Privacy policy
This policy explains what personal data SignBit Ltd collects when you use SignBit, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
Summary
We collect what we need to run your account and our service: your name and email address, a record of your sign-ins, the details of the vaults you use with us, and what you choose to tell us. We do not sell personal data, we do not use advertising or tracking cookies, and we do not build marketing profiles.
We never receive your private keys or your recovery phrase. They are created on your own devices and stay there. Nothing in this policy can affect your bitcoin, because we cannot move it on our own.
If our systems were ever breached, an attacker could obtain account records, but not anyone's bitcoin, because your bitcoin is protected by keys we do not hold.
Who we are
SignBit is software for securing your own bitcoin with multi-signature vaults. It is provided by SignBit Ltd, a private limited company incorporated in England and Wales with company number 17487090, whose registered office is at Suite A, 82 James Carter Road, Mildenhall IP28 7DE, United Kingdom. We are the controller of the personal data described in this policy, and we are registered with the Information Commissioner's Office under registration number ZC261456.
You can contact us about anything in this policy at [email protected].
What this policy covers
This policy covers our websites, including signbit.io and testnet.signbit.io, the SignBit app, our co-signing service, the emails we send and our support. It applies to our customers, to people who hold a key in a vault on SignBit, and to people whose details reach us in other ways, such as beneficiaries and people who make an inheritance claim.
Fountain, our signing app, does not send any data to us or to anyone else. It keeps your keys encrypted on your own device and makes no network connections.
When you leave SignBit for another service, for example Stripe to pay, Google to sign in, or a block explorer to look up a transaction, that service's own privacy policy applies.
Information we collect
Account details. Your name, your email address, and your password if you set one, which we store only as a one-way hash that we cannot read or recover. We also record when you accepted our terms and which version you accepted.
Sign-in and security records. Each time you sign in, we record the time, your IP address, the country and approximate city your connection comes from, and your browser's user-agent, which tells us the kind of device and browser you used. We also keep the country you signed up from, and the IP address and country of your most recent activity. We use these records to protect your account, to investigate misuse, and to help confirm your identity if you lose access. The city comes from your IP address, not from your device's location, and is often wrong.
Two-factor authentication. If you turn it on, we store the secret your authenticator app uses, and your backup codes, which we store only as one-way hashes. If you ask us to reset two-factor authentication, we record the request, including your IP address, the country and approximate city it came from, and your browser and device, and the checks we made before deciding it.
Preferences. Your language, display currency, timezone and preferred block explorer, and whether other SignBit users can find you by email to invite you to a vault, which is off unless you turn it on.
Vault information. For each vault you create or join: its name, the public keys and descriptor that define it, its addresses, balances and spending rules, and its transactions, including the addresses paid, the amounts, and the labels, notes and comments that keyholders add. A vault's public keys reveal all of its addresses and balances, to us and to everyone else who holds them. Much of this is also public on the Bitcoin blockchain, but we link it to your account, so we treat it as personal data. Names, labels and notes are ordinary text that our staff can read.
People you invite. If you invite someone to hold a key in a vault, we store the email address you enter. We only send an invitation to an existing SignBit account whose owner has chosen to be found by email.
Support. Your support tickets, their messages and any files you attach, and emails you send us. Everyone on a ticket can read it, including our staff and anyone added to it. If you paste a recovery phrase into a ticket message, we remove it before it is stored.
Optional postal address. You can add a postal address in Settings if you want us to be able to write to you. It is blank unless you fill it in, nothing depends on it, and you can remove it at any time. We do not run identity checks, and we never use your address to grade, verify or restrict your account.
Sign in with Google. If you choose it, Google gives us your name, your email address, whether Google has verified that address, and an identifier for your Google account. We use these only to create your account and to sign you in. We ask for nothing else, we keep no Google access token, and we do not store your Google profile picture. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Billing. If you subscribe to a paid plan, we keep your plan, its status and renewal date, and the reference numbers our payment processor gives your customer record and subscription. Your card details go straight to the processor and never reach us.
Our record of what we co-sign. When we add our signature to a transaction, our signing service records which vault it was for, the address paid, the amount and the time. That service is separate from the rest of SignBit and holds no name, email address or IP address. It also keeps the public descriptor of every vault registered with it, so that the same vault cannot be presented to it under a different name. This record is what makes a daily limit measurable, and it is our own record of what we signed.
Notes and records our staff make. Our staff may record notes about an account or a claim, for example the reason an account was restricted or a claim was decided, and our systems log the actions staff take on accounts.
