SEAL — Privacy Policy

Last updated: 25 October 2026 Version: 1.3

1. Data Controller

Arkon Technology Kızılırmak Mah. Ufuk Üniversitesi Cd. Next Level Loft Ofis, No: 4 Floor: 27 No: 72/76, Söğütözü, Çankaya/Ankara, Türkiye Email: support@getseal.app

2. Personal Data We Collect

2.1 Automatically

• Device ID: a random identifier created on your device when you first pair or sign. It is recorded with your signing key and in the audit-chain entries of receipts you act on. It is not linked to any external identity.
• Operating-system device identifier: the Android ID (Android) or identifierForVendor (iOS). The app sends it to our server when you pair or set up your account. The server does not keep the raw value; it stores only a one-way, peppered SHA-256 hash of it, with your account and in a separate anti-abuse record, to prevent repeated free trials (see section 6).
• Cryptographic public key: Needed for signature verification. Private key stays on your device only.
• Device type + platform (iOS / Android).
• IP address — held in server logs temporarily (rate-limit + fraud prevention).
• Crash and error reports — when the app or our server hits an error, a technical report is sent to Sentry: the error details, the app version, device model and operating system, and the recent events and log lines leading up to the error. Those log lines can include your display name, phone number, internal account ID, a pairing code, or details you entered in a receipt.

2.2 Provided by you

• Phone number — for WhatsApp OTP verification, and to recover your account on a new phone. Your full phone number is also printed, next to your name, on the PDF of every receipt you are a party to, which the other party can download and share. The public verification page, which anyone with the receipt code can open, shows your name and your phone number in masked form (e.g. +90•••4567).
• Display name — so the other party can recognize you during pairing. It is also written on each receipt you take part in.
• Agreement contents — items, notes, amounts, dates you enter.
• Saved drafts — if you tap “Save as draft”, the unsent form (the items, amounts, dates and notes you had entered so far) is stored under your account so it survives a reinstall. A draft is visible only to you: it has no counterparty, no signature and no verification record until you actually send it.
• Push notification token — so we can alert you when the other party acts.
• Subscription status — SEAL Plus is sold only through Apple In-App Purchase and Google Play Billing. Apple or Google processes the purchase, and RevenueCat (our subscription-status provider) tells us about it. We record whether your account has an active subscription, the store’s transaction identifier for it, and when its status last changed (for example a purchase, renewal or expiry). We never receive or store your card, bank, or app-store account details.

3. How We Use It

• Operating the service: creating, signing, sharing, and verifying agreements.
• Security: session, OTP, and signature verification; rate limits; abuse prevention.
• Notifications: surfacing revisions / approvals / rejections from the other party.
• Audit chain: cryptographically recording who did what, when — this is the core legal value of the app.
• Error tracking: when the app or our server hits an error, a crash or error report is sent to Sentry so we can find and fix the problem; a small sample of performance measurements is sent the same way. Error tracking is on in every released version of the app and the server.
• Subscription management: unlocking SEAL Plus features for your account, restoring your subscription after a reinstall or on a new device, and preventing repeated free trials.

4. Legal Basis

• Performance of contract (account + agreement records, phone verification, saved drafts, subscription status).
• Legal obligation (required disclosures).
• Explicit consent (push notifications, given through your device’s notification permission; you can withdraw it in your device settings).
• Legitimate interest (rate limiting, fraud and abuse prevention, crash and error reports).

5. Third-Party Data Processors

International transfers rely on processors’ contractual safeguards in accordance with applicable data protection laws.

6. Retention

• Verification codes: each WhatsApp code expires after 5 minutes and is stored only as a salted hash. Your phone verification record (phone number, verification status and time) is kept until you delete your account, because it is how you recover your account on a new phone.
• Pairing codes: 30 minutes (auto-deleted via TTL). A minimal pairing statistic (that a pairing was started or joined, when, and the internal account IDs involved; no phone number or name) is kept with no automatic expiry.
• Signing challenges: 5 minutes (auto-deleted via TTL).
• Receipts and their audit-chain entries: kept with no automatic deletion period. A sealed receipt is a record shared by two people, so deleting your account does not delete sealed (or rejected) receipts you share with someone else. They are removed from your own lists, but stay in the other person’s archive and on the public verification page, with the name recorded on the receipt. A receipt that is not yet concluded is different: when you delete your account, a pending receipt you sent is withdrawn (deleted for both parties, its verification link stops working), and a pending receipt sent to you is closed as rejected so the sender is not left waiting. Audit-chain entries are kept unchanged — including the action type and time, your internal account ID and device ID, the device-key fingerprint, the signature, the signed message (for an edit, or a rejection with a reason, this includes that text) and the masked phone number recorded at the time — because changing or removing an entry would break the chain for every later entry.
• Withdrawn receipts: while a receipt you sent is still pending (not yet sealed or rejected), you can withdraw it with “Delete completely” in your Archive. The receipt is then deleted for both parties and its verification link stops working; its audit-chain entries stay unchanged so the chain remains verifiable.
• Account record: after account deletion we keep a pseudonymous record: your internal account ID, its creation date, a “deleted” flag and the deletion date, the hash of your device’s operating-system identifier, and your subscription status with the store’s transaction identifier(s) and when that status last changed, so that existing receipts still point to a stable ID. Your display name is removed from it.
• Anti-abuse hashes: a one-way, peppered SHA-256 hash of your phone number and of your device’s operating-system identifier is kept after account deletion, so that deleting and re-creating an account cannot be used to reset trial eligibility.
• Saved drafts: until you send them, delete them in the app, or delete your account. They are deleted outright with the account — nothing about a draft is retained.
• Logs and error reports: server log lines (kept up to 30 days) and crash or error reports already sent to Sentry can contain your display name, phone number or internal account ID; account deletion does not erase them, and they expire under those retention periods. Copies held by our processors (for example Twilio’s record of the WhatsApp codes sent to your number, and RevenueCat’s subscription record) are kept under their own retention periods.

7. Your Rights

You may:

• Ask for access to the personal data we hold about you,
• Rectify inaccurate or incomplete data,
• Delete your account at any time in the app (Settings → Delete My Account) or request deletion by email, subject to the retention described in section 6 (see Account Deletion),
• Object to automated processing that adversely affects you,
• Request limitation of processing,
• Seek compensation for damages caused by unlawful processing.

Send requests to support@getseal.app. We reply within 30 days.

8. Security Measures

• All network traffic is encrypted with TLS (HTTPS), and the database is encrypted at rest by MongoDB Atlas.
• Database access requires authenticated credentials.
• Private signing keys live only in your device’s secure storage (iOS Keychain / Android Keystore) — never transmitted to our servers.
• OTP codes are stored as salted SHA-256 hashes, never plaintext.
• Rate limiting + trusted-host middleware protect against common attacks.

9. Children

SEAL is not intended for users under 18. Personal data of minors that we become aware of is deleted on request.

10. Changes

We may update this policy. The current text is published on this page with its last-updated date and version number.

11. Contact

Data protection inquiries: support@getseal.app