Privacy Policy

This Privacy Policy explains how Halfstack, the operator of Signed (“Signed,” “we”), collects, uses, and protects information when you use signed.fyi (the “Service”). We aim to collect only what we need to run the Service well.

• Account data — name, email, and password (hashed), handled via our auth provider, Supabase.
• Billing data — subscription status and the last four digits / card brand of your payment method. Full card details are collected and stored by Stripe, not by us.
• Customer Data — the documents you upload to send for signature, the fields placed on them, and the completed signed versions.
• Signer data — when a sender requests your signature, we process your name and email address (provided by the sender) and, as you act on the document, your signature, the field values you enter, your IP address, browser information, and timestamps. This becomes part of the document’s audit trail, which is shared with the parties to that document.
• Usage & device data — log data, IP address, browser/device type, and product analytics (via Vercel Analytics) to understand and improve the Service.
• Support data — messages you send us at info@tryhalfstack.com.

The self-sign tool runs entirely in your browser. PDFs you open there are rendered and signed on your device and are never uploaded to our servers. If you save a signature for reuse, it’s stored locally in your browser, not with us.

• Provide, secure, and maintain the Service;
• Deliver signature requests, record the audit trail, and preserve completed documents for the parties;
• Process payments and manage subscriptions;
• Respond to support requests and send service-related notices;
• Improve features, performance, and reliability;
• Detect, prevent, and address fraud or abuse, and comply with law.

When you sign (or decline) a document as a recipient, we process your information to provide the Service to the sender and to create the legally meaningful record both parties rely on. Your signature, email, IP address, and event timestamps are embedded in that document’s audit trail and shared with the document’s parties. Questions about the underlying document — what it says, why you received it — belong with the sender. Questions about our handling of your data can come to info@tryhalfstack.com.

Where applicable, we process personal data to perform our contract with you, for our legitimate interests (e.g., securing and improving the Service, and providing the audit-trail record senders and signers rely on), to comply with legal obligations, and with your consent where required.

We don’t sell your personal data. We share it only with service providers that help us run the Service:

• Supabase — database, document storage & authentication;
• Stripe — payment processing;
• Resend — transactional email (signature requests and notifications);
• Vercel — hosting & analytics.

Documents and their audit trails are also shared with the parties to those documents — that’s the product. We may disclose information to comply with law or to protect rights, safety, and security.

We retain personal data while your account is active and as needed to provide the Service. Completed documents and their audit trails are retained so the parties can rely on them; senders control their documents and can delete them. After account closure we delete or anonymize account data within 90 days, except where we must retain it for legal, tax, or security reasons.

We use industry-standard measures including encryption in transit, row-level access controls on our database, private document storage, unique unguessable signing links, and least-privilege access. No method of transmission or storage is 100% secure, but we work to protect your information and review our practices regularly.

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact info@tryhalfstack.com. You can also access and update much of your data directly in your account settings. Note that we may be unable to alter or delete signatures and audit-trail entries embedded in other parties’ completed documents, as they exist to preserve the integrity of those records.

We and our subprocessors may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

We use essential cookies only — to keep you signed in and to operate the Service. Our analytics (Vercel Analytics) is cookieless. We don’t use advertising or cross-site tracking cookies.

The Service isn’t directed to children under 16, and we don’t knowingly collect their data.

We may update this Policy from time to time. Material changes will be notified in-app or by email, and the “last updated” date above will change.

For privacy questions or requests, contact info@tryhalfstack.com.