Privacy

Use without saving

If you choose "Use without saving", your PDF stays in your browser. Sign sends no PDF to the server.

What the server stores

When you save and share a document, the server stores these items:

• The PDF, encrypted in your browser. Each version is a separate encrypted file.
• The file name, also encrypted.
• A fingerprint (SHA-256) of each version, and its size and time.
• The email of the person who created the document, and the email of each person who signed in when they saved a change.
• A list of events: created, saved, signed and deleted, with the email and time of each.

The server cannot read your PDF

Your browser makes a random key. It encrypts the PDF with the key before it sends the PDF. The key is in the part of the link after the # sign. Browsers never send that part to a server. So the server never has the key.

Anyone who has the full link has the key. Share the link only with people you trust.

Who can see what

• A person with the link can open the PDF, fill in fields, add text and save a new version. They do not need an account.
• Anyone with the document address, even without the part after #, can see the list of events. It shows the email and time of every person who created, saved, signed or deleted the document.
• To create a document, or to add a signature, a person must sign in. Sign checks the email through the sign-in service.

Where it runs

Sign runs on Cloudflare. The encrypted files are in Cloudflare R2 and the records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for.

Signing in

To sign in you use Google (on Google's site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on kamadorueda.com for 30 days. For details, read the sign-in section of Coro's privacy page.

What stays in your tab

Your browser keeps the key of a shared document in this tab only, so you can come back after you sign in. While you sign in, it also keeps your unsaved changes in this tab. The changes are removed when you come back. The key is removed when you close the tab.

Error reports

If the page has an error, it sends a report with the error message, page type and browser. It has no PDF, file name or account. Cloudflare keeps technical request logs, with no IP address, for 7 days.

For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location (country, region and city). It works these out from your connection. These records hold no PDF, file name or key.

How long it stays

The server deletes a document 7 days after you create it. It deletes the files at once. It deletes the records within about 1 hour after that. The person who created a document can delete it before then: the files go at once, and the records go within about 1 hour.

Your signature picture

If you draw a signature, Sign keeps the picture in your browser on this device. It is not sent to the server by itself. It is only in the encrypted PDF that you save. You can clear it at any time.

Signature record

A signature in Sign is a simple electronic signature. The download can have a last page, "Signature record". It lists the fingerprints, the times and the emails of the events.

Questions

Questions, or want your data removed? Write to kamadorueda@gmail.com.