Privacy Policy

Overview

SignDrop is a Chrome extension that lets you sign PDF documents directly in your browser. We are committed to protecting your privacy and being transparent about how we handle your data.

Data Collection and Storage

What we store (on your device only)

• PDF documents — signed PDFs are stored locally in your browser (IndexedDB). They never leave your device unless you explicitly download or share them, and you can delete them anytime from the extension's library.
• Signatures — typed, drawn, or uploaded signatures are stored locally in Chrome's storage. They are never transmitted to any server.

Temporary session data (optional "Sign with Phone" feature)

When you choose to sign using your phone via QR code, a short-lived session is created in Firebase Realtime Database to pass the signature from your phone to the extension. It contains:

• A random session ID (UUID)
• Session status (waiting / completed)
• The signature image (temporary)
• Creation and expiration timestamps

Sessions automatically expire after 5 minutes and are deleted immediately once the signature is captured. This is the only feature that uses any external service — if you never use "Sign with Phone," no data ever leaves your device.

What we do NOT collect

• No personal information (name, email, etc.)
• No browsing history
• No analytics or usage statistics
• No documents stored on any server
• No data shared with third parties
• No cookies or tracking technologies

Permissions

• storage — store signatures and document metadata locally.
• tabs / activeTab — detect and access the PDF tab you choose to sign.
• scripting — inject a read-only script to detect PDF documents.
• webRequest — inspect Content-Type headers only, to detect PDFs. No request data is intercepted, modified, or collected.

Host permissions for *.firebaseio.com, *.firebaseapp.com, *.googleapis.com, and *.googleusercontent.com support the optional phone-signature feature and reading PDFs from Gmail/Google Drive.

Third-Party Services

The only external service used is Firebase (Google), and only for the optional "Sign with Phone" feature — for temporary session coordination between your desktop and phone. Data is limited to a session ID, status, and signature image, transmitted over HTTPS, and automatically deleted after 5 minutes. Database rules enforce strict validation and size limits and prevent unauthorized access. See Firebase's privacy policy.

Data Security

• All signatures and documents are stored using browser-standard APIs, isolated to your browser, and inaccessible to other websites or extensions.
• Phone-signature sessions use unguessable random UUIDs, expire automatically after 5 minutes, and are transmitted over HTTPS.

Data Retention and Deletion

• Local data — kept until you delete it manually via the extension's library, or by uninstalling the extension.
• Phone-session data — deleted automatically after 5 minutes, and immediately after the signature is captured.

Children's Privacy

This extension is not directed at children under 13, and we do not knowingly collect data from children.

Your Rights

You can access your data (stored locally in your browser), delete it via the extension's interface, export it by downloading signed documents, and uninstall the extension at any time.

Compliance

This extension is built to comply with the Chrome Web Store Developer Program Policies, the GDPR, and the CCPA.

Changes to This Policy

We may update this policy from time to time. Changes are reflected in the "Last updated" date above.

Contact

Questions about this policy or data handling: signdrop@mayorov.co