Your information stays yours.

This policy explains how Cryptid Technologies, Inc. (“BetterSign”, “we”, “us”) handles information on the BetterSign websites (bettersign.ing and its subdomains, such as www.bettersign.ing, tester.bettersign.ing and updates.bettersign.ing) and in the BetterSign apps for iPhone, iPad, Android, macOS, Windows and Linux.

The short version

Information we don’t collect

When you visit our websites, we don’t ask who you are, and we don’t try to work it out. We don’t:

• use advertising, retargeting or social-media tracking pixels;
• use third-party analytics that follow you across sites;
• set cookies to identify or track you;
• buy or receive information about you from data brokers.

The homepage remembers one setting in your browser’s local storage: whether you chose the “Plain speak” or “Technical” view. It stays on your device and is never sent to us. You can clear it at any time by clearing your browser’s site data.

Information you choose to share with us

We only receive personal information when you send it to us. For example:

• Emails. If you email us (for example, to ask for early access or to become a design partner), we receive your email address and whatever you write, and we use them to reply.
• Alpha-tester signup (tester.bettersign.ing). If you sign up to test BetterSign, we collect what you enter in the form: your contact email; an optional name, Google account email and Apple ID; the kinds of devices you’ll test on; whether you’re interested in custom (AOSP) Android builds; and any notes you add. We use this only to run the test program: to invite you to Google Play internal testing or Apple TestFlight, to send you install instructions, and to reply to you. We email you a confirmation when you sign up.
• Our clients. If you are an organization that works with us, we receive whatever information you share with us to deliver the service, and we use it only for that purpose.

Technical information

Like every website, our servers must receive some technical information to deliver a page to you, such as your IP address, your browser type and the page you asked for. Our websites are hosted on Cloudflare, which processes this information to deliver and protect the sites (for example, to block attacks and spam). We don’t use it to identify you.

On the tester signup form, we limit how often one network can submit the form. To do this we keep a salted, one-way hash of your IP address, not the address itself, and delete it when the hourly limit window ends.

Our download and update service (updates.bettersign.ing) serves installers and update files. It doesn’t need an account, and we don’t link downloads to individual people.

The BetterSign apps

The BetterSign apps are built so that we don’t need your personal information.

• No account needed. You don’t need an account, email address or phone number to use the app. Your identity is created on your device.
• Your keys, contacts and messages stay on your device. Your private keys never reach our servers. Your name and profile photo stay on your device too. If you make a backup, it’s encrypted with a passphrase you choose and saved wherever you put it.
• Your public identity record is public. So that others can verify you, the app publishes your public identity record to the peer-to-peer network. It holds your public keys and signatures, not your name or photo. Devices you connect to on the network, including our bootstrap server, can see your IP address.
• Messages are encrypted on your device. Our relay server, and other BetterSign devices that help deliver messages, pass them on without being able to read them. To deliver a message, they can see which identity it’s addressed to, its size and when it was sent. If you run the desktop app, it helps in the same way: it stores and passes on other people’s encrypted messages, which it can’t read.
• Notifications. To deliver notifications, the app uses Google’s Firebase Cloud Messaging and, on iPhone and iPad, Apple’s push service. Your device’s push token goes to them, and to the relay of any browser you pair with the BetterSign browser extension.
• Permissions. The camera is used only to scan QR codes, and the photo library only to choose a profile photo. Face ID or your fingerprint is checked by your phone itself, and we never receive biometric data.
• Signing in to websites. When you sign in to a website with BetterSign, the app sends that website your public identity and a signature proving it’s you. If you sign a document, it also sends the signature you drew.
• Link previews. When a message contains a link, the app fetches a preview straight from that website, which can see your IP address. You can turn this off with Generate link previews in Settings.
• Updates. The desktop app checks updates.bettersign.ing for new versions, which shares your IP address, platform and app version.
• No analytics. The apps don’t include analytics, advertising or crash-reporting tools.

Who we share information with

We don’t sell, rent or trade personal information. We share it only:

• With service providers who help us run the websites, the apps and the test program, and only as needed for that purpose: Cloudflare (hosting, storage, security and email delivery); Google (Firebase Cloud Messaging for notifications, and Google Play internal testing if you ask to test on Android); and Apple (push notifications, and App Store Connect and TestFlight if you ask to test on iPhone or iPad).
• When the law requires it, such as in response to a valid court order.
• If our business changes hands, for example in a merger or acquisition. This policy would continue to protect your information.

How long we keep it

We keep information you share with us only as long as we need it for the reason you gave it. For example, we keep tester signup details for the length of the test program, or until you ask us to delete them, whichever comes first.

Your choices and rights

You can ask us at any time to:

• tell you what information we hold about you;
• correct it;
• delete it;
• stop emailing you.

Email contact@bettersign.ing and we’ll respond within 30 days. Depending on where you live (for example, the EU, the UK or California), you may have more rights under local law, and we’ll honor them.

Security

We protect the information we hold with reasonable safeguards. All our websites use HTTPS, and only our team can see tester data, after signing in. No system is perfectly secure, but we keep as little as we can, which limits what could ever be exposed.

Children

Our websites aren’t directed at children under 13 (or under 16 where local law sets a higher age), and we don’t knowingly collect information from them. If you believe a child has sent us information, contact us and we’ll delete it.

Links to other sites

Our websites link to other sites, such as Google Play, Apple’s App Store and TestFlight, and GitHub. Those sites have their own privacy policies, and we aren’t responsible for them.

Changes to this policy

If we change this policy, we’ll post the new version here and update the effective date at the top. If a change materially affects information you’ve already given us, we’ll tell you by email before it takes effect.

Contact us

Cryptid Technologies, Inc.
Email: contact@bettersign.ing