What we collect, why, and how to take it back

Last updated October 2026. This page is written for both our customers and the Google team reviewing our OAuth verification.

At sign-in

You can sign in with an email link or with Google. With an email link we store only the address you typed, and we send one email containing a sign-in link that works for 20 minutes. When you choose Continue with Google, we request the standard identity scopes (openid, email, profile) and receive exactly four things: your name, your email address, your profile picture, and your Google account ID. We store these on your Signet account so we know who you are, show your name in the app, and attach the signatures you create to your account. Nothing else is read at sign-in.

Gmail access (only when you click Connect Gmail)

We request the scope https://www.googleapis.com/auth/gmail.settings.basic only when you click Connect Gmail — it is never requested at sign-in, and it is asked for separately with its own consent screen. With it we:

read your list of send-as addresses, to find your primary address (Gmail only lets apps update the signature on the primary address); and
write the signature HTML you generated into your Gmail settings when you click Install in Gmail.

That is the sole use of this scope. We do not read your emails, your contacts, your drafts, or anything else in your Google account. We keep the OAuth tokens (access + refresh) needed to perform the install later; they are stored on our server and never shared.

Your Facebook profile picture (only when you tap Import from Facebook)

On the home page and in the editor you can bring in your Facebook profile picture with one tap. That uses Facebook Login with the smallest permission Facebook offers, public_profile: Facebook tells us your name and the address of your profile picture, nothing else. We download the picture and store it exactly as we would a photo you uploaded: it becomes the headshot of your signature. If you had not typed a name yet, your Facebook name is placed in the signature's name field for you to keep or change. We do not store the access token Facebook gives us for that single request, we do not post to Facebook, and we do not see your friends, your email address or anything else on your account. Facebook sets its own cookies during that step; Meta's Privacy Policy covers them.

To delete what we received from Facebook: delete the signature it is in (My signatures → Delete, or let an unactivated preview expire after 7 days), and remove Signet from your Facebook apps at Settings & privacy → Settings → Apps and websites. You can also email support@signet.email and we will delete it and confirm.

Your signature content

The headshot, logo, icons and text you upload are used to make your signature. When you activate a signature, its images are published at public web addresses so they can appear in the emails you send. That means anyone who receives one of those emails, or has the address, can see those images. Deleting a signature removes them.

Payments

Payments are processed by Stripe. We never see or store your card number — Stripe gives us only your customer ID, subscription status and renewal date.

Cookies and site measurement

Signet sets two first-party cookies: a signed, HttpOnly session cookie that keeps you signed in, and a random visitor ID that lets us count how many visitors reach each step of making a signature (for example, opening the editor, making a preview, or starting checkout) and how far they get on the home page (whether it stayed on screen for 10 seconds, was scrolled, and which buttons were tapped), by device type, by the screen width the page displayed at, and by whether they arrived from one of our ads. We don't store your IP address with these counts, they are never sold or shared, and they are deleted after 180 days.

We also use the Meta Pixel, which sets Meta's own cookies, to measure how our ads perform: it tells Meta when an ad visitor views a page, opens the editor, makes a preview, or starts or completes checkout. See Sharing below for how to control how Meta uses your data.

We also use Microsoft Clarity, a session-replay and heatmap service, to understand how visitors use our pages: where they tap, how far they scroll, and where they stop. Clarity sets Microsoft's own cookies and records how the page is used, with masking turned on so that the text you type and the images you upload are not captured, and it is not loaded on your account page. For how Microsoft handles this data, see the Microsoft Privacy Statement.

Retention and deletion

Signatures you generate while signed out are anonymous previews and are deleted automatically after 7 days unless activated. Activated signatures stay until you delete them. Deleting your signatures removes their images; to also remove your account record, email us at support@signet.email and we will delete it.

Revoking Google access

You can cut off Signet's access to your Google account at any time, three ways:

In the app: My signatures → Gmail → Disconnect. This deletes your stored Gmail tokens immediately.
At Google: myaccount.google.com/permissions → remove Signet under third-party access. This revokes both sign-in and Gmail access.
By email: write to support@signet.email and we will revoke and delete your tokens and account data.

Revoking access does not delete signatures you already installed in Gmail — those live in your Gmail settings until you remove them there (Gmail → Settings → Signature).

Google Workspace API Limited Use compliance

Our use of data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Signet uses no artificial intelligence or machine learning models and integrates with no third-party AI/ML service providers. No Google Workspace or Gmail user data — raw, aggregated, or derived — is used to train, retrain, or otherwise improve any AI or ML model, and no such data is transferred to any third party for AI/ML purposes.

Sharing

We do not sell your data. Google user data is shared only with the service providers we need to run Signet (our cloud hosting and storage providers, and Stripe for payments) and is never used for advertising. We use the Meta Pixel to measure ad performance; you can control how Meta uses your data at facebook.com/adpreferences. We use Microsoft Clarity to see how our pages are used, as described under Cookies and site measurement.

Contact

Questions about this policy: support@signet.email.