Referrals. If you sign up through someone's referral link, we record whose link it was and whether a credit was given for it. The person who referred you sees only how many people joined and paid through their link, never who. To check that nobody is referring their own second account, we compare the card fingerprints our payment processor gives us for your payments with those of the person who referred you and of the others they referred: a fingerprint is a code that identifies a card without revealing its number.
Beneficiaries
A vault's keyholders can record who should inherit it. For each beneficiary they may give us a name and, if they choose, a relationship, an email address, a phone number and notes. This is information about someone who may never have used SignBit, so we treat it with particular care: we use it only as described here, and never for marketing.
We use these details to show them to the vault's keyholders, to print the vault's recovery plan, and to help our staff assess an inheritance claim. We email a beneficiary only if a keyholder asks us to, and only to ask whether the address reaches them and whether they are willing to be listed. That email names no one and mentions no money.
A beneficiary can ask us what we hold about them, ask us to correct it, or ask to be removed, by writing to [email protected]. We will also tell them who listed them, because someone asked to confirm an inheritance arrangement is entitled to know where it came from. Keyholders can edit or remove a beneficiary at any time, and removing one deletes the record. The vault's history keeps only a short one-way fingerprint of the details, which lets us confirm in an estate or legal process that a given person was listed.
If someone tells us they do not want to be contacted, we keep their email address for one reason only: so that we never contact them about that vault again. It is a block, never a mailing list, and it is kept for as long as the vault exists.
Inheritance claims
Anyone can ask to recover a vault after its owner has died or can no longer act, using our public claim form. If you make a claim, we collect the details you give us: your name, the address the bitcoin should be sent to and, if you choose, your email address, phone number, a statement and a passphrase, which we store only as a one-way hash. We also record your IP address, the country and approximate city your connection comes from, your browser and device, and the proofs you sign with the vault's keys.
If you send us documents, such as a death certificate or a grant of probate, we keep them with our records of the claim. They can contain information about the person who died and about you.
We use this information to assess the claim, to keep the vault's owner and keyholders informed, and to complete or refuse the transfer. While a claim is open, we email the vault's owner and keyholders about it, and those emails include your name, and in the owner's case the address you gave.
Staff who handle claims can see the claim, the vault's beneficiaries and the owner's contact details, and they may compare where and on what device a claim was made with where the owner usually signs in. We keep a claim and the decision on it as a permanent record of what happened to the vault, but we delete the claimant's IP address, approximate city and device details after 12 months. A claim is deleted if its vault is deleted.
What we never collect
Keys and recovery phrases. Private keys, seed phrases and recovery phrases are created on your device, by you or by Fountain, and are never sent to us. If anyone claiming to be from SignBit asks for your recovery words, they are trying to steal from you. We will never ask.
Card numbers. Payments are handled by Stripe, and your card details go to them, not to us.
Tracking data. We use no advertising or analytics trackers, and we do not follow you across other websites.
Identity documents. We do not ask for identity documents to open or use an account.
How we use information, and our legal basis
We use personal data only where the law allows it. For each purpose below, the legal basis we rely on is given in brackets.
To provide your account and the service: signing you in, showing your vaults, building and co-signing transactions within your rules, coordinating keyholders, and sending the emails the service depends on, such as security alerts, signing requests and inheritance claim notices. (Performance of our contract with you.)
To keep accounts and the service secure: detecting and investigating misuse, applying rate limits and spending limits, running security checks at sign-up, and confirming your identity if you lose access. (Our legitimate interest, and yours, in accounts and vaults that cannot easily be taken over.)
To support you: answering your tickets and emails, and keeping a record of what was discussed. (Performance of our contract with you, and our legitimate interest in giving good support.)
To handle inheritance planning and claims: keeping beneficiary details, contacting a beneficiary when a keyholder asks, and assessing and completing claims. (Our legitimate interest, and the vault owner's, in making sure a vault can pass to the right people.)
To send reminders: for example if you have not signed in for a long time, or a yearly prompt to review your vaults. These are service messages, not marketing. (Our legitimate interest in your vaults staying recoverable.)
To bill you, if you take a paid plan, to run our referral programme (giving discounts and credits, and checking it is not misused), and to keep the financial records the law requires. (Performance of our contract with you, our legitimate interest in preventing misuse of the programme, and our legal obligations.)
To comply with the law and protect our rights: meeting our legal obligations, establishing or defending legal claims, and, only when the law requires it, answering requests from authorities, which we check carefully first (see "Who we share information with"). (Legal obligation, and our legitimate interests.)
We do not send marketing emails, and we do not use your data for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects: account recovery and inheritance claims are decided by people. If you do not give us an email address, we cannot open an account for you.
