SignedBy
Privacy Policy
Version 1, effective
SignedBy (https://signedby.email) is a free email signature builder run by Luis Urrutia, an individual based in Chile ("we" or "us"). We are the controller of the personal data described here. This policy explains what data SignedBy handles, why, who processes it for us, and the rights you have. Questions and requests go to support@signedby.email.
In short
- The signature you design stays in your browser. We do not receive it.
- Images you publish with a signature are public, so that your recipients' email apps can show them.
- An account is optional. If you sign in, we keep your email address and an identifier for your account.
- We show no ads, set no tracking cookies, and do not sell or share your data for advertising.
What we handle and why
Your signature
The details you enter, such as your name, job title, phone numbers, email address, links, and images, are saved in your browser's local storage, so that they are still there when you come back. They are not sent to us. Copying, installing, and downloading a signature all happen in your browser.
Images you publish
Email apps show a signature's images only when they are hosted online. When you copy a signature with a photo, logo, or other image, your browser uploads a resized copy, and the signature links to it at https://img.signedby.email. We store it with Cloudflare R2 under a fingerprint of its content, together with a fingerprint of the image it was made from, so the same image is not uploaded twice.
- Published images are public: anyone with an image's link can open it. That is how your recipients see it.
- We keep published images so that the emails you have already sent keep showing them. To have an image removed, send us its link. Removing an image also removes it from emails already sent.
- Uploading needs an upload key, which your browser saves locally and never puts in the signature.
We handle these images to provide the service you ask for. Take care with photos of other people and with logos you do not own; our Terms of Service cover what you may upload.
Your account
Signing in is optional. Clerk runs sign-in for us, with your email address or with an account at Microsoft or, when we offer it, Google. To sign you in and keep you signed in, Clerk processes your email address, the name and profile picture your sign-in provider shares, identifiers for your account and sessions, and your IP address and browser details to protect accounts from abuse. Our database, run by Convex, stores your email address and your account's identifier.
If you sign in with Google, we receive your name, email address, and profile picture (the OpenID Connect
openid, email, and profile scopes), and use them only to create and identify
your SignedBy account. We do not use Google user data for advertising, do not sell it, and share it only with
Clerk and Convex, which process it for us. Our use of information received from Google APIs adheres to the
Google API Services User Data Policy,
including the Limited Use requirements. Microsoft and Google handle your sign-in with them under their own
privacy policies.
Visiting the site
Cloudflare hosts SignedBy. Like any web server, it processes your IP address, your browser's user agent, and the pages you request, in order to deliver them and protect the site from attacks. We count visits with Cloudflare Web Analytics, which stores nothing in your browser, does not fingerprint you, and discards your IP address. It records the page, the referring site, your country, device type, browser, and how fast the page loaded.
Writing to us
Messages to support@signedby.email are forwarded to our mailbox through Cloudflare Email Routing. We use them to answer you, and keep them as long as we need to follow up.
Where the data comes from
From you, from your browser, and, if you sign in with Microsoft or Google, from that provider. We make no decisions about you based solely on automated processing.
Legal bases
Where a law such as the EU's General Data Protection Regulation asks for a legal basis, ours are:
- Performing our agreement with you: running your account and hosting the images you publish.
- Our legitimate interests: keeping the service secure and free of abuse, keeping published images available to the emails that use them, and counting visits without identifying you.
- Your consent, when we ask for it; you can withdraw it at any time.
Cookies and local storage
-
SignedBy sets no advertising or analytics cookies. The cookies it uses are strictly necessary for signing in:
Clerk sets
__clienton clerk.signedby.email,__client_uaton signedby.email, and__sessionon signedby.email once you sign in, and Cloudflare sets__cf_bmand_cfuvidon clerk.signedby.email to tell people from bots. None of them track you across sites. - Your browser's local storage keeps your signature, whether you dismissed the editing tip, and the upload key if you entered one. Clearing the site's data in your browser removes them.
Who processes your data
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, image storage, visit counts, and email forwarding | Cloudflare's global network; a United States company |
| Clerk, Inc. | Sign-in and account security | United States, on Google Cloud and Cloudflare |
| Convex, Inc. | Account database | United States, on AWS in Northern Virginia |
These providers process data on our behalf and under our instructions. We do not sell personal data. We disclose it to others only when the law requires it.
International transfers
We are in Chile, and our providers process data mainly in the United States, under data processing agreements that bind them to protect it. For data about people in the European Economic Area, the United Kingdom, or Switzerland, Cloudflare and Clerk are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and Convex relies on the standard contractual clauses approved by the European Commission.
How long we keep data
- Your signature: in your browser, until you clear the site's data or choose Start over.
- Published images: until you ask us to remove them.
- Your account: until you ask us to delete it. Write to us from the address you sign in with, and we delete it from Clerk and from our database within 30 days.
- Messages to support: as long as we need them to answer you and keep a record of the request.
Your rights
You can ask us to tell you what personal data we hold about you and to give you a copy, and to correct, delete, or block it. You can object to how we use it, ask us to restrict that use, ask for your data in a portable format, and withdraw consent you gave. Write to support@signedby.email. We may ask you to confirm that the account is yours, and we answer within the time the law where you live sets. We honor these requests wherever you live.
If you are in Chile, Law 19,628 on the protection of private life guarantees access, correction, deletion, and blocking today. Law 21,719, which amends it and is scheduled to take effect on December 1, 2026, adds objection and portability and lets you complain to the Agencia de Protección de Datos Personales. If you are in the European Economic Area or the United Kingdom, your rights come from the General Data Protection Regulation, and you can complain to the data protection authority where you live.
Children
SignedBy is not meant for children under 16, and we do not knowingly collect their data.
Security
All connections to SignedBy use HTTPS. Uploads need an upload key, and only signed-in users can reach their account data. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Changes to this policy
When we change this policy, we publish a new version with its date. If a change is significant, we say so on the site and email account holders before it takes effect.