Privacy Policy

Account and organization

Sign-up and sign-in are handled by Clerk, our authentication provider. Clerk holds your name, email address and sign-in credentials. SigCraft's own database stores your Clerk user ID, your organization's ID, name and URL slug, and each member's role (admin or member).

Signature content

What you enter in the editor: names, job titles, company details, phone numbers, postal addresses, website and social links, photo and logo addresses, license or registration numbers, disclaimers, and any custom HTML. Each signature also stores whether tracking is on. SigCraft also stores banners (name, image address or HTML, link, start and end dates), earlier versions of each signature, schedules, teams and groups, the email address and display name of each team member, brand settings, and approval requests (the requester's name and email address).

Push history

Each time a signature is pushed to Gmail, SigCraft logs the Gmail address that is connected, the send-as address written to, whether the push succeeded, an error code if it failed, and the time.

Billing

Starter is the one paid plan. One person, one Gmail mailbox. It is sold monthly or yearly through Stripe. A 14 day free trial with no card. It starts the first time you push a signature to Gmail or add a second signature. Renews automatically each month or year until you cancel. Paid plans may not be open yet on the day you read this. Until they are, nothing is charged.

Stripe takes your payment details at checkout. Card numbers go to Stripe and never reach SigCraft. When you start checkout, SigCraft sends Stripe your organization ID, your user ID and the plan you chose. For each organization, SigCraft stores the Stripe customer ID, the Stripe subscription ID, the plan, the subscription status, the date the current paid period ends, and the date the free trial ends.

Fill in from text

If you use Fill in from text in the editor, the text you paste (the first 2,000 characters) is sent to OpenAI, which returns the contact details it finds. SigCraft does not store the pasted text. Do not paste anything you do not want sent to OpenAI. Data that SigCraft receives from Google is never sent to this feature.

Things you make public

Each signature has a preview link. Anyone who has that link can see the signature without signing in. If you publish a template to the template marketplace, its name, description, tags and field values are visible to anyone. Signature icons and images are served as images from sigcraft.app.

Cookies and logs

SigCraft uses the cookies Clerk needs to keep you signed in. It runs no advertising scripts and no third-party analytics scripts.

Our hosting provider, Vercel, keeps request logs that include IP address, browser user agent, address requested and time, as any web host does. Application logs record events such as a Gmail account being connected, including the SigCraft user ID and the Google account ID and email address involved.

Email from SigCraft

SigCraft does not send email to you or to anyone else. Its weekly summary job only writes a count to a log. Email about your sign-in comes from Clerk.

What each scope is used for

The two cards below cover every Google scope SigCraft requests today. Each says what is accessed, what is written, what is stored, for how long, and who it is shared with.

The connection ledger

Until Google finishes reviewing SigCraft, Google limits how many people can connect. To stay under that limit, SigCraft keeps a ledger. Each row holds a keyed hash of the Google account ID, a keyed hash of the SigCraft user ID, the ID of SigCraft's Google client, and the time the row was first recorded. It holds no email address and no raw ID. Because we hold the key, we can check whether a given account has a row, but the table does not list anyone.

These rows are kept after you disconnect, after you delete your SigCraft account, and after an organization is deleted. Counting past connections is their purpose. While this limit is in force, a SigCraft account can have 3 Gmail addresses connected at once and can connect 5 different addresses in total.

Limited Use

SigCraft's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, Google user data is:

• Used only for features you can see. Showing which account is connected, listing the addresses a signature can be pushed to, and writing signatures.
• Not used for advertising. That includes retargeting and personalized or interest-based advertising.
• Not sold, and not transferred to anyone else, except to the processors named above as needed to provide the service, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with your explicit prior consent.
• Not used to train AI. It is not used to develop, improve or train generalized artificial intelligence or machine learning models, and it is not sent to Fill in from text.
• Not read by humans, unless you have given us your explicit agreement to look at specific data (for example while we help you with a support request), it is necessary for security purposes such as investigating a bug or abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.

Withdrawing access

You can withdraw SigCraft's access at Google at any time by removing SigCraft under third-party connections in your Google Account. You can also disconnect inside SigCraft. Section 8 explains what happens to stored data.

Google Workspace domain connection (not available yet)

SigCraft contains a second way to connect, for Google Workspace administrators. It is built and switched off. No one can connect a domain today, and SigCraft holds no domain data from it. The text below says what the feature will do, so that you can read it before it opens. We will update this policy before it does.

