Privacy
Version 2026.06.9 · Last updated 2026-07-18. Plain English. The version string above is the one stamped on your consent log when you signed up; your account shows which version you accepted.
Your PDFs never leave your browser by default
When you use AttachKit to fill, sign, or redact a PDF, the document bytes are parsed and edited entirely in your browser — using JavaScript libraries (pdf-lib, pdf.js) for the PDF manipulation itself and WebAssembly only for OCR (Tesseract.js, when you scan a non-searchable PDF). We don't upload, store, or transmit the PDF itself. You can verify this by opening your browser's network tab while you work.
That is what by default means, and here is what it doesn't cover. Two flows exist to hand your document to another device, and they upload it: send-for-signature and the QR phone handoff. Both encrypt it in your browser first, so we store only ciphertext — for 7 days, then a daily sweep deletes it. If you open the network tab during one of those, you will see that upload; we would rather name it here than have you find it there.
For the technical detail — exactly which paths touch our server, which cryptography we use, and how to verify each claim yourself — see our security page.
What we do see
- Your email if you sign in for a free or paid account (stored to authenticate you).
- Your saved profile data (name, address, etc.) — only the fields you explicitly enter at
/account/profile. Stored in our database when you're signed in, in your browser's localStorage when you're not. - Auto-fill from profile — Form-field names + types (not PDF bytes) and your saved profile data, to compute the mapping. We do not log the request or response. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- Scan for PII — Extracted text spans (not PDF bytes) from the redact tool, to find the PII worth redacting; the coordinates stay client-side. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- AI clause review — The extracted document text you submit for review — no coordinates, no PDF bytes. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based), or to Google (the Gemini API) if we enable it for this feature.
- Draft a document — The text you type (the parties, terms, and details you describe), to generate the draft. No PDF bytes are sent. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- Field help — A form field's name and type, plus nearby labels, for a one-line explanation of what the field wants. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- Library cited answers (Max) — Your question plus the excerpts that matched it — each excerpt's extracted text and file name. The file name is sent so the answer can cite its source; the embeddings and search index themselves stay in your browser. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- Ask AI about this document — The open document's extracted text — tagged page by page, so an answer can cite the page it came from — plus your question, when you use Summarize, Key points, Ask, Explain, or Translate on it. When you summarize a document's reviewer notes instead, the notes and their author/page labels are what get sent. No PDF bytes are sent. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based), or to Google (the Gemini API) if we enable it for this feature.
- PDF agent — The extracted document text and your instruction, plus the page geometry, the form-field names (the names only — never the values you entered), the positions of text on the page, and the shape of any table your instruction refers to, all derived in your browser. The agent uses them to plan the edits; the plan then runs on your device and no PDF bytes are sent. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based).
- Translate document — The document's extracted text and the language you picked — page by page, or line by line when you keep the original layout. The translated PDF is built in your browser from the returned text; no PDF bytes are sent. Sent to our AI sub-processor, Anthropic, PBC (the Claude API, US-based), or to Google (the Gemini API) if we enable it for this feature.
- Browser type, IP address, and timestamp for API calls — short-lived web-server request logs for abuse prevention, and (when you're signed in) your session records, so you can review and revoke active sessions. Retention periods are listed under How long we keep your data below.
- The name, email, and message you type into our contact form (general questions, bug reports, feature requests, or security disclosures), stored so we can respond and triage. If you attach a screenshot or screen recording to a bug report, we store that attachment with your message under the same retention and erasure rules — note that a capture taken on a tool page may show your open document, so crop or redact anything sensitive before attaching. Attachments are entirely optional; nothing is captured automatically.
- If someone sends you a document to sign through AttachKit: the email address they entered (so we can deliver the request), and — only if they turned on identity verification — a one-time code we email you to confirm it's you. We use a recipient's email solely to deliver and verify that one signing request.
Legal bases for processing (GDPR / UK GDPR)
If you're in the EU or UK, here's the lawful basis under Article 6 for each way we use personal data:
- Running the service — your account email, saved profile, the fill/sign/redact you perform, and send-for-signature ciphertext: performance of a contract (Art. 6(1)(b)).
- AI features (auto-fill mapping, PII detection for redaction, clause review, document drafting, field-help explanations, library cited answers, document summaries/Q&A/translation, the PDF agent's planning step, and whole-document translation) — sending the extracted text, field names/labels, profile data, or prompt described above to our AI sub-processor (Anthropic, the Claude API) when you invoke the feature: contract / your request. It only runs on demand.
- Security, abuse prevention & logging — IP, user-agent, timestamps, rate-limit and AI-spend counters: legitimate interests (Art. 6(1)(f)) in keeping the service available and affordable.
