Skip to content

Privacy

Version 2026.06.9 · Last updated 2026-07-18. Plain English. The version string above is the one stamped on your consent log when you signed up; your account shows which version you accepted.

Your PDFs never leave your browser by default

When you use AttachKit to fill, sign, or redact a PDF, the document bytes are parsed and edited entirely in your browser — using JavaScript libraries (pdf-lib, pdf.js) for the PDF manipulation itself and WebAssembly only for OCR (Tesseract.js, when you scan a non-searchable PDF). We don't upload, store, or transmit the PDF itself. You can verify this by opening your browser's network tab while you work.

That is what by default means, and here is what it doesn't cover. Two flows exist to hand your document to another device, and they upload it: send-for-signature and the QR phone handoff. Both encrypt it in your browser first, so we store only ciphertext — for 7 days, then a daily sweep deletes it. If you open the network tab during one of those, you will see that upload; we would rather name it here than have you find it there.

For the technical detail — exactly which paths touch our server, which cryptography we use, and how to verify each claim yourself — see our security page.

What we do see

Legal bases for processing (GDPR / UK GDPR)

If you're in the EU or UK, here's the lawful basis under Article 6 for each way we use personal data:

How send-for-signature is encrypted — and where the key goes

When you use the Send-for-signature feature, the PDF is encrypted in your browser with AES-GCM-256 before any upload. Our servers store only ciphertext — the decryption key is never saved to our database or our logs.

By default, the key itself rides in the link, in the part after #. And because we send that link to your recipient by email on your behalf, your browser hands it to us — key included — and we pass it to our email provider (Resend), which delivers it to their mailbox, where it stays until they delete it. So the key does pass through us in transit. We save it to no database column and no log — but the message we sent has the key in the link, and that message stays in our account with Resend for as long as Resend keeps it. We'd rather set out the whole path than claim a guarantee the email step doesn't support.

On Max, zero-knowledge mode closes that gap: if your recipient has published an encryption key, we wrap the document key to them directly, the link carries no key, and we never see one. It requires your recipient to be an AttachKit user who has opted in, so it's not available for every send.

Note: anyone who has the full link (including the fragment) can decrypt and sign in your place if the request is still pending. Treat the link like a password.

Third parties we share with

Cookies + analytics

We set only strictly-functional cookies, and never for advertising:

Analytics are opt-in. We use Plausible — cookieless, no cross-site tracking, no third-party fingerprinting, aggregate page-view counts only — and its script loads only after you choose "Accept analytics" on the cookie banner. Under that same opt-in we also keep a first-party aggregate usage counter — which tools are used and which post-task prompts are shown or clicked, by day — with no personal data, file content, or IP address, used only to improve the product. It is recorded only while analytics consent is accepted. Choose "Essential only" and it never loads. You can withdraw consent any time from your account, and the banner re-appears whenever the policy version changes. We record your choice to a server-side ledger (see DPA).

Google Ads click attribution. If you arrive from one of our Google ads, Google appends a click id (gclid, gbraid, or wbraid) to the landing URL. Under the same analytics opt-in above, we store that id in your browser's own localStorage (first-party, on your device only) so a later signup or upgrade can be reported back to Google as an aggregate conversion via server-side offline import. We load no Google tag, no gtag.js, no GA4, and no cross-site cookies, and the id is never shared with any third party except that owner-configured conversion report. It is only stored if you accepted analytics — choose "Essential only" and no click id is ever kept — and it clears when you clear your browser data.

How long we keep your data

Outside the two flows below, we never retain your PDF bytes — they're processed in your browser and never reach our servers. Send-for-signature and the QR phone handoff are the exceptions: both upload a copy of the document encrypted in your browser. The key that opens it is saved to no database column and no log of ours; on the default send path it nonetheless passes through us and Resend inside the link we email for you — the full path is set out under How send-for-signature is encrypted above.

That ciphertext is kept for 7 days from when you send it, then deleted by a sweep that runs once a day — so in practice it goes at expiry or within a day of it. Signing it doesn't shorten that: a completed request stays for the rest of its 7 days, because you fetch your signed copy after your recipient signs, and deleting it at completion would take it away before you'd had it. You can delete it yourself at any point — including once it's signed — from your sent-for-signature list, and deleting your account removes it too (below). Whichever comes first wins.

Your rights (GDPR / UK GDPR)

Wherever you live, you can ask us to honor the rights the law gives you over your personal data:

Access, erasure, and portability are self-service and immediate at /account; for anything else, use our contact form and we'll respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority (in the EU, your national DPA; in the UK, the ICO) — though we'd appreciate the chance to put things right first.

California privacy rights (CCPA / CPRA)

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising — we run no ad trackers and our analytics are cookieless. California residents have the right to know, access, correct, and delete the personal information we hold, and not to be discriminated against for exercising those rights. To make any of these requests — including telling us not to sell or share, though we already don't — use our contact form; we verify from your signed-in address and respond within 30 days.

Children

AttachKitis a tool for adults handling their own documents. It is not directed to children, and we don't knowingly collect personal data from anyone under 16 (or under 13 in the US, per COPPA). If you believe a child has provided us personal data, use our contact form and we'll delete it.

Your data, your control

Sign in and visit /account to export everything we hold about you as a JSON file, or permanently delete your account — both are self-service and take effect immediately. Deleting erases your profiles, saved signatures, templates, tracked contracts, signing and encryption keys, API keys, sessions, billing metadata, and any messages you've sent us. Documents you sent others for signature are deleted outright — not just stripped of your name — so the encrypted file itself goes with the account. Their links stop working. If a recipient still needs their signed copy, have them download it before you delete. Where someone else sent a document to you, we remove your email from their request but leave their document alone: it isn't ours or yours to destroy. Use our contact form for anything not covered.

Changes

We'll update this page if the privacy posture changes meaningfully. The last-updated date at the top reflects the most recent change.