Signhoot Inc. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by Signhoot Inc. This Privacy Policy applies to our website, mobile applications, and their associated subdomains (collectively, our "Service"). By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy.

1. Information We Collect

1.1. Personal Data

When you use our Service, we may collect the following personal information from you:

Contact information (such as email address)
Account credentials (such as username or nickname — real name is never required)
Optional profile information (such as first name, last name — clearly labeled as optional)
Billing information (processed securely by our payment provider; we do not store full credit card numbers)
User content (such as documents uploaded, signatures, form responses)

1.2. Usage Data

We automatically collect certain information when you visit, use, or navigate the Service. This information does not reveal your specific identity but may include:

Device and usage information (such as IP address, browser type, operating system, device model)
Log data (such as access times, pages viewed, time spent on pages)
General location information (based on IP address — we do not collect precise GPS location)
App interaction data (features used, actions taken) — only if you opt in to share analytics

1.3. Data We Do NOT Collect

We do not collect or access:

Precise geolocation data
Contacts or address book data
Photos or camera data (except documents you explicitly upload)
Health or fitness data
Financial data beyond what you provide for billing
Browsing history outside our Service
Search history outside our Service

2. How We Use Your Information

We use the information we collect for the following purposes:

Service delivery: Providing, maintaining, and improving our Service to you
Transactions: Processing and completing transactions, including document signing and subscription management
Communications: Sending transactional messages (signing requests, confirmations, security alerts)
Marketing: Sending promotional communications only if you have opted in via your account settings — you can opt out at any time
Analytics: Monitoring trends, usage, and activities — only for users who opt in via the "Share Analytics" setting
Security: Detecting, investigating, and preventing fraudulent transactions and other illegal activities
Legal compliance: Responding to lawful requests from public authorities

3. Third-Party Services and SDKs

Our Service integrates with the following third-party services, each of which has its own privacy policy:

Supabase — Authentication, database, and serverless functions (Privacy Policy)
Stripe — Payment processing for subscriptions and billing (Privacy Policy)
Mailjet — Transactional and marketing email delivery (Privacy Policy)
Cloudflare R2 — Secure object storage for signed documents (Privacy Policy)
AWS KMS — Key management for zero-knowledge encryption (Privacy Policy)
Third-party AI processing providers — AI-powered document generation and analysis (document content may be sent for processing under data processing terms)
Apple App Store — In-app purchase processing and subscription management (Privacy Policy)

We share only the minimum data necessary for each service to function. No third-party service has access to your zero-knowledge encrypted content.

3a. App Tracking Transparency (Apple App Store)

Signhoot does not track you. We do not use the iOS AppTrackingTransparency framework because we do not link user or device data collected in our app with third-party data for advertising or measurement purposes, and we do not share user or device data with data brokers. We do not use third-party advertising SDKs, cross-app analytics SDKs, or fingerprinting techniques. Because we do not track, the iOS "Allow App to Track" prompt is not shown.

3b. App Privacy — Data Types (Apple "Nutrition Label")

Below is a plain-English summary of the data categories Signhoot collects, matching the disclosures in our App Store listing. All items are used only for App Functionality, Account Management, or Analytics (opt-in). None are used for Tracking or Third-Party Advertising.

Contact Info — Email address. Linked to identity. Used for account creation, authentication, and transactional communications.
User Content — Documents, signatures, and template content you upload or create. Linked to identity. Used for App Functionality only. Signatures and sensitive content are protected with zero-knowledge encryption.
Identifiers — A user ID generated by our authentication provider. Linked to identity. Used for App Functionality only. We do not collect Advertising Identifiers (IDFA).
Usage Data — Product interaction data such as feature usage and page views. Not linked to identity when Analytics is disabled; linked to identity only if you opt in to Share Analytics. Used for Analytics and Product Personalization.
Diagnostics — Crash and performance logs. Not linked to identity. Used solely to keep the app stable.
Purchases — Purchase history for subscription entitlements (managed by Apple / RevenueCat). Linked to identity. Used for App Functionality. We never receive your payment card number.

We do not collect: precise location, coarse location beyond IP-derived country, contacts, photos or media (except documents you explicitly upload), health & fitness, financial info beyond billing metadata, sensitive info, browsing history outside our Service, search history outside our Service, or audio data.