- Payments — via Stripe: contract, plus a legal obligation (Art. 6(1)(c)) to keep tax/accounting records.
- Analytics — cookieless Plausible, and any non-essential cookies: consent (Art. 6(1)(a)). Opt-in and withdrawable any time.
- Transactional email — sign-in codes, sign-request notifications, and billing/trial notices via Resend: contract. These are required to use the service and can't be turned off.
- Reminders & marketing email — contract-renewal reminders (legitimate interest, Art. 6(1)(f) — for contracts you chose to track) and any product news (consent, Art. 6(1)(a) — off unless you opt in). Manage both in your notification settings or with the one-click unsubscribe link in any such email.
How send-for-signature is encrypted — and where the key goes
When you use the Send-for-signature feature, the PDF is encrypted in your browser with AES-GCM-256 before any upload. Our servers store only ciphertext — the decryption key is never saved to our database or our logs.
By default, the key itself rides in the link, in the part after #. And because we send that link to your recipient by email on your behalf, your browser hands it to us — key included — and we pass it to our email provider (Resend), which delivers it to their mailbox, where it stays until they delete it. So the key does pass through us in transit. We save it to no database column and no log — but the message we sent has the key in the link, and that message stays in our account with Resend for as long as Resend keeps it. We'd rather set out the whole path than claim a guarantee the email step doesn't support.
On Max, zero-knowledge mode closes that gap: if your recipient has published an encryption key, we wrap the document key to them directly, the link carries no key, and we never see one. It requires your recipient to be an AttachKit user who has opted in, so it's not available for every send.
Note: anyone who has the full link (including the fragment) can decrypt and sign in your place if the request is still pending. Treat the link like a password.
Third parties we share with
- Anthropic, PBC (the Claude API; US-based) — our AI sub-processor for auto-fill mapping, PII detection for redaction, clause review, document drafting, field-help explanations, library cited answers, document summaries/Q&A/translation, the PDF agent's planning step, and whole-document translation. We use Anthropic's commercial API, which does not train on the data sent through it, and don't pass anything unless you invoke an AI feature.
- Google LLC (the Gemini API; US-based) — an alternative AI sub-processor we may use for these features and no others: clause review, document summaries/Q&A/translation, and whole-document translation. Every other AI feature calls Anthropic directly and cannot be routed elsewhere. When it is enabled, only the extracted text you submit to one of those features is sent — the same data Anthropic would receive, never the document file — on the paid Gemini API tier, which does not train on data sent through it.
- Resend — email delivery (magic links, sign-request notifications). A send-for-signature email contains the sign link, which in the default mode carries the document's decryption key, so Resend handles that link in order to deliver it.
- Stripe — payments.
- Google Cloud — hosting + logs.
- Neon — Postgres database.
- Plausible — privacy-respecting analytics (no cookies, no personal data).
- Google Drive / Dropbox (optional cloud import) — off by default; the import buttons appear only when the operator configures the provider's keys. If you choose to import a file, your browser fetches it directly from the provider — our servers never receive the document bytes. The provider sees your authenticated request and file-listing metadata for that import.
- Google / Cloudflare STUN servers — used only during a co-sign or live-review session to set up the peer-to-peer connection. They receive the participant's IP address for NAT traversal and never receive document content (the document flows directly between peers).
Cookies + analytics
We set only strictly-functional cookies, and never for advertising:
- better-auth.session_token — your sign-in session. Strictly necessary (HTTP-only); cleared when you sign out.
- attachkit-cookie-consent — records which cookie-policy version you answered and whether you accepted analytics. 1-year expiry; a plain version string (the year-month it was published), not a tracking identifier.
- ak_counsel — set only if you turn on Local AI mode (a Max privileged-AI setting). Records that preference so AI processing stays on your own device; functional, not a tracking identifier. 1-year expiry; cleared when you turn Local AI mode off.
Analytics are opt-in. We use Plausible — cookieless, no cross-site tracking, no third-party fingerprinting, aggregate page-view counts only — and its script loads only after you choose "Accept analytics" on the cookie banner. Under that same opt-in we also keep a first-party aggregate usage counter — which tools are used and which post-task prompts are shown or clicked, by day — with no personal data, file content, or IP address, used only to improve the product. It is recorded only while analytics consent is accepted. Choose "Essential only" and it never loads. You can withdraw consent any time from your account, and the banner re-appears whenever the policy version changes. We record your choice to a server-side ledger (see DPA).
Google Ads click attribution. If you arrive from one of our Google ads, Google appends a click id (gclid, gbraid, or wbraid) to the landing URL. Under the same analytics opt-in above, we store that id in your browser's own localStorage (first-party, on your device only) so a later signup or upgrade can be reported back to Google as an aggregate conversion via server-side offline import. We load no Google tag, no gtag.js, no GA4, and no cross-site cookies, and the id is never shared with any third party except that owner-configured conversion report. It is only stored if you accepted analytics — choose "Essential only" and no click id is ever kept — and it clears when you clear your browser data.
