You then upload them to the GST portal yourself.

What we do not do

  • No accounts, no login, no sign-up
  • No cookies used for tracking or analytics
  • No Google Analytics, Facebook Pixel, or similar
  • No error reporting services (Sentry, Bugsnag, etc.)
  • No A/B testing or feature flagging services
  • No server-side processing of your data
  • No cloud storage or backup services
  • No data is sold, shared, or accessed by third parties

Your controls

  • Delete all data: Use your browser's site settings to clear all data for this site, or delete individual records from within the app.
  • Export before clearing: Download your data as JSON or CSV before clearing browser storage.
  • Verify yourself: The source code is readable. You can inspect it in your browser's developer tools, or view the source to confirm no network requests are made.
  • Offline use: Once loaded, GSTSelf works without an internet connection. You can disconnect from the internet while using it.

Scope of this privacy statement

This privacy statement covers only the GSTSelf application as distributed and installed on your device. It does not cover your browser, operating system, network, or any third-party browser extensions you may have installed. GSTSelf is a tool that runs on your device — its privacy properties depend on the security of your device and browser.

How to verify this yourself

  1. Open your browser's Developer Tools (F12) and go to the Network tab.
  2. Use GSTSelf normally — add invoices, prepare returns, run health checks.
  3. Observe that no network requests are made while using the application (after initial page load).
  4. Check the Application tab > Service Workers to confirm no service workers are registered.
  5. Review the source code in the Sources tab to confirm no data is sent externally.