3c. In-App Purchases and Subscriptions (Apple App Store)

On iOS, subscriptions are sold and processed by Apple via In-App Purchase and are subject to the Apple Standard EULA unless a custom EULA is provided in our Terms of Service. Subscription price, currency, and billing period are shown before purchase and again on the Pricing screen. Subscriptions auto-renew unless auto-renew is turned off at least 24 hours before the end of the current period. You can manage or cancel your subscription at any time in iOS Settings → [your name] → Subscriptions. Signhoot cannot cancel App Store subscriptions on your behalf. Any unused portion of a free trial (if offered) is forfeited when a paid subscription is purchased. Refunds, when applicable, are handled by Apple.

4. Zero-Knowledge Encryption

Signhoot employs a zero-knowledge encryption architecture for your document signatures and sensitive content. This means:

Your document contents and signatures are encrypted on your device before being sent to our servers
The encryption keys are generated and stored only on your device
We cannot access or view the contents of your encrypted documents or signatures
Even in the event of a legal request, we cannot provide decrypted access to your documents or signatures as we do not possess the encryption keys

This provides an additional layer of security and privacy for your most sensitive information. However, please note that certain account and metadata information (such as file names, timestamps, and account details) is not encrypted in this manner to enable the basic functionality of the service.

5. Sharing Your Information

We may share the information we collect in the following circumstances:

With vendors, consultants, and other service providers who need access to such information to carry out work on our behalf (see Section 3 above)
In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation, or legal process
If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property, and safety of Signhoot Inc. or others
In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company
With your consent or at your direction (e.g., when you send a signing request to a recipient)

We do not sell your personal information to third parties. We do not use your data for third-party advertising.

6. Your Rights and Choices

You have the following rights regarding your personal information:

Access and correction: View and update your personal information by logging into your account settings
Marketing opt-out: Opt out of marketing communications at any time via your account settings or by following the unsubscribe link in any promotional email
Analytics opt-out: Disable the "Share Analytics" toggle in your account settings to stop all usage analytics collection
Data portability: Request a copy of your personal data
Restriction: Request restriction of the processing of your personal data
Account deletion: You may permanently delete your account and all associated data at any time through Dashboard → Settings → "Delete Account." This action is irreversible and removes all documents, signatures, templates, usage history, and profile data from our servers

7. Account Deletion and Data Removal

In accordance with Apple App Store guidelines and applicable privacy regulations, we provide a straightforward account deletion mechanism:

Navigate to Dashboard → Settings → Danger Zone → Delete Account
You will be asked to confirm by typing "DELETE"
Upon confirmation, the following data is permanently removed:
- All documents and templates you created
- All saved signatures
- All signing requests (sent and received)
- Usage quotas and history (AI, email validation, bank statement conversions)
- Support conversations
- Your user profile and authentication credentials
A minimal record (email, account tier, and aggregate counts) is retained in our deleted accounts log for fraud prevention and legal compliance for up to 30 days, after which it is permanently purged
If you have an active subscription purchased via the Apple App Store, you must also cancel it through your Apple ID settings — we cannot cancel App Store subscriptions on your behalf

8. Data Security

We take the security of your information seriously and use appropriate technical and organizational measures to protect your personal information, including:

Zero-knowledge encryption for signatures and sensitive document content
TLS/SSL encryption for all data in transit
Row-level security policies on our database to isolate user data
Rate-limiting on sensitive API endpoints
Regular security audits

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

9. Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy:

Active accounts: Data is retained while your account remains active
Deleted accounts: All user data is deleted immediately upon account deletion, except for a minimal audit record retained for up to 30 days
Dormant accounts: Accounts inactive for over 3 months may be flagged as dormant; you will be notified before any data is removed
Legal obligations: Certain data may be retained longer if required to comply with legal obligations, resolve disputes, or enforce our agreements

10. Children's Privacy

Our Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under the applicable minimum age, we will promptly delete that information. If you believe we have inadvertently collected such data, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure your personal information remains protected in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and, where required, sending you an email notification. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact us at:

Signhoot Inc.
Email: privacy@signhoot.com
Address: 472 Amherst St. Unit 727173, Nashua, New Hampshire 03063, United States