How long we keep your data
- Account & profile, saved signatures/templates, API keys, tracked contracts — until you delete them or close your account (self-service, immediate — see below).
- Send-for-signature / QR-phone-handoff documents (the encrypted PDF, its IV, the filename, and the sender's and recipients' email addresses) — 7 days from the moment the request is created, then deleted by a daily sweep — so it goes at expiry or within a day of it. Signing the document does not delete it sooner, and revoking a request stops the link immediately but leaves the ciphertext until that same expiry. You can delete it yourself at any point — including once it's signed — and closing your account deletes every request you sent, encrypted document included. Whichever comes first wins.
- Sessions (with IP + user-agent) — for the life of the session; cleared when you sign out or it expires.
- Web-server request logs (IP, user-agent, timestamp) — up to 30 days, for abuse prevention.
- One-time login / signing codes — deleted on use and swept shortly after they expire.
- Billing & webhook records (Stripe event payloads) — 90 days, then purged; your rows are erased immediately if you delete your account.
- AI-usage cost telemetry (route, model, token counts, a hashed caller key — never document content) — about 13 months, then purged.
- Contact-form messages (your name, email, and message text) — up to 24 months, then purged; erased immediately if you delete your account.
- Support tickets (your email and the message thread) — resolved tickets are purged 24 months after they close; erased immediately if you delete your account.
- Marketing / launch-update leads (the email you give us to hear about launches, plus any note you add) — up to 24 months, then purged; erased immediately if you delete your account, or sooner on request via our contact form.
- Consent receipts — kept for the life of the account as the audit trail GDPR Art. 7 requires.
Outside the two flows below, we never retain your PDF bytes — they're processed in your browser and never reach our servers. Send-for-signature and the QR phone handoff are the exceptions: both upload a copy of the document encrypted in your browser. The key that opens it is saved to no database column and no log of ours; on the default send path it nonetheless passes through us and Resend inside the link we email for you — the full path is set out under How send-for-signature is encrypted above.
That ciphertext is kept for 7 days from when you send it, then deleted by a sweep that runs once a day — so in practice it goes at expiry or within a day of it. Signing it doesn't shorten that: a completed request stays for the rest of its 7 days, because you fetch your signed copy after your recipient signs, and deleting it at completion would take it away before you'd had it. You can delete it yourself at any point — including once it's signed — from your sent-for-signature list, and deleting your account removes it too (below). Whichever comes first wins.
Your rights (GDPR / UK GDPR)
Wherever you live, you can ask us to honor the rights the law gives you over your personal data:
- Access a copy of what we hold (Art. 15).
- Rectify inaccurate data (Art. 16).
- Erase your data — be forgotten (Art. 17).
- Restrict or object to processing, including anything we base on legitimate interests (Art. 18 & 21).
- Portability — receive your data in a machine-readable format (Art. 20); our JSON export does exactly this.
- Withdraw consent at any time, as easily as you gave it (Art. 7(3)) — e.g. analytics, from the cookie banner or your account.
Access, erasure, and portability are self-service and immediate at /account; for anything else, use our contact form and we'll respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority (in the EU, your national DPA; in the UK, the ICO) — though we'd appreciate the chance to put things right first.
California privacy rights (CCPA / CPRA)
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising — we run no ad trackers and our analytics are cookieless. California residents have the right to know, access, correct, and delete the personal information we hold, and not to be discriminated against for exercising those rights. To make any of these requests — including telling us not to sell or share, though we already don't — use our contact form; we verify from your signed-in address and respond within 30 days.
Children
AttachKitis a tool for adults handling their own documents. It is not directed to children, and we don't knowingly collect personal data from anyone under 16 (or under 13 in the US, per COPPA). If you believe a child has provided us personal data, use our contact form and we'll delete it.
Your data, your control
Sign in and visit /account to export everything we hold about you as a JSON file, or permanently delete your account — both are self-service and take effect immediately. Deleting erases your profiles, saved signatures, templates, tracked contracts, signing and encryption keys, API keys, sessions, billing metadata, and any messages you've sent us. Documents you sent others for signature are deleted outright — not just stripped of your name — so the encrypted file itself goes with the account. Their links stop working. If a recipient still needs their signed copy, have them download it before you delete. Where someone else sent a document to you, we remove your email from their request but leave their document alone: it isn't ours or yours to destroy. Use our contact form for anything not covered.
Changes
We'll update this page if the privacy posture changes meaningfully. The last-updated date at the top reflects the most recent change.