SIGNCOMET
Privacy policy
Last updated: October 15, 2026
How SignComet handles account information, encrypted documents, Google sign-in, optional AI, cookies and privacy requests.
About this policy
This policy describes how SignComet handles information when you visit signcomet.com, create an account, send or sign documents, or contact us. Contact SignComet at hello@signcomet.com for privacy questions and requests. Document senders also decide what information to include in their documents and whom to invite; ask the sender about their own purposes and obligations.
Information we handle
We handle account names, email addresses, authentication identifiers, profile details you supply, and account/security settings. We process uploaded documents, signatures, field values, recipient details, document status, timestamps, integrity proofs and activity records to operate signing workflows. Contact forms and support emails contain the information you submit. Network addresses and request information are processed to deliver the service, limit abuse and protect accounts. Please include only information needed for your document or request.
Google sign-in
If you choose Google sign-in, Google and our authentication provider, Supabase, supply basic identity information such as your Google account identifier, name, email address and available profile picture. We use it to authenticate you and manage your SignComet account. Google sign-in does not give SignComet access to your Gmail messages, Google Drive files, contacts or calendar. You can revoke access in your Google Account connections settings; revoking access does not itself delete SignComet records. Information received through Google APIs is used in accordance with the Google API Services User Data Policy, including its Limited Use requirements where applicable.
Documents and encryption
Document content and saved signatures are encrypted for storage. Your browser unlocks protected content using your vault credentials. Account, routing and activity metadata are needed to operate the service and are not all encrypted with your vault key. Some invitation workflows use temporary service-held access material to grant access to invited recipients. Do not interpret encryption as a guarantee that no service component ever handles access material. Protect your account, vault passphrase, recovery kit and shared links. We cannot guarantee absolute security.
Local tools and optional Gemini
Quick signing and on-device reading tools process PDFs on your device without uploading the PDF for those features. Optional Gemini explanations are separate: when you enable and submit an eligible request, the original PDF and your question pass through our server to Google Gemini, and its response returns to you. Senders control whether recipients can use this option. Do not submit information you lack permission to share. Turning the feature off cannot retrieve information already sent. Google processes those requests under its applicable Gemini API terms. AI answers can be incorrect and are not legal advice.
Why we process information
We use information to provide accounts and document workflows, deliver invitations and recovery messages, preserve agreement evidence, respond to requests, prevent abuse and meet applicable obligations. Where a legal basis is required, processing may be necessary to provide the requested service, support legitimate security and operational interests, meet legal obligations, or follow your consent for optional features. You may withdraw consent for future optional processing without undoing processing already completed.
Service providers and recipients
Oracle Cloud hosts the application; Supabase provides authentication, database and object storage; Brevo delivers transactional emails; Hostinger provides our domain and support mailbox; Google provides sign-in and optional Gemini processing. Providers receive information necessary for their services. Other participants receive the documents and information you share with them. We may disclose information when required by applicable law or necessary to investigate abuse and protect rights. SignComet does not sell personal information or use Google account data for advertising. Providers may process information outside your country; our current application and database infrastructure is in the United States.
Cookies, browser storage and email activity
We use essential session cookies and browser storage for sign-in, security, preferences and enabled local features such as easier vault unlock. Clearing this storage may sign you out or remove device-specific settings. With your permission, Google Analytics measures visits to our homepage, privacy policy, terms and user guide. It does not run in the workspace or signing pages. Google may process browser and device information, approximate location and cookie identifiers. We send public page addresses without query strings or fragments, and do not send document content, account identifiers or form entries. Analytics cookies last up to 90 days. Optional analytics stays off until you choose Allow analytics; you can decline or withdraw permission using Cookie preferences on any public page. Your choice is stored in this browser. We disable advertising features and do not install advertising trackers. Google processes analytics data on its infrastructure, which may be outside your country. Transactional email providers report delivery, bounce, open and link-click events; SignComet uses those observations for delivery troubleshooting and invitation activity. Opens and clicks are estimates and may be triggered by mail-security tools.
Retention and account deletion
Account deletion revokes access and removes selected account and vault data after unfinished agreements are resolved. It does not erase shared agreements, completed PDFs or their evidence. The current application retains referenced originals and completed PDFs, audit records, receipts, invitation activity and deletion tombstones without an automatic expiry, including for cancelled, declined, expired or personally trashed agreements. A stable account identifier and email can remain to prevent a newly registered account from inheriting old agreements. Eligible unreferenced encrypted objects may be cleaned up after they are more than 30 days old; this is not a recovery guarantee. Provider backups and operational records may have separate retention. Contact us about a specific erasure request; we assess applicable rights, other participants' interests and legal obligations rather than promising automatic deletion of all records.
Your choices and requests
You can update available profile settings, manage security, disable optional AI and request account deletion in Settings & security. Depending on your location, you may have rights to access, correct, erase, restrict or object to processing, obtain a copy of information, withdraw consent or complain to your data-protection authority. Email hello@signcomet.com to make a request. We may need to verify your identity and clarify the records involved. Do not send passwords, recovery keys or unnecessary document contents in your request.
Younger users
SignComet has no blanket minimum age, but users must have the permission and legal capacity required for their activities. A parent or guardian must authorize and supervise use where required by applicable law. Where verified parental consent is required before collecting a child's personal information, a parent or guardian must contact hello@signcomet.com before the child creates an account or submits personal information so the requirements can be assessed. A statement of permission alone does not replace legally required verification. Parents may contact us to review or request removal of a child's information. We will assess reported collection without required consent and restrict processing or remove information as required by law.
Changes and contact
We may update this policy as the service changes. The date above identifies the current version; material changes will be communicated as appropriate through the service or email. Contact: hello@signcomet.com.