Your account and your data: sign-in, saved profile, export and delete

An AttachKit account is deliberately small. Because PDFs are processed in your browser and never uploaded, the account holds only what makes the tools more convenient — your sign-in identity, an optional auto-fill profile, saved signatures and templates, and billing once paid plans are open. This article covers how to get in, what is stored where, and how to take your data out.

Signing in: passkey or email code

There are no passwords. Two ways in from the login page:

1. Sign in with passkey — one tap with your fingerprint, Face ID, or hardware security key. Passkeys are stored on your device (or synced by iCloud Keychain / Google Password Manager); AttachKit never sees the private key. This is the fastest path once you’ve registered one.
2. Email me a sign-in code — enter your email and you get a 6-digit code that expires in 10 minutes. Paste the code, or tap the link in the email to sign in automatically. Your first sign-in creates the account.

After an email-code sign-in, AttachKit offers once per device to add a passkey so the next sign-in skips email entirely — you can take it or choose Maybe later. You can also add, name, and remove passkeys anytime under Account → Security. One note: passkeys require a secure (HTTPS) connection; the email path always works.

Your saved auto-fill profile

The profile page holds the details that Auto-fill uses to populate PDF forms: full name, email, phone, address, city, state, postal code, country, date of birth, and SSN / Taxpayer ID or EIN (the sensitive fields are masked on screen until you choose to show them).

Where it lives depends on whether you’re signed in:

• Signed in: synced to your account, so it follows you across browsers and devices — with one exception: the SSN / Taxpayer ID and EIN fields always stay only in this browser and are never synced to our servers, even while you’re signed in.
• Anonymous: stored only in your browser’s localStorage — nothing reaches our servers at all.

Either way, the profile is filled into PDFs locally in your browser; the documents themselves are never uploaded.

Where your documents live

Not with us. Filling, signing, redacting, converting — all of it happens on your device, so there is no server-side library of your PDFs to manage, export, or breach. The narrow exception is the one optional network feature, labeled in the tool when it happens: Send for signature stores your document as encrypted ciphertext we cannot read (see Send for signature, explained). Saved drafts don’t leave your device either — they’re kept in your browser’s own storage, encrypted with a key that exists only in that browser.

Email notifications

Under Account → Notifications you choose which optional emails you receive, such as renewal reminders and product news. Essential emails — sign-in codes, sign-request notifications, and billing — are always sent, because the features don’t work without them.

Export your data

On your account page, the Export my data (JSON) button downloads everything AttachKit holds about you in one file, immediately and self-service — no support ticket, no waiting period. This honors GDPR Article 20 data portability.

Delete your account

Also on the account page: Delete my account permanently erases your account and all associated data. You confirm by re-typing your email, and it takes effect immediately. It cannot be undone, so export first if you want a copy. This honors GDPR Article 17 erasure.

The privacy + data page rounds this out: it lists your consent receipts (a timestamped record of every policy you accepted or withdrew from, with versions), lets you withdraw cookie consent, and links both data-rights actions. If you’d rather not use the self-service buttons, contact us and we’ll process an export or deletion within 30 days.

Related

• Plans and AI actions
• Send for signature, explained