Skip to content
TurboGST

Privacy

What happens to your data on this site today.

Draft

This describes how the site works today. It is not a finished privacy policy and will be reviewed and replaced before accounts are opened to the public.

The free tools

The error fixer, JSON splitter, GSTIN validator and invoice checker run entirely in your browser. The files you choose, and anything you type into them, are processed on your device and are not sent to us.

If you create an account

  • We store your email, name, a salted Argon2id hash of your password (never the password), your organisation's name and the GSTINs and names you add.
  • If you turn on two-step sign-in we store your authenticator key encrypted, and hashed recovery codes.
  • We keep a log of security-relevant events (sign-ins, password and two-step changes, GSTINs added or removed) with the IP address they came from.
  • Signing in with Google gives us your verified email, name and picture. Nothing else from your Google account.
  • Session cookies keep you signed in. They are essential, so there is no cookie banner. We use no analytics or advertising trackers.

The browser extension

The TurboGST extension collects no data and sends nothing to us. When you click Send to GST portal, this site hands it one JSON file in your browser. The extension keeps that file in memory until it is placed in the GST portal's upload box or you remove it. It does not read portal pages, returns, ledgers or your profile, and it never sees your portal password, OTP or digital signature. How it works.

Reading invoices from PDF or JPG

If invoice reading is switched on for your account, the file you upload is sent to our extraction provider, Anthropic, to read the invoice fields, and is stored with your account until you delete it. Nothing is sent unless you upload an invoice yourself.

Your theme choice

Your light or dark choice is kept in your browser's local storage and never leaves your device.

What our host sees

Like any website, the server that delivers these pages sees your IP address and the pages you request in its standard access logs.

Still to come

When invoice reading, billing and reconciliation arrive, files and invoices will be stored and processed on our servers. A full policy will come first, covering what we keep, for how long, who processes it, and how you can have it deleted, in line with India's Digital Personal Data Protection Act.