Privacy policy
Summary
Last updated 2026-11-15. DulySigned collects what it needs to get documents signed and to prove who signed them. It does not sell your data or show ads. Questions go to support@dulysigned.app.
What we collect
Your account: your email address. Sign-in codes are stored only as a hash and expire after a few minutes. If you sign in with Google, Google tells us your email address and that it has verified it. We ask Google for nothing else.
Your documents: the PDFs you upload, the edits you make, and the signed copies.
People you send to: the names and email addresses you enter, and the contacts and groups you save.
The signing record: for each step (opened, code checked, signed, declined), the time, the IP address, the browser's user agent, and how the person was confirmed. This record becomes the certificate page of the signed PDF.
Email delivery: for each email we send, the kind of email, the address, and whether it was delivered, delayed or bounced. We do not keep the email text. Addresses that bounce permanently or report our email as spam go on a block list, so we stop sending to them.
Product use: pages you open and buttons you click in DulySigned, through PostHog. In the app, PostHog may record sessions with all text and form inputs masked. Signing pages are never recorded.
Your answer to "How did you hear about DulySigned?", if you give one.
Why we use it
To run the service: store documents, send sign-in codes, invitations and signed copies, and build the audit certificate.
To stop abuse: bot checks, rate limits and the email code that confirms each signer.
To improve DulySigned: we look at how features are used. We do not use your documents for this.
Who processes it for us
Cloudflare hosts DulySigned and stores the database and files. It also sends our email and runs the Turnstile bot check.
Resend sends our email only when Cloudflare email is not available.
A timestamp service (for example DigiCert) gets only a hash of the seal on a signed PDF, never the document or any names.
When you check a signed PDF on /verify, your browser sends only the file's fingerprint (SHA-256), never the file.
PostHog stores product analytics.
Google (Gemini API) processes text only when you use an AI feature in templates: the document text and the message you type are sent to Google to get a reply. Signers never interact with the AI, and the signing record is never sent to it.
If you connect DulySigned to an AI assistant
You can connect DulySigned to an AI assistant such as ChatGPT or Claude. You approve each connection on a DulySigned page while you are signed in. DulySigned then gives that assistant an access token that acts as you. The token lasts one hour and the assistant renews it for up to 30 days.
The assistant can read your template list and texts, the titles of your saved templates, the titles, states, settings, recipient names and email addresses of your envelopes, the time, type and actor of each audit event, your contacts (name, email address, company), and your plan name and usage. When you ask it to, it can create drafts from templates or from text you give it, change and delete drafts, send envelopes, send one document to many people, correct a recipient, send reminders, void envelopes, save a template and save a contact. It cannot download your PDFs, signed copies or certificates.
DulySigned uses what the assistant sends, such as the details for a document, only to do what you asked. What DulySigned returns goes to the company that runs the assistant (for example OpenAI or Anthropic), which handles it under its own privacy policy.
DulySigned stores each connection (the app, your account, the approved access) on Cloudflare, with tokens stored only as hashes. Product analytics records the name of each action and the app that asked, never the details or document text. To stop an assistant, disconnect DulySigned in that assistant's settings. To end every connection at once, write to us.
If someone sent you a document
The sender controls the document and decides who gets it. DulySigned records your name, email address, IP address, browser and the times you took each step, because that record is the proof of signing. It is part of the signed PDF that every party receives.
Cookies and similar storage
sk_session keeps you signed in for up to 30 days. sk_sign keeps a signing session open while you sign. sk_file keeps a download page open for one hour after you confirm your email code. Cookies whose names start with __Host-oauth- last 10 minutes while you approve an AI assistant connection. PostHog uses a cookie and local storage to count visits and sessions.
Free tools
The signature generator and the PDF hash checker run in your browser. Your name, drawing and files are not sent to DulySigned.
How long we keep it
We keep your account data while your account is open. To delete your account and documents, email us from the address you sign in with. Signed copies that were already emailed to other parties stay with them, and a signing record inside a signed PDF cannot be changed.
Your choices and rights
You can ask for a copy of your data, a correction, or deletion. Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023 or the EU GDPR may give you these rights. Write to support@dulysigned.app.
Security
DulySigned uses HTTPS everywhere. Files and data are stored on Cloudflare, which encrypts them at rest. Report a security problem to security@dulysigned.app.
Changes
When this policy changes, we update this page and the date at the top.