Privacy Policy

Last updated: 18 July 2026

Credentials Manager is a browser extension and web application, operated by UKS Associates (“we”, “us”), that helps chartered-accountancy firms autofill their clients’ login credentials on Indian government portals (Income Tax, GST, TDS TRACES and MCA) from a Google Sheet the firm controls. This policy explains what data the extension and web app handle, and what they do not.

The short version

Your clients’ usernames and passwords live in your own Google Sheet. The extension reads them (through our server) only to fill the login form on the matching government portal in your browser, and writes them back only when you ask it to (adding a client, or confirming a changed password). We do not sell your data, we do not use it for advertising, and we do not share it with anyone outside the flow described below.

Information we handle

Account information. When you sign up, we store your email address, a hashed password (via our authentication provider, Supabase), your firm/organisation name, your role (admin or sub-user), and your plan. This is used to sign you in, group your team, and control who may access what.

Client login credentials (authentication information). The usernames and passwords for your clients’ government-portal logins are stored in a Google Sheet that you create and own. To fill a form or save a change, the extension asks our server to read from — or write to — that sheet on your behalf. Credentials are transmitted over encrypted connections (HTTPS) and are used solely to autofill the corresponding portal in your browser. We do not retain a separate long-term copy of your clients’ passwords for our own purposes; the Google Sheet remains the source of truth.

Locally stored data. The extension keeps a small amount of data in your browser’s local storage: your current sign-in session, the details of the last credential you filled (so it can detect a password change), and any pending “update the sheet” or “add this client” prompt awaiting your confirmation. This never leaves your browser except to perform an action you initiate.

Usage timestamps. We may record when a user was last active, so a firm’s admin can manage their team. We do not track your browsing on the government portals or anywhere else.

How the extension uses its permissions

Host access to the government portals (incometax.gov.in, gst.gov.in, tdscpc.gov.in, mca.gov.in) — to detect their login forms and fill the correct fields.
Host access to our own web app and authentication provider — to read your sign-in session and load your client list.
Cookies — to read your Credentials Manager sign-in session so the extension mirrors whether you are logged in on the web app.
Storage — to keep the session and pending prompts described above.
Active tab & scripting — to fill the login form on the portal page you have open.

What we do not do

We do not sell or rent your data. We do not use it for advertising or for any purpose unrelated to providing this service. We do not read the content of pages other than to locate the login fields on the supported government portals. We do not transfer your data to third parties except the infrastructure providers strictly needed to run the service (see below).

Service providers

We rely on Supabase (authentication and account database), Vercel (application hosting), and Google Sheets (your credential store, which you own and share with our service account so it can read and write on your behalf). These providers process data only to operate the service.

Data retention and deletion

Your account information is kept for as long as your organisation uses the service. Your clients’ credentials live in your Google Sheet and are deleted whenever you delete them there. To close your account and have your account information removed, contact us at the address below.

Your control

A firm’s admin approves every user and can revoke any user’s access at any time. Signing out of the web app immediately signs the extension out as well. You can uninstall the extension at any time to stop all local processing.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.

Contact

Questions about this policy or your data? Email uksassociates169390@gmail.com.