Privacy Policy for SignDrop

Last Updated: November 2026

Overview

SignDrop is a Chrome extension that allows you to sign PDF documents directly in your browser. We are committed to protecting your privacy and being transparent about how we handle your data.

Data Collection and Storage

What We Collect

1. PDF Documents (Local Only)

   • Signed PDF documents are stored locally in your browser using IndexedDB
   • Documents never leave your device unless you explicitly download or share them
   • You can delete documents at any time from the extension’s library

2. Signatures (Local Only)

   • Your typed, drawn, or uploaded signatures are stored locally in Chrome’s storage API
   • Signatures made on your computer are never transmitted to any server (a signature drawn on your phone passes once through the temporary session below)
   • All signature data remains on your device

3. Temporary Session Data (Phone Signature Feature)

   • When using the phone signature feature, a temporary session is created in Firebase Realtime Database
   • Session data includes:
     • Session ID (random UUID)
     • Session status (waiting/completed)
     • Signature image data (base64 encoded)
     • Timestamps (creation and expiration)
   • The QR code stops accepting a signature 5 minutes after it is created
   • The signature is deleted the moment your computer receives it; any session left behind is deleted automatically within 15 minutes

4. Feedback You Choose to Send (Optional)

   • After you sign a document, SignDrop may ask how it is working for you. If you write a message and press Send, it is stored in Firebase Realtime Database and delivered to the developer through a private Telegram chat
   • What is sent: your message, the face you picked (not great / okay / love it), the extension version, the time, and your email address only if you type one in to get a reply
   • Nothing is sent if you close the prompt, pick “Love it”, or leave the message empty
   • Feedback is kept so the developer can reply and fix what you reported. Email [email protected] to have it deleted

What We DO NOT Collect

• ❌ We do not collect personal information, except an email address you choose to type into the optional feedback form
• ❌ We do not track your browsing history
• ❌ We do not collect analytics or usage statistics
• ❌ We do not store your documents on any server
• ❌ We do not sell or share your data. Phone signatures and feedback you send pass through Firebase (Google); feedback is delivered to the developer through Telegram
• ❌ We do not use cookies or tracking technologies

Permissions Explanation

The extension requests the following permissions:

Required Permissions

1. storage

   • Purpose: Store signature templates and document metadata locally
   • Scope: Local browser storage only

2. tabs

   • Purpose: Detect when you’re viewing a PDF document
   • Scope: Read-only access to tab information (URL, title)

3. activeTab

   • Purpose: Access the current PDF tab when you click “Sign this PDF”
   • Scope: Only the active tab, only when you interact with the extension

4. scripting

   • Purpose: Detect a PDF in the tab you clicked the extension on, and read that PDF so you can sign it
   • Scope: Only the active tab, only after you click the extension
   • What it does: Checks whether the page is a PDF and copies the PDF’s bytes into the signing page on your computer; nothing is sent anywhere

Host Permissions

The extension requests no host permissions. It cannot read or modify the pages you visit.

Network Access

The extension’s own pages are permitted to connect to the following domains, and only for the optional “Sign with Phone” feature and for feedback you choose to send:

1. https://*.firebaseio.com — Firebase Realtime Database, used to coordinate a temporary signing session between your desktop and your phone.
2. https://*.firebaseapp.com — hosts the phone signature capture page you open by scanning the QR code.
3. https://*.googleapis.com — Firebase SDK dependencies.

No connection is made to any of these unless you explicitly choose “Sign with Phone” or press Send on the feedback form.

Third-Party Services

Firebase (Google)

We use Firebase Realtime Database for the phone signature feature and for feedback you choose to send.

Phone signature:

• Purpose: Temporary session coordination between desktop and mobile
• Data Stored: Session ID, status, and signature image (temporary)
• Duration: Deleted the moment your computer receives the signature; any session left behind is deleted automatically within 15 minutes
• Security: Database rules prevent unauthorized access and limit data size
• Firebase Privacy Policy: https://firebase.google.com/support/privacy

Feedback:

• Data Stored: Your message, sentiment, extension version, time, and an email address only if you entered one
• Duration: Kept until you ask for it to be deleted ([email protected])
• Delivery: Forwarded to the developer’s private Telegram chat
• Security: Database rules allow only adding new feedback; nobody can read it back through the extension or the website

Note: Firebase is used only when you choose “Sign with Phone” or send feedback. It is not used for any other extension features.

Data Security

Local Data Protection

• All signatures and documents are stored locally using browser-standard APIs (IndexedDB and Chrome Storage)
• Data is isolated to your browser and cannot be accessed by other websites or extensions
• Your data remains on your device unless you explicitly export or share it

Firebase Security

• Database rules accept a signature only into a session less than 5 minutes old, only as an image, and never allow listing sessions
• Sessions stop accepting a signature after 5 minutes
• Signature data is transmitted over HTTPS
• No authentication required (sessions use random UUIDs)

Data Retention and Deletion

Local Data

• Signatures: Stored indefinitely until you delete them manually
• Documents: Stored indefinitely until you delete them manually
• How to Delete: Use the extension’s library to delete individual documents or signatures

Firebase Data

• Immediate Deletion: The session, with the signature, is deleted the moment your computer receives it
• Automatic Deletion: Any session left behind (for example, if you close the window first) is deleted automatically within 15 minutes
• Feedback: Kept until you ask for deletion at [email protected]

Complete Data Removal

To completely remove all extension data:

1. Delete all signatures and documents from the extension’s library
2. Uninstall the extension
3. This will remove all local storage, IndexedDB, and extension data

Children’s Privacy

This extension is not directed at children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the “Last Updated” date at the top of this document.

Contact

If you have questions about this privacy policy or data handling:

• Email: [email protected]

Your Rights

You have the right to:

• Access your data (stored locally in your browser)
• Delete your data (using the extension’s interface)
• Export your data (download signed documents)
• Uninstall the extension at any time

Compliance

This extension complies with:

• Chrome Web Store Developer Program Policies
• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)

Summary: SignDrop stores all your documents and signatures locally on your device. The only external services used are Firebase, for the optional phone signature feature (the signature is deleted as soon as your computer receives it; any leftover session within 15 minutes) and for feedback you choose to send, and Telegram, which delivers that feedback to the developer. We do not track you, and the only personal information we ever receive is an email address you choose to add to feedback.