Is it safe? Security and privacy

#Your data stays on your computer

• Saved as files on your PC. Every invoice, client, product, payment and setting is a file in the _system\data folder inside the app's folder. Saved invoice PDFs go in the Saved Invoices folder next to it.
• No account, no login, no signup. The app never asks for an email address or a password to use it.
• No cloud server. We do not run a server that holds your books. There is nothing of yours on our side to leak or to lose.
• Google Drive only if you set it up. If you choose to connect your own Google Drive (Settings → Google Drive), copies of your invoice PDFs and backups go to your Drive. Nothing goes there until you do. See Google Drive.

One honest limit: the data files are not encrypted. Anyone who can sign in to your Windows or Mac account can open that folder, the same as your other documents. Protect the computer with its own password, and see What you should do.

#It works without internet

Everything you do day to day works offline: making and printing invoices, PDFs, payments, stock, purchases, expenses, reports, GSTR-1 and GSTR-3B files, backups, and reading a supplier's bill from a photo (OCR). The app runs on your computer and opens in your browser, but it is not a website.

Internet is needed only to install the app, to update it, and for the optional things listed below. When you are offline the app simply skips them; your work is not affected. Everything the app needs to run, even its font, is inside the app folder.

#Offline mode: never go online by itself

Click the Wi-Fi button at the top right of any screen and then Turn Offline mode on, or tick Offline mode in Settings → Privacy & internet. The button turns orange, with a line through it, while it is on. From then on the app makes no internet connection by itself:

• no automatic check for a new version;
• no reading of the supporters list;
• no automatic copy of each invoice PDF to Google Drive.

Things you click still work when you click them: Check for Updates and Update, the ? help pages, Report, WhatsApp and other links, and Save to Drive. The setting is kept in the app's data folder, so the app's own server obeys it too. The same card lists everything that uses the internet, and when.

#Every address the app connects to

This is the complete list. Apart from these, the app talks only to itself on your own computer.

By itself, while the app is open

Offline mode stops both of these.

Only when you do something

There is nothing else: no analytics service, no advertising network, no error-tracking service, and no server of ours that receives your data.

For IT people: the app's Content Security Policy (in src/index.html) limits what the page may load or contact to the addresses above. The update check is made by the app's own server (/api/check-update in server.js); the supporters list and Google Drive are called from the page.

#No tracking, no ads, nothing sent to us

• No analytics. The app does not count your clicks, screens or invoices, and does not report how you use it.
• No ads, and no paid version that unlocks features.
• No data sent to us. We never see your invoices, clients, amounts, GSTIN or bank details. We do not even know how many people use the app.

#Why is it free? What is the catch?

There is no catch, and your data is not the product.

• It stays free, forever. There will be no paid version, no locked features, no ads and no tracking. And because the code is open source under the MIT licence, the app you have today can always be used, copied and kept by anyone, even if we stopped working on it. Nobody can take it away or start charging you for it.
• It costs very little to keep going. The app runs on your computer, so there are no servers and no cloud bills for us to pay.
• How we earn. Free GST Billing is made by DiceCodes, a small software company in India. We earn from paid work for businesses that want it (custom features, setup and moving data in, support plans) and from people who choose to support the project. See Support & About.
• Tracking you would gain us nothing. We do not sell ads or data, so there is nothing to collect. Collecting your data would also break the one promise the app is built on.
• The code is public, so this can be checked, not just believed.

#Other computers cannot open it

The app has a small built-in server that your browser talks to. It listens only on this computer's own internal address, 127.0.0.1, so other computers on your Wi-Fi or office network cannot open the app or read your data.

It also refuses requests from other websites: a web page you visit cannot quietly read your books from the app in the background.

This is also why several people cannot use it from different computers at the same time. See Several people, or several computers.

#Check it yourself

You don't have to trust what we write. Any of these takes a few minutes and needs no technical skill except the last two.

1. Switch the internet off. Turn off Wi-Fi (or unplug the cable), close the app and open it again. Make an invoice, download its PDF, print it, record a payment and open Reports. Everything works. That is because nothing the app does with your books needs the internet.
2. Turn on Offline mode (above) and leave it on. The app then goes online only when you click something that needs it.
3. Watch its connections. On Windows, open Resource Monitor (press Windows key + R, type resmon, press Enter), open the Network tab and look at node.exe, the program the app runs on. With Offline mode on, it has no connections outside your computer. On a Mac, use Activity Monitor's Network tab. Your browser is listed separately: the app's page uses it only for the things in the list above.
4. Block it in the firewall. In Windows Defender Firewall's Advanced settings, add an Outbound rule that blocks the app's node.exe (in the app folder's _system\node folder, or C:\Program Files\nodejs). The app keeps working; only the update check stops. Remove the rule to update.