• A Workspace super admin would authorize SigCraft's service account in the Google Admin console (Security > Access and data control > API controls > Manage Domain Wide Delegation) for two scopes: https://www.googleapis.com/auth/gmail.settings.basic and https://www.googleapis.com/auth/admin.directory.user.readonly.
• SigCraft would then list and write the Gmail signature of mailboxes on that domain, and read the domain's directory profiles (name, job title, department, phone number, photo and email addresses) to fill in signatures.
• No Google token would be stored for a domain. SigCraft would store the admin's email address, Google account ID and Workspace customer ID, the email address and display name of each person added to a team, and push history.

What a signature can contain

• An open-tracking image. A 1 by 1 pixel image loaded from sigcraft.app. When a mail program loads it, SigCraft records an open.
• Tracked links. Web links (http and https) that pass through sigcraft.app on the way to their destination. When someone clicks one, SigCraft records a click and then sends the browser on. Email and telephone links are not tracked.
• Campaign tags. A signature can be set to add utm_source, utm_medium and utm_campaign to its links. Those are read by the destination website, not by SigCraft.

The signature editor has a switch, Track opens and clicks, that is on by default. When it is off for a signature, the next push of that signature carries no image and no tracked links. A signature already in Gmail does not change until you push it again.

Who sees it

The members of the organization that owns the signature, in their SigCraft dashboard, as totals and breakdowns: opens and clicks per day, most-clicked links, mail programs, and countries and cities. We do not sell this data and do not use it for advertising.

Limits worth knowing

Gmail, Apple Mail and other services often fetch images through their own servers. When they do, the user agent and location recorded are the mail service's, not yours, and an open can be recorded even if you did not read the message.

How long it is kept

Open and click events are not deleted on a schedule. They are deleted when the signature they belong to is deleted and when the organization that owns it is deleted.

Your options as a recipient

Turning off automatic image loading in your mail program stops the open-tracking image. The organization that sent you the email decides whether its signatures are tracked, and is the right place to send an objection. You can also email us at hello@precipitous.io. Because SigCraft does not record who received an email, we usually cannot identify which events, if any, relate to you.

When you disconnect your Gmail account

In SigCraft, open Settings, then Connections, and choose Disconnect. SigCraft asks Google to revoke its access, then deletes the connection record, including the encrypted tokens and your Google account ID, email address, name and profile picture address. Push history entries and the connection ledger are not deleted.

Disconnect has an optional checkbox that also empties the signature on the address SigCraft last pushed to. If you leave it unchecked, the signature stays in Gmail until you change it.

When you delete your SigCraft account

SigCraft asks Google to revoke its access and deletes your stored Gmail connections and tokens, the same as disconnecting each one. If you were the only member of an organization, SigCraft also deletes everything that organization holds, as described next. If the organization has other members, its data stays with them and only your connections are deleted. This starts automatically when the account is deleted and normally finishes within a minute. If a step fails, it is retried automatically.

When an organization is deleted

Deleting an organization deletes all of its SigCraft data from our live database: signatures and their version history, teams, banners, schedules, push history, open and click events, templates it published to the marketplace, its billing record, the Gmail connections made in it (after asking Google to revoke each one), and anything else stored for that organization. Any paid subscription is canceled at once, and the unused part of the period is not refunded.

What is kept

• Signatures already in Gmail stay there unless you chose to clear the signature when you disconnected. Each person can change or delete their signature in Gmail settings.
• The organization's own record is kept. Its name, its short web name and its ID sit in a table SigCraft shares with other Precipitous products. Email us to have it removed.
• A copy of a marketplace template that another organization made before the deletion is theirs and stays.
• The connection ledger is kept after a disconnect, after an account is deleted and after an organization is deleted, for the reason given in section 3.
• Canceling a paid plan deletes nothing. Cancel any time from Settings, then Billing. The plan runs to the end of the period you paid for. After that, your data stays.
• There is no automatic expiry while an organization exists. Push history and tracking events are kept until the organization is deleted or you ask us to delete them.

How to request deletion

Email hello@precipitous.iofrom the address on your SigCraft account and tell us what to delete: a whole organization, one person's entries, or tracking data. For anything that belongs to an organization, we may ask you to show that you are one of its admins.

We will delete the data from our live database and confirm by email within 30 days. Deleted data cannot be restored. Copies in database backups are not edited and expire with the backups. We may keep records the law requires us to keep. Payment records are held by Stripe under its own policy.