Privacy policy

Last updated October 22, 2026

This policy covers the SealProof website (sealproof.io), the SealProof app (app.sealproof.io) and the SealProof iPhone app, run by Peak Beak LLC. The short version: your documents are encrypted on your device before they reach us, so we can't read them.

Your documents

Documents, envelope titles, field contents, signatures and folder names are encrypted in your browser or on your iPhone before they're uploaded. We store only the encrypted copies and can't read them. The keys stay with you, your teammates you share with, and your signers (in their signing links).

What we collect

• Account details: your email address, name, and optionally a company name, brand color, logo and profile photo (these appear on emails and signing pages you send).
• Signers and recipients: the names and email addresses you enter, so we can send them their links, and a signer's mobile number if you add one, so we can text them their signing link and codes.
• Signing evidence: the audit trail for each envelope. It records when a document was sent, delivered, viewed, signed or declined, and for each signer: IP address, browser and device, an approximate location worked out from the IP address (city, state and country), their time zone and device clock, how long the document was on screen and how many pages they viewed before signing, and whether their emails were delivered. It also records who later opened or downloaded the document. This is what makes a signature provable later. Locations are looked up on our own servers using DB-IP's IP geolocation data (db-ip.com); IP addresses aren't sent to anyone for this.
• In-person and ID checks (only if you use them): the kind of ID and issuing state; ID numbers and photos are encrypted like documents. Optional ID-and-selfie checks are run by Stripe Identity.
• Devices and security: the devices you're signed in on and your two-step settings.
• Billing: your plan and payment status. Card details go straight to Stripe; we never see them.
• Signer feedback (always optional): after signing, a signer can rate how easy it was and leave a comment, and we may email them once, about a day later, to ask (with an unsubscribe link). They can also tell us whether they run a business, its name, and whether they'd like to hear about SealProof. We only contact them about SealProof if they ask us to. This is about signing, never about the document.
• Requests from this site: if you ask for our vendor review packet, the details you enter.
• Abuse prevention: a salted, one-way hash of your IP address, used to rate-limit requests.
• Analytics: aggregate page views on sealproof.io via Plausible Analytics, which uses no cookies and collects no personal data.

The fingerprint demo

Files you drop into the “See a seal hold, and break” demo are hashed in your browser. They are never uploaded, and neither the file nor its fingerprint is sent to us.

How we use it

To run the service: send envelopes and emails, keep the audit trail and seals, secure your account, bill your plan and answer you when you contact us. We don't sell or rent your information, and we don't use it for advertising.

Who processes it

• Supabase hosts our database.
• Resend sends our emails.
• SignalWire (or Twilio) sends text messages, which carry the signer's mobile number and signing link or code.
• Stripe handles payments and, if you use them, photo ID checks.
• A timestamp authority (RFC 3161, currently DigiCert) and OpenTimestamps calendar servers timestamp and anchor seals. They receive only hashes, never documents or personal details.
• Cloudflare and Google (DNS-over-HTTPS) and public RDAP registries look up a business's domain when it asks to be verified.
• Amazon Web Services stores the encrypted documents and holds the key that seals completed documents.
• Apple delivers iPhone notifications, which never include document titles or contents.
• Our web hosting provider runs the website and app.
• Plausible provides cookieless analytics on sealproof.io.

Cookies

The website sets no cookies. The app uses only the cookies needed to keep you signed in and secure; there are no advertising or tracking cookies.

How long we keep it

We keep your account and envelopes while your account is open. When you close your account (in Settings, or in the iPhone app), we delete your documents and destroy their keys. The audit records that prove a signature happened are kept so the seal can still be verified. Finished envelopes (documents, keys, signer details and the audit trail) are removed 7 years after they finish; the seal is kept, reduced to its signature, so it can still be verified.

Your choices

You can ask us to access, correct or delete your information at any time by emailing privacy@sealproof.io.

Changes

If we change this policy, we'll update the date above and, for material changes, email account holders.