The Extension reads the following data from your active CoreTax browser session to enable its automation features:

This data is held in memory only during active jobs and is NEVER persisted to chrome.storage or transmitted to any external server. When the job completes or the Extension is closed, this data is discarded.

The Extension intercepts JSON API responses from CoreTax's list endpoints to enable its capture and download features. This data includes invoice numbers, document numbers, and taxpayer document details. This data is stored locally in chrome.storage.local and is never transmitted to any external server.

When you sign in using Google OAuth, the Extension stores the following authentication data locally:

Your raw email address is stored locally only and is never transmitted to our payment server. Instead, a one-way SHA-256 hash of your email (email_id) is used as your identifier. This hash cannot be reversed to reveal your original email.

When you subscribe or donate, the following data is sent to fecttral.com/api/payment/extension:

• email_id — A one-way SHA-256 hash of your Google email address. This replaces the former Device ID system and uniquely identifies your account for payment verification without revealing your actual email.
• Subscription Token — sent only during verification to confirm your subscription is active.
• Payment Type & Amount — "subscription" or "donation" and the requested amount.

We do NOT send any CoreTax data (invoices, documents, taxpayer information, access tokens, or cookies) to our payment server or any other third party.

If your account is associated with a company license, the Extension verifies your company access status through our authentication server at fecttral.com. The following data is exchanged:

• Session Token — sent as a Bearer token to authenticate the request and retrieve your company status.
• Company Status — received from the server: company name, expiry date, and active status. Cached locally and refreshed on Extension startup.

No CoreTax data is involved in this exchange. Company access status is checked on startup and periodically to ensure your access level is current.

• Collect browsing history.
• Collect data from websites other than coretax.pajak.go.id.
• Collect personal information beyond what is needed for CoreTax automation and payment processing.
• Use your data for advertising.
• Sell, rent, or share your data with third parties for marketing purposes.

The Extension includes a passive checkpoint system that saves your current filter settings (year, period, invoice number) and visual overlay state into sessionStorage on the CoreTax page. When you navigate away and return, these checkpoints are automatically restored.

This data exists only in sessionStorage (cleared when the tab closes) and is never transmitted externally.

Free (non-subscribed) users will see an interstitial image advertisement with a 15-second countdown timer before starting download jobs. These ads are served from local PNG image files bundled with the Extension — they do not contact any ad network, tracker, or external server. No personal data is collected or transmitted during ad display. Ad links point to coretax-console.fecttral.com but no data is sent to that domain.

• CoreTax session data is held in memory only, not persisted to disk.
• Payment server communication uses HTTPS encryption.
• Webhook signatures are verified using RSA-SHA256.
• Spreadsheet cell values are sanitized to prevent formula injection attacks.

• You may clear all locally stored data at any time by uninstalling the Extension or clearing Extension data in Chrome settings.
• You may request deletion of your payment records by contacting us through the Chrome Web Store listing support channel.
• Subscription can be cancelled at any time; no further charges will be made after the current period expires.

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated effective date. Continued use of the Extension after changes constitutes acceptance of the updated policy.

For privacy-related questions or concerns, please contact the developer through the Chrome Web Store listing support channel.