We hash documents client-side, commit signatures to Solana, and run an account-light backend. This page is a plain-language account of what's collected, where it lives, and how to make us delete it.
We never see your document contents — files are hashed in your browser.
We collect the bare minimum: email (optional), IP for abuse prevention.
Storage: Supabase (Postgres) + Cloudflare R2. EU & US regions only.
Document hashes & signature txs on Solana mainnet are permanent and public.
One first-party analytics cookie. No Google, no Facebook pixel, no ads.
Email privacy@blocksign.ink for any GDPR/CCPA request.
This service is operated by BlockSign, Inc., a C-corporation incorporated in Delaware, United States. When this policy says "we", "us", or "BlockSign", it means that entity. Our principal place of business is 548 Market Street, PMB 91204, San Francisco, CA 94104, USA.
For the purposes of the EU GDPR and the UK GDPR, BlockSign, Inc. is the data controller for personal data processed through blocksign.ink and the BlockSign API.
We collect as little as possible. Where you give us an email or our infrastructure necessarily logs an identifier, here's the full list:
We do not collect: government IDs, biometrics, payment card data (Stripe handles that, we never see it), contact lists, location beyond country-level, or anything from trackers we don't run.
Your encrypted blobs and metadata live with two infrastructure providers we've chosen for their security posture and clear data-processing agreements. Nothing is stored on third-party marketing or ad-tech platforms.
supabase · postgres 15
Account records, audit trail rows, document metadata, hashed emails. Row-level security on every table.
cloudflare R2 · s3-compatible
Optional encrypted PDF blobs. Bucket is private; objects are encrypted with a per-document key derived from your signing credentials.
solana · mainnet-beta
Document hashes and signature transactions. Public, replicated globally, and — by design — permanent.
Read this carefully
Anything written to Solana mainnet — document hashes, signature transactions, signer wallet addresses — is permanent, public, and outside our control to delete. That's the entire point of on-chain notarization, but it means the right to erasure (GDPR Art. 17) cannot remove on-chain records.
The on-chain payload is intentionally small: a SHA-256 hash and the signing wallet's public key. Neither reveals the document contents nor your real-world identity unless you separately publish that linkage. If you want full deniability, sign with a fresh wallet you don't reuse.
We keep off-chain data only as long as it's useful. Concretely:
We use exactly two cookies, both first-party. No third-party trackers, no ad networks, no Google Analytics, no Facebook pixel.
Analytics is provided by Plausible, self-hosted on our infrastructure. It records page views and outbound clicks in aggregate; no cross-site profile, no fingerprint, no cross-device tracking. You can opt out from the cookie banner or by sending Do Not Track — we honor it.
We share data with the minimum set of subprocessors needed to run the service. Each has a signed Data Processing Agreement and SOC 2 Type II or equivalent attestation:
We don't sell your data. We don't share it with advertisers. We will share with law enforcement only on receipt of a valid legal process and will notify you unless legally prohibited.
Under GDPR, UK GDPR, CCPA/CPRA, and similar regimes, you have the rights below. To exercise any of them, email privacy@blocksign.ink from the address tied to your account; we'll respond within 30 days.
Access
Get a copy of every byte we hold on you, in JSON.
Rectification
Correct anything we have wrong (e.g. an outdated email).
Erasure
Delete your off-chain data. On-chain records are out of reach — see clause 04.
Portability
Export your data in a machine-readable format. We give you JSON + your audit trail.
Restriction
Pause processing while a dispute is open.
Objection
Object to processing for legitimate-interest grounds (analytics, abuse triage).
Opt-out of sale
N/A — we don't sell or share data for cross-context behavioral advertising.
Withdraw consent
Anywhere we ask for it. Withdrawing doesn't affect prior lawful processing.
If we don't satisfy you, you can complain to your local supervisory authority — for EU residents, the lead authority is the Irish Data Protection Commission.
TLS 1.3 in transit. AES-256 at rest in Postgres; per-document XChaCha20-Poly1305 for blobs in R2. Secrets stored in Cloudflare KV with envelope encryption. We run quarterly pen-tests. If you find a vulnerability, our security contact is security@blocksign.ink — we operate a public bug bounty program.
No system is perfect. If we have a breach affecting personal data, we'll notify regulators within 72 hours and affected users without undue delay.
When we change this policy materially, we'll email everyone with an account, post a notice on the homepage for 30 days, and bump the version stamp at the top. Non-material edits (typos, broken links, clarifications) ship without notice but are visible in the policy's git history.
Postal: 548 Market Street, PMB 91204, San Francisco, CA 94104, USA. Allow two weeks for postal responses; email is faster.
Send email