Cookies and similar technologies
We use only cookies that SignBit needs to work: one that keeps you signed in for up to 30 days, and short-lived ones used while you sign in and complete two-factor authentication, which expire within minutes. We set them ourselves, not through third parties, and because they are strictly necessary we do not ask for consent to them.
Your browser also stores some information on your device: your preferences, such as language, theme and display options, a copy of your profile so that pages load quickly, which is removed when you sign out, unsent form drafts, and your email address on the sign-in page if you ask us to remember it. It stays in your browser, and you can clear it at any time.
Our sign-up and password reset pages may use Cloudflare Turnstile, a security check that tells people apart from automated abuse. Cloudflare receives your IP address and technical information about your browser for that purpose. We use no advertising or analytics cookies.
Who we share information with
We share personal data with the service providers who help us run SignBit, under contracts that require them to protect it, and with others only where the law requires or allows it. We never sell it.
Hosting. Our cloud hosting provider runs our servers, our database and our signing service, and stores our backups.
Network and security. Cloudflare provides our domain names and carries the traffic to our websites, so it sees visitors' IP addresses. It also provides the security check described above.
Email. Our email delivery provider sends our emails, so it processes the address and contents of each one. Our support mailbox runs on Google Workspace, and if you book a call with us, you do so on Google Calendar, which receives the details you enter.
Payments. Stripe processes payments for paid plans. It receives your name, email address, chosen plan and payment details, and an internal reference to your account, and it is responsible for your card data.
Google sign-in. If you sign in with Google, Google confirms who you are to us, and in doing so learns that you signed in to SignBit.
Bitcoin data. We run our own Bitcoin node and ask it first. When it cannot answer, we ask public block explorers, which then receive the addresses and transaction IDs we look up and any transaction we broadcast. These requests come from our servers, not your browser, so they are not linked to your IP address, although the providers can tell that they come from SignBit. We also check the current block height with several independent sources, and those requests carry nothing about you.
Price data. We fetch the bitcoin exchange rate from several public price sources. Those requests carry nothing about you.
Advisers and authorities, only as a last resort. We share information with our own lawyers, accountants and auditors only as far as they need it to advise us, and they must keep it confidential. We give information to the police, courts, regulators or other authorities only when the law requires it, or when it is needed to stop fraud or other crime. Before we do, we check that the request is lawful and properly made, we share only what it covers, and we challenge requests that go further than the law allows. Where the law lets us, we tell you first. We hold as little about you as we can, and we can never move your bitcoin on our own.
A change of ownership. If SignBit Ltd is sold or reorganised, personal data may pass to the new owner, who must continue to protect it as this policy describes.
The other keyholders of a vault you share can see that vault's information, including your name. We can give you a current list of our service providers on request.
International transfers
Our hosting provider currently stores our database and runs our servers in the United States. Some of our other providers, including our email provider, Stripe, Google and Cloudflare, also process data in the United States or elsewhere outside the UK.
Whenever personal data leaves the UK, we make sure it is protected by a safeguard recognised by UK law, such as adequacy regulations, including the UK extension to the EU-US Data Privacy Framework where a provider is certified, or the International Data Transfer Agreement or Addendum issued by the ICO. If you are in the European Union, your data is transferred to the UK under the European Commission's adequacy decision for the UK. You can ask us for more information about these safeguards.
How long we keep information
Sign-in records and IP addresses are deleted after 12 months by an automatic daily job. Where a record also has value to other people, such as a vault's history, which every keyholder relies on, or the log of actions our staff take, we keep the record but remove the IP address, approximate city and browser details from it after the same period.
Account details, preferences and support tickets are kept while your account is open and deleted when it is closed, as the next section explains.
Vault information, including transaction history, is kept for as long as the vault exists on SignBit, because its keyholders rely on it. A deleted vault leaves only a short record that it existed: its name, its owner, its size, and when it was deleted.
Our co-signing record is kept in two parts, on two clocks. The address paid and the amount are erased after 90 days. The rest, the bare fact that we signed a particular transaction for a particular vault at a particular time, is kept permanently, because it is what stops the same transaction being presented to us twice and counted once. A transaction stays valid for as long as the coins behind it are unspent, so that check cannot be given an expiry date. The descriptors registered with our signing service are also kept permanently, so that a vault's limits cannot be reset by presenting it under a new name. If a vault is deleted, the address and the amount are erased once each payment is more than a day old, rather than after 90 days: a daily limit covers the previous 24 hours, and erasing a payment inside that window would give the vault an allowance it had already used.
