GGST File

Privacy policy

Last updated 12 October 2026

This policy covers the GST File website at gst.dcrayons.app and the "GST File login" browser extension. It says what we keep, why, who else handles it, and how to delete it.

What the website keeps

• Your account: your name, your email address, and your password. We keep the password only as a one-way hash (scrypt), so nobody can read it back, us included.
• Your companies and GSTINs: the company names and GSTINs you add.
• Portal logins: the usernames and passwords you save for a GSTIN on the GST portal, the E-Way Bill portal and the E-Invoice portal. The passwords are encrypted on our server and are decrypted only to fill in that portal's login for you, or to show them to you on the dashboard when you ask.
• Login tokens: random tokens that keep you logged in on the website (30 days) and in the extension (180 days). We keep only a hash of each token.
• Files you upload: marketplace reports you upload for GSTR-1, and the returns and files built from them.
• Technical logs: our web server's standard logs (IP address, time, page asked for). After failed logins we keep the email and IP address in memory for 15 minutes, to stop password guessing.

What the extension does

• It runs only on the login pages of the GST portal (https://services.gst.gov.in/services/login), the E-Way Bill portal (https://ewaybillgst.gov.in/Login.aspx and https://ewaybill2.gst.gov.in/Login.aspx) and the E-Invoice portal (the home pages of https://einvoice1.gst.gov.in and https://einvoice2.gst.gov.in, where its login form is). It does not run on any other page and does not read your browsing history.
• When you connect it, it sends the email and password you type to gst.dcrayons.app over HTTPS, and stores the login token it gets back in your browser. It never stores your account password.
• When you pick a GSTIN, or click "Log in" next to a saved login on the dashboard, it fetches that GSTIN's username and password for that portal from gst.dcrayons.app over HTTPS. It keeps them in the browser's memory for that tab until they are filled in, for at most two minutes, and then puts them into the login boxes.
• It never reads, fills in, or sends the captcha. It sends nothing from the portals' pages back to us.
• It has no ads, no analytics, and no code loaded from the internet.

How we use it

We use this data only to run GST File for you: to log you in, to show your companies and GSTINs, to build your returns, and to fill in portal logins when you ask. We do not sell your data, use it for advertising, or use it to decide anyone's creditworthiness.

The use of information received from the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Who else handles it

• Amazon Web Services hosts our server, where the data is stored.
• Cloudflare carries the traffic between your browser and our server.
• Google Fonts serves the font on our pages, so your browser asks Google for it.

We do not give your data to anyone else, unless the law requires it.

Keeping it safe

All traffic uses HTTPS. Portal passwords are encrypted on our server, account passwords and login tokens are stored only as hashes, and repeated wrong passwords pause logins for 15 minutes.

Deleting your data

• Delete a GSTIN or a company on the dashboard, and its saved portal logins are deleted at once.
• Press "Disconnect this browser" in the extension to end its login token and remove it from the browser. Removing the extension also removes everything it stored.
• To delete your whole account and everything in it, email us from your account's email address.

Changes

If this policy changes, we update this page and the date at the top.

Contact

Questions or deletion requests: [email protected]