1. About this policy and operator
VyaraRecon is an independently operated GST operations application. For privacy requests, contact varun2010gupta@gmail.com.
2. Information the application processes
- Account and sign-in: name and email you enter; a salted password hash (never the password itself); session identifiers and expiry; and, if Google sign-in is enabled, the Google account identifier, email, and name returned for authentication.
- Client workspaces: client/business names, GSTINs, trade names, selected workspace, and other details you enter.
- Reconciliation and tax workpapers: invoice identifiers, supplier GSTINs/names, dates, taxable and tax amounts, return totals by tax head and period, matched records, comparison results, review decisions, review notes, and review events.
- Bank reconciliation: the imported statement filename and fingerprint, parsed transaction dates, descriptions, references and amounts, selected ledger accounts, matching decisions, and related voucher details. The uploaded CSV itself is not retained by the application.
- Invoice capture: uploaded PDF/image bytes are processed for the request; OCR-extracted invoice fields, confidence values, filename, and review state may be stored. The original scan bytes are not saved as the document by this application.
- Uploaded reconciliation files: bytes are parsed in memory. The application stores parsed results, filename, size, SHA-256 fingerprint, and selected period, not the original file bytes.
- Payments, if configured: order identifiers, amount, provider status, refund status, entitlement dates, and receipt contact details submitted to the payment provider. VyaraRecon does not receive or store card credentials.
- Technical and security data: account and review audit events and service diagnostics needed to operate, secure, and troubleshoot this local installation. The local server may also produce ordinary process logs.
- License activation (when the online issuer is configured): customer email, optional phone number, device fingerprint, license identifier, expiry, activation status and timestamps. Cloudflare D1 stores the license status and a hash of the signed key; it does not store the raw activation key or signing private key.
3. Purposes
Information is processed to create and secure accounts; keep client work separated; parse and compare files supplied by you; calculate and display review workpapers; save return totals and review decisions; create exports and supplier follow-up drafts; provide invoice OCR; operate bookkeeping and bank-reconciliation functions; process a payment when enabled; prevent misuse; and troubleshoot failures.
4. Choice, authority, and lawful handling
Provide only information you are authorized to use. Before processing another person’s or client’s personal or tax information, you are responsible for having the necessary authority and giving any notices required for your role. You are responsible for ensuring that you have permission to use and share the records you upload, including client and supplier information.
5. Storage and security in the desktop app
The application runs on the computer where its server is started. Account and workspace data are stored in a local SQLite database (default filename taxrecon.db). Reconciliation and return workpaper data, parsed bank transactions, OCR fields and review notes persist there until removed. On the Windows desktop app, a local automatic backup is encrypted and saved under the current Windows user profile; its encryption key is protected by Windows. It is not an off-device backup and may be unavailable if that Windows profile or device is lost. The manual encrypted backup feature creates a password-encrypted file in your browser before download; VyaraRecon does not receive the backup password. You choose where to store or copy that file. Do not upload client data to a cloud drive unless your organization permits that provider. Passwords are salted and hashed; session tokens and unfinished invoice or voucher drafts are kept in browser local storage on this device. Anyone with access to the computer, browser profile, or database file may be able to access local data.
6. Sharing and service providers
VyaraRecon does not sell personal or tax data and does not use it for advertising. It does not connect to GSTN, submit returns, or directly synchronize with Tally or BUSY. Google Identity Services is loaded only if an owner-configured Google OAuth client is present. Cashfree is contacted only when the owner configures checkout; payment-provider processing is then subject to its own terms and privacy practices. If online license activation is configured, Cloudflare Pages and D1 process the license metadata described above under Cloudflare’s terms and privacy documentation. The signing private key is held as a Cloudflare secret and is not returned to customers. Other hosting, email, analytics or OCR providers should be documented here before they are enabled.
7. Browser storage and external requests
The application stores a sign-in bearer token in browser local storage so you can remain signed in. Signing out removes it from that browser. Google’s sign-in script and Cashfree’s checkout script are requested only when their corresponding features are configured or used. VyaraRecon does not intentionally use advertising trackers or analytics cookies. The local server and operating system may keep their own logs outside the application’s database.
8. Retention and deletion
Saved records remain in the local database until you remove them or delete the account. You can remove OCR captures from the Invoice inbox and request account deletion in Account & settings. Account deletion removes linked account, client/workspace, reconciliation, return-total workpaper, bookkeeping, bank-reconciliation, OCR, payment, session, and identifiable application audit records where the database links them to the account. It does not erase backup files you downloaded or copied elsewhere. The optional encrypted backup can only be restored with the password you selected; VyaraRecon cannot recover it. This does not remove operating-system backups or records separately held by identity/payment providers, nor records the operator must retain under applicable law.
9. Your choices and requests
You may access and correct data through the application where those features are available, change your password, sign out, delete OCR captures, or delete the account. For a privacy, access, correction, deletion, or complaint request, contact varun2010gupta@gmail.com and include enough information to identify the account without sending passwords or OTPs. Rights and response timelines depend on applicable law.
10. Children
VyaraRecon is designed for business and accounting workflows. Accounts are intended for adults acting in a professional or business capacity.
11. Changes and effective date
This policy is dated 25 October 2026. Material changes to data handling will be reflected here.
12. Applicable privacy law
The handling of personal data is subject to applicable privacy and consumer-protection laws. Your statutory rights remain unaffected.