Privacy

This note explains what Online Contracts stores while you use the service at online-contracts.com.

Account data

We keep your name, email, optional company, password hash, plan, account status, and sign-in timestamps. Passwords are stored with bcrypt and are never written in plain text.

Documents and recipients

When document features are used we store the file, a SHA-256 hash, page count, field positions, recipient names and emails, access tokens, signature values, IP addresses, user agents, and an audit log in UTC.

Security mail

Confirmation and password-reset messages are sent through SMTP credentials you configure. Tokens in those messages expire and are stored only as hashes.

Cookies

A session cookie keeps you signed in and holds a CSRF token for forms. There are no advertising cookies.

Retention

Account and document records remain until you ask for deletion, or until the workspace is closed. Login-attempt rows are operational and may be pruned.

Contact

Privacy requests: hello@online-contracts.com