#What "open source" means here

Open source means the full program code is public. Free GST Billing's code is on GitHub under the MIT licence. Anyone (you, your IT person, a developer friend, a security researcher) can read every line and see exactly what it does. Nothing is hidden.

That is the opposite of a risk: a closed program asks you to trust it, while this one lets you check it. Many people look at the code, and problems they find are reported in public.

How a careful user can check

• Read the code. The places to look: server.js (the built-in server, and the only outgoing call it makes: the update check), src/ (the screens), src/index.html (the list of addresses the page may contact), and install.ps1 / install.sh (the install line).
• Read the install line before running it. Open the address in the install line in your browser: it is a plain text script you can read.
• Watch the network. Your IT person can watch the computer's connections while the app runs and compare them with the list above.
• Build it yourself. The release ZIP is made from this same public code with one command, npm run release:zip. A developer can run the app straight from the code (npm install, then npm start) instead of using our ZIP.

#Is the install safe?

• No administrator rights. The install line puts the app in your own user folder (Windows: %LOCALAPPDATA%\Programs\Free GST Billing; Mac: Applications in your home folder). It does not change Windows system files, add a Windows service or ask for an admin password.
• From the official place only. The install line downloads the script and the app from this project's own GitHub page, over a secure (HTTPS) connection.
• Your data is never touched. Installing over an existing copy backs up your data to Documents\FreeGSTBill Backups first and replaces only the app's own files.

Why Windows or the Mac may show a warning for the ZIP

The app is not code-signed. A signing certificate costs a few hundred dollars every year, and this app is free. So when you open the downloaded ZIP's launcher, Windows may show "Windows protected your PC" and a Mac may say it cannot check the app. That message means "this program is not signed by a paid certificate". It does not mean a virus was found. See "Windows protected your PC".

The one-line install shows no such warning because Windows and macOS put that check only on files marked as downloaded from the internet. Browsers add that mark; PowerShell and Terminal, which the install line uses, do not. It is not because the app was approved or certified by Microsoft or Apple; it was not.

#Backups and the PIN lock

• Daily automatic backups. Every day the app copies all your data into a dated backup and keeps the last 30 days. See Daily backups.
• A copy on another drive. Choose a second folder (another drive, a USB disk, a synced folder) and every daily backup is copied there too, so a failed hard disk does not take your books with it. See Keeping a copy somewhere else.
• Before every update, the installer and the updater back up your data first.
• PIN lock (optional). On a computer others use, turn on a 6 or 8 digit PIN in Settings → App lock. The PIN is stored only as a scrambled check value (a salted hash), never as the digits, and after five wrong tries in a row it makes you wait 30 seconds. It locks the app's screens; it does not encrypt the files. See App lock.

#Problem reports

When something goes wrong, the app notes it in the Problem log on your computer. Nothing is sent anywhere by itself.

Only when you click Report does it open a GitHub problem form in your browser, filled in with the error and your app, browser and computer type. Before that, private details are removed: GSTIN, PAN, phone numbers, email addresses, UPI IDs, IFSC codes, long numbers such as bank account numbers, and your Windows user name. You see the form before anything is posted, and it is posted only if you submit it on GitHub.

#Updates and security fixes

• Regular updates. A new version usually comes out every Saturday, with urgent fixes sooner. The app tells you when one is ready; see Updating.
• Watched for known problems. GitHub's security alerts (Dependabot) watch the code libraries the app uses, and a known security problem in one of them is fixed in an update.
• Only what the app needs. The download contains the built app and only the packages its server needs to run. Developer tools are left out.

#What you should do

• Download only from the official places: this project's GitHub page or the install line on these pages (dicecodes.com). Copies on other websites, on YouTube links or forwarded on WhatsApp are not ours and may have been changed.
• Keep Windows or macOS up to date, and keep its built-in antivirus on.
• Put a password on your computer account, and turn on the app's PIN lock if others use the same PC.
• Keep a backup copy on another drive or a USB disk (see Keeping a copy somewhere else).
• Keep the app updated: click Update when it tells you a new version is ready.

#Found a security problem?

Please report it privately, not in a public issue, so it can be fixed before anyone misuses it:

• GitHub private report (preferred): the Report a vulnerability button on the project's Security tab.
• Email: Contact@dicecodes.com with SECURITY in the subject.

Use made-up data when you describe it, never real invoices or GSTINs. The full policy is in SECURITY.md.