Beneficiary details are kept until a keyholder removes them or the vault is deleted. A request not to be contacted is kept for as long as the vault exists.
Inheritance claims are kept permanently as part of the vault's record, except the claimant's IP address, approximate city and device details, which are deleted after 12 months. A claim is deleted with its vault.
A postal address is kept until you change or remove it, and is deleted with your account. We do not delete it on a timer: unlike an IP address, which we observe and which goes out of date, an address is something you chose to give us, and it stays correct until you change it.
Invoices and payment records held by our payment processor are kept for at least six years, because UK law requires us to keep financial records.
Backups of our database are kept for up to 90 days and then deleted. Data you delete stays in older backups until they expire. We never restore a backup to bring deleted data back, and we do not use backups for any other purpose.
Operational logs, which can include IP addresses, email addresses and payment details, are kept by our hosting provider for up to 30 days and then deleted.
Records of a deletion or of a staff action are kept for as long as we may need them to show what we did and to deal with legal claims.
Error reports. When something fails, on our servers or in your browser, we record the technical details of the failure, the page or feature involved, your browser's user-agent and, if you are signed in, your account, so we can find and fix the cause. We never record what you typed or sent, such as passwords, keys or recovery phrases. Error reports are deleted after 90 days.
Closing your account
You can ask us to close your account and delete your personal data by writing to [email protected] from the email address on your account. We will confirm when it is done.
If you own a vault, or hold a key in one, we cannot close your account until that vault has been deleted or, if you own it, handed over to another keyholder, because other people may rely on it to reach their own bitcoin. We will explain the options and help you with them.
When we close your account, we delete your account details, password, sign-in history, preferences and support tickets, and we cancel any paid plan. Some information is kept, as the previous section explains: shared vault records that other keyholders rely on, our co-signing record, records of actions our staff took, and a short record of the deletion itself, which includes the name and email address on the account.
Closing your SignBit account does not move, freeze or put at risk any bitcoin. Your keys and your vault's descriptor keep working, with or without us, and our guide to recovering without SignBit explains how.
Your rights
Data protection law gives you rights over your personal data. You can ask us for a copy of it, ask us to correct it or delete it, ask us to restrict how we use it, and object to how we use it where we rely on legitimate interests. You can also ask for the data you gave us in a structured, machine-readable format, or ask us to send it to another organisation. Some of these rights have conditions and exceptions, which we will explain if they apply.
You can correct most of your details yourself in Settings, and you can export your vault records from the app. For anything else, write to [email protected]. We may need to confirm your identity first, and we will normally ask you to write from the email address on your account.
We will reply within one month. If a request is complex, or you make several, we may need up to two more months, and we will tell you if so. We do not charge, unless a request is clearly unfounded or excessive.
Exercising your rights never affects your access to your bitcoin. Your keys are yours, whatever happens to your SignBit account.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first, at [email protected]. We will acknowledge your complaint within 30 days, look into it, keep you informed, and tell you the outcome without undue delay.
You also have the right to complain to the UK Information Commissioner's Office (ICO), or the data protection authority in your country. The ICO's website is ico.org.uk.
How we protect information
We protect personal data with technical and organisational measures suited to the risk. Information travels encrypted, passwords are stored only as one-way hashes, our staff's access is limited by role and sensitive access is recorded, and two-factor authentication is available for your account. We recommend you turn it on.
Our signing key is kept apart from the website and its database, protected by a hardware security module, and every use of it is recorded. A compromise of the website alone cannot produce our signature.
No system is perfectly secure, and we will not claim otherwise. What the design does guarantee is that an attacker who took over our entire infrastructure still could not move your bitcoin, because they would still be missing your keys.
If a breach of your personal data is likely to put your rights at risk, we will tell you without undue delay, and we will report breaches to the ICO where the law requires.
Children
SignBit is for adults. You must be 18 or over to open an account, and we do not knowingly collect personal data from children. A keyholder may record a child as a beneficiary, and in that case we hold only what the keyholder gives us, as described above.
Changes to this policy
We will update this policy when what we do changes, or when the law does. The date at the top shows when it last changed.
If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect, rather than rely on you noticing a new date.
Contact
Email [email protected] with any question about this policy or to make a request about your data, or write to us at SignBit Ltd, Suite A, 82 James Carter Road, Mildenhall IP28 7DE, United Kingdom.
We have not appointed a data protection officer, because the law does not require one for an organisation of our size and kind. Data protection at SignBit is overseen by our founder.
No genuine message from SignBit will ever ask for your recovery phrase, your private keys or your password.