Privacy Policy

Who is responsible

Bino Solutions S.R.L., Str. Primaverii 17B, bl. G5, sc. A, operates SignedByAHuman and is the controller of the personal data described here. Contact us at [email protected].

What we collect

• The text you choose to sign for hosted receipts.
• A strict hash and a conservatively normalized hash of that text so harmless line-ending or trailing-space changes can be detected without ignoring punctuation or word boundaries.
• Receipt metadata such as signature type, verification methods, confidence score, timestamps, expiration date, and the signed statement used to verify the receipt.
• A salted hash of your IP address for abuse prevention and rate limiting.

Optional verification data

• Captcha: Cloudflare Turnstile may process technical and browser information to help distinguish people from bots.
• OAuth: If you connect Google or Apple, a short-lived proof stores the provider name, a salted hash of the provider account identifier, and provider-returned account fields needed to validate the flow. Your email address or profile picture is only shown publicly if you ask us to disclose it.
• Proof of payment: If you use Stripe checkout, we store payment proof records such as the tier, amount, currency, status, checkout references, and checkout link. This app does not store full card numbers.
• SMS verification: If you verify a phone number, Twilio Verify sends and checks the code. We store a keyed hash of the phone number, which cannot be turned back into the number without our secret key, and the proof status. The hash is never published. Your full phone number is only stored on the final receipt if you choose to disclose it after successful verification.
• Passkeys: If you use a passkey, we store passkey proof data such as a hash of the credential ID, the public key, authenticator or device label, timestamps, and status.

What becomes public

• The signed text for hosted receipts.
• The receipt ID, signed date, expiration date, signature type, verification methods, and verification strength data.
• The identity provider name if you use OAuth.
• Your email address, profile picture, or phone number only if you explicitly choose to disclose them.
• Payment metadata connected to a proof-of-payment signature.
• If a receipt is removed, its page shows the removal date and reason category instead of the signed text.

Reports about receipts

• If you report a receipt, we store the receipt ID, the reason and explanation you give, your name and email address if you choose to provide them, and a salted hash of your IP address for abuse prevention.
• We use this information to review the report, to decide whether to remove the receipt, and to tell you the outcome if you gave an email address. Reports are not published.

How we use information, and why

• To create, store, and verify the receipts you ask for, including the optional identity, payment, SMS, and passkey checks you choose. This is necessary to provide the service you request (GDPR Article 6(1)(b)).
• To show your email address, profile picture, or phone number on a receipt, only when you choose to disclose them. This relies on your consent (Article 6(1)(a)), which you can withdraw by asking us to remove the receipt.
• To prevent abuse, spam, fraud, and automated signing, to keep the service secure, and to review reports and remove receipts that break the content policy. This relies on our legitimate interest in a safe and lawful service (Article 6(1)(f)).
• To meet legal obligations, such as accounting and tax rules for payments and acting on notices of illegal content (Article 6(1)(c)).

Browser storage and cookies

• SignedByAHuman uses browser localStorage to remember temporary OAuth, payment, SMS, and passkey proof IDs, plus some draft settings, during the signing flow.
• Cloudflare Web Analytics measures aggregate page visits and performance without using advertising cookies. SignedByAHuman does not use this data for cross-site tracking or targeted advertising.
• Third-party services such as Stripe Checkout, Google or Apple sign-in pages, Cloudflare Turnstile, or Google Fonts may use their own cookies or similar technologies when your browser connects to them.

Retention

• Receipts are public for 365 days. After a receipt expires it is no longer shown, and its stored record is deleted the next time it is requested or, at the latest, by a daily cleanup 365 days after expiry. A receipt removed after a report is no longer shown and is deleted the same way.
• Reports are deleted 180 days after they are resolved.
• OAuth state records are stored for up to 10 minutes.
• OAuth proof records are stored for up to 5 minutes unless used sooner.
• Payment proof records are stored for up to 24 hours unless used sooner.
• SMS proof records are stored for up to 10 minutes unless used sooner.
• Passkey challenges are stored for up to 5 minutes.
• Passkey proof records are stored for up to 10 minutes unless used sooner.
• Rate-limit records are stored only as long as needed to operate abuse protections.
• Local browser storage remains on your device until the app clears it, it expires, or you clear site storage yourself.

Third-party services

SignedByAHuman currently depends on third-party services for hosting, bot checks, payment processing, SMS verification, and optional sign-in. Their privacy terms also apply when you use those parts of the product.

• Cloudflare for hosting, infrastructure, database services, aggregate Web Analytics, and the Cloudflare Turnstile Privacy Addendum for bot checks.
• Stripe for proof-of-payment checkout.
• Twilio for SMS verification.
• Google for Google sign-in and Google-hosted fonts, plus the Google Fonts privacy FAQ.
• Apple if Apple sign-in is used.

Some of these providers process data outside the European Economic Area, including in the United States. Those transfers rely on safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Your choices

• Do not sign private, confidential, or sensitive text.
• Use only the verification methods you want. Payment, OAuth, SMS, and passkeys are optional.
• Do not enable public disclosure of your email address, profile picture, or phone number unless you want those details shown on the public receipt.
• Clear your browser storage if you want to remove local draft or proof data from your device.

Your rights

You can ask us to access, correct, or delete your personal data, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected]. Most receipts are anonymous, so we may ask for details that show a receipt is yours before acting on a request.

You can also complain to a data protection authority. In Romania, that is the National Supervisory Authority for Personal Data Processing (dataprotection.ro); you can also contact the authority where you live or work.