Privacy
Plain language, and accurate about what the system does today rather than what it is planned to do. Last updated 19 October 2026.
What pulseSign is
pulseSign lets one person send a document to another person to sign. The documents are usually private agreements between individuals — rental contracts, loans, private sales — so they contain personal details, and often financial ones.
What is collected
- The document you upload. Whatever it contains is stored as you sent it, plus a PDF copy made for display and signing.
- Names and email addresses of the people involved. A signer's email is optional — a signer who gives none can still sign, and simply does not receive a copy by email.
- The signature you draw, stored as an image.
- When a signing link is opened, only the time is recorded. When a signature is made, the time, the IP address and the browser user-agent are recorded. This is the evidence that signing happened, and is the reason the record exists at all. The same three are recorded when a sender creates a signing link, has it emailed, or asks for a new one.
There is no analytics, no advertising, and no tracking cookie. pulseSign does not measure how you use it, does not follow you to other sites, and sells nothing to anyone.
Who else processes it
These are the only third parties involved. Each one is listed with what it actually receives.
| Who | What they receive | Why |
|---|---|---|
| Supabase | The document, participant names and email addresses, signature images, and the event log | Database and file storage. Files sit in a private bucket, reachable only through short-lived signed links. |
| Resend | A recipient email address and the contents of the message — including, in the finished-document notice, the signed PDF itself as an attachment | Sends the invitation and the finished-document notice. Only used when an email address is supplied. |
| DigitalOcean | Everything in transit, as the host | Runs the servers. Documents are not stored on this machine. |
| Your email address and profile name, only if you choose to sign in | Sign-in. Not yet available; listed here because it is being built. |
How long it is kept
Until you ask for it to be deleted. There is currently no automatic deletion: a document you sent last month is still there. Automatic expiry for documents sent without an account is planned and is not built, and this page will say so plainly until it is.
A signing link expires 30 days after it is created, including after the document has been signed. That stops the link working; it does not delete the document.
How it is protected
- Documents live in a private store; there is no public URL for a file.
- Signing links carry a random token, and only a hash of that token is stored — a copy of the database does not yield working links.
- Database credentials stay on the server. Your browser never holds one.
What is not claimed: the signed PDF is an ordinary PDF. It is not cryptographically sealed, so nothing in the file itself proves it has not been altered since. What pulseSign can show is its own record of who opened the link and when, and what was signed.
Your choices
- Signing without giving an email address is supported.
- To have a document and its record deleted, email the address below and say which document. Deleting the record also deletes the evidence that it was signed, so both go together.
- To ask what is held about you, use the same address.