Privacy Policy

SignatureLab is operated by Signature Lab LLC. This policy covers signature-lab.io, SignatureLab accounts and membership, Flashlab, the newsletter and the contact form. Contact us at support@signature-lab.io.

Your account. Your email address and password (stored only as a secure hash; we never see it). If you sign in with Google, we receive your name, email address and profile picture from Google. We also record when you sign in and the device session you're using, so we can keep your account to one active sign-in.

Membership. Your plan, subscription status, renewal date and the Stripe customer and subscription IDs that link your account to your payments. Stripe collects your card and billing address; we never receive your full card number.

Flashlab use. Daily usage counts for your account, so we can apply fair use limits. Flashlab views show a faint watermark with your account ID.

Newsletter. Your email address, kept on our mailing list with Resend until you unsubscribe. Every newsletter has an unsubscribe link. Your IP address is held briefly to limit repeated sign-ups, then deleted automatically.

Contact form. Your name, email address and message, delivered to our support inbox so we can reply.

Technical logs. Like most websites, our servers log requests, including IP addresses, to keep the service working and secure.

We don't use advertising or analytics cookies. The site stores a few items in your browser: your light or dark theme and your sign-in session. Stripe's checkout and Google sign-in may set their own cookies when you use them, for security and fraud prevention.

We use these providers to run SignatureLab. They process your information on our behalf, only for the purposes described here.

• Supabase: Account sign-in: stores your email, password (hashed) and Google sign-in details.
• Stripe: Payments for membership. Card details go directly to Stripe.
• Resend: Sends our emails: sign-in links, billing notices and the newsletter.
• Amazon Web Services: Hosts the website, our database and our servers, in the United States.
• Google: Sign-in with Google, if you choose it; also hosts our support mailbox.

We don't sell your personal information, share it for advertising, or use it to build profiles. We may disclose information if the law requires it.

• Account and membership records: until you delete your account.
• Payment records: Stripe keeps them as tax and financial law requires, even after you delete your account.
• Newsletter: until you unsubscribe.
• Server logs: up to 30 days.
• Database backups: deleted records can remain in backups for up to 35 days before they are overwritten.

You can delete your account from your account page. That cancels any membership immediately, deletes your membership record and deletes your sign-in account. Stripe keeps the payment records it's legally required to keep. To remove yourself from the newsletter, use the unsubscribe link in any newsletter.

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing support@signature-lab.io. Depending on the state you live in, you may have additional privacy rights; we'll honour them. We'll respond within 30 days.

SignatureLab accounts are for people 18 and over. We don't knowingly collect information from children. If you think a child has given us information, contact us and we'll delete it.

Information is encrypted in transit, and access is limited to what each part of the service needs. Our servers and database are in the United States. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

We'll update this policy when our practices change, and email account holders about significant changes before they take effect.

Privacy questions and requests: support@signature-lab.io.