Privacy policy
Summary
Last updated 2026-11-08. SignKaro collects what it needs to get documents signed and to prove who signed them. It does not sell your data or show ads. Questions go to support@signkaro.org.
What we collect
Your account: your email address. Sign-in codes are stored only as a hash and expire after a few minutes. If you sign in with Google, Google tells us your email address and that it has verified it. We ask Google for nothing else.
Your documents: the PDFs you upload, the edits you make, and the signed copies.
People you send to: the names and email addresses you enter, and the contacts and groups you save.
The signing record: for each step (opened, code checked, signed, declined), the time, the IP address, the browser's user agent, and how the person was confirmed. This record becomes the certificate page of the signed PDF.
Email delivery: for each email we send, the kind of email, the address, and whether it was delivered, delayed or bounced. We do not keep the email text. Addresses that bounce permanently or report our email as spam go on a block list, so we stop sending to them.
Product use: pages you open and buttons you click in SignKaro, through PostHog. In the app, PostHog may record sessions with all text and form inputs masked. Signing pages are never recorded.
Your answer to "How did you hear about SignKaro?", if you give one.
Why we use it
To run the service: store documents, send sign-in codes, invitations and signed copies, and build the audit certificate.
To stop abuse: bot checks, rate limits and the email code that confirms each signer.
To improve SignKaro: we look at how features are used. We do not use your documents for this.
Who processes it for us
Cloudflare hosts SignKaro and stores the database and files. It also sends our email and runs the Turnstile bot check.
Resend sends our email only when Cloudflare email is not available.
A timestamp service (for example DigiCert) gets only a hash of the seal on a signed PDF, never the document or any names.
When you check a signed PDF on /verify, your browser sends only the file's fingerprint (SHA-256), never the file.
PostHog stores product analytics.
OpenAI processes text only when you use an AI feature in templates: the document text and the message you type are sent to OpenAI to get a reply. Signers never interact with the AI, and the signing record is never sent to it.
If someone sent you a document
The sender controls the document and decides who gets it. SignKaro records your name, email address, IP address, browser and the times you took each step, because that record is the proof of signing. It is part of the signed PDF that every party receives.
Cookies and similar storage
sk_session keeps you signed in for up to 30 days. sk_sign keeps a signing session open while you sign. sk_file keeps a download page open for one hour after you confirm your email code. PostHog uses a cookie and local storage to count visits and sessions.
Free tools
The signature generator and the PDF hash checker run in your browser. Your name, drawing and files are not sent to SignKaro.
How long we keep it
We keep your account data while your account is open. To delete your account and documents, email us from the address you sign in with. Signed copies that were already emailed to other parties stay with them, and a signing record inside a signed PDF cannot be changed.
Your choices and rights
You can ask for a copy of your data, a correction, or deletion. Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023 or the EU GDPR may give you these rights. Write to support@signkaro.org.
Security
SignKaro uses HTTPS everywhere. Files and data are stored on Cloudflare, which encrypts them at rest. Report a security problem to security@signkaro.org.
Changes
When this policy changes, we update this page and the date at the top.