Privacy Policy
Last updated: September 4, 2026
Core principle
PARAMANT collects only what is strictly required to operate your account and run the service.
An email address is required to create an account and recover access; it is personal data, and it is stored. No phone number. We do not log IP addresses for analytics or profiling. An IP is processed for security and abuse-prevention only (rate limiting, the session record, an audit log, and the DPA signature record), the audit trail keeps a masked address for up to 400 days, and one log holds a full address for longer than any timer; both are named below. Only a strictly-necessary session cookie (no tracking cookies). No tracking pixels. No analytics. No advertisements. We never sell your data.
How Ghost Pipe & ParaShare (the ParaSend web app) work
Files sent through the web app are encrypted client-side in your browser using post-quantum cryptography (ML-KEM-768 + ECDH P-256 + AES-256-GCM + HKDF-SHA256) before they ever reach our servers. The relay never sees plaintext on that path. The one place it does is the hosted signing ceremony on the /v1 API, where the document is sent to us so that we can run the ceremony; we hold it, sealed at rest under our own key, until that envelope ends.
Files are split into 5 MB encrypted chunks. Each chunk exists only in RAM on our relay server. On the Community plan it is permanently and irreversibly destroyed after the first download (burn-on-read); a paid plan buys more reads per link through the API before that same destruction, up to 10 on Firm and 100 on Enterprise. Encrypted payload data is never written to disk. From a transfer, the only thing persisted to disk is cryptographic hashes in the public Certificate Transparency log: no file content, no keys, no plaintext. (Account data, listed below, is stored separately to run your account.)
Community plan blobs expire after 1 hour maximum. Firm blobs after 24 hours. Enterprise blobs after 7 days. All are destroyed earlier once the last read of the link is spent.
How ParaSign document delivery works
When you request signatures, your browser encrypts the document with AES-256-GCM before upload. The signing relay stores the encrypted capsule with the envelope until its expiry: 30 days unless the request asks for another term, and never longer than 365 days. The relay does not receive document plaintext or the document key. The personal signing link contains the key in its URL fragment; browsers do not send that fragment to the relay.
When a signer places a visible seal or date, the relay stores the signed field type, page number and normalized coordinates in the envelope. It does not receive document text, a drawn signature image or free-form field content. The placement is covered by the signer’s ML-DSA-65 signature.
The recipient must also sign in with the exact invited email address. The link alone cannot retrieve the ciphertext. If you choose Paramant email delivery, Resend processes the recipient address, message and complete signing link. It does not receive document plaintext. You can instead create links without sending email.
What we process
| Data | Purpose | Storage | Shared |
|---|---|---|---|
| Encrypted blob (5 MB padded chunks) | One-time secure transfer | RAM only · burn-on-read | Never |
| ParaSign encrypted document capsule | Deliver the document with a signing request | Redis · expires with the envelope | Hosting provider stores ciphertext only |
| Personal ParaSign invitation link | Bind one recipient to one encrypted document and signing slot | Processed during delivery; not written to application logs | Resend only when you choose email delivery |
| SHA-256 hash of blob | Routing & delivery confirmation | RAM only · deleted after its last read | Never |
| API key (Firm/Enterprise) | Authentication & rate limiting | Loaded from config at startup | Never |
| Device ID (SDK users) | Key routing between sender and receiver | RAM only · cleared on restart | Never |
| Device ID hash (CT log) | Public tamper-evident audit log | Disk · /data/ct-log.json · SHA3-256 one-way hash only | Never |
| Signed delivery receipt | Proof that a transfer was delivered | Redis · 15 minutes, then deleted | Never |
| Aggregated relay statistics | System health monitoring | In-process counters only | Never |
| Email address | Account identity, login, recovery, signing-invite delivery | Stored (server) · also kept as a hash for rate-limiting | Email provider (Resend) for messages we send you |
| Sign-in factors: passkey public keys, TOTP secret (encrypted), recovery codes (hashed) | Account authentication | Stored (server) | Never |
| ParaSign signing public key + fingerprint | Verifiable signing identity | Stored (server) · public half only; the private key never leaves your browser | Public (its hash is in the CT log) |
| Plan + anonymised billing reference | Firm/Enterprise billing | Stored (server) | Payment processor (Mollie, EU) |
| Client IP + user-agent | Security, rate limiting | Session/rate-limit TTL | Never |
| Masked IP in the audit log (1.2.x.x) | Account audit trail | Redis · at most 400 days, and at most 1000 entries per account | Never |
What we never do
- Sell your data, or use it for advertising or profiling
- Log or store IP addresses for analytics or profiling (an IP is used for security and abuse-prevention only, in the logs named below)
- Use tracking cookies or browser fingerprinting (only a strictly-necessary session cookie is set after login)
- Run advertising or tracking scripts
- Share your data with third parties, except the operational subprocessors needed to run the service (hosting, transactional email, and payments, listed below)
- Write Ghost Pipe or ParaShare transfer payloads to disk. ParaSign request documents are different: their encrypted capsule may be persisted until the envelope expires.
- Load fonts, scripts, styles, or any other resource from a third party. Everything is self-hosted on paramant.app
No third-party requests
Every byte your browser loads on paramant.app comes from paramant.app. No web fonts from Google, no JavaScript or CSS from a CDN, no analytics, no tracking pixels, no embedded third-party widgets. Open your browser’s network inspector on any page: every request goes to one origin, and nowhere else.
This is deliberate. A single request to a third party leaks your IP address and the page you are viewing to that party before you have agreed to anything. So we self-host everything: fonts (a plain system font stack, zero font files downloaded), scripts, styles, and images all come from paramant.app.
What runs the service is operational, never tracking: our own edge (Caddy) terminates TLS directly on our server (see below); transactional email is sent server-side via our email provider; and a payment processor handles billing on its own pages. None of these is loaded into the site, and none follows you across it.
Local storage in your browser
For technical functionality, the following data is stored locally in your browser only. It never leaves your device:
- ECDH + ML-KEM key pairs: generated locally for end-to-end encryption (SDK / Ghost Pipe sessions)
- Nonce registry: replay-attack protection (SDK sessions)
- Status history (
paramant_status_v1): the last 24 hours of relay health checks your own browser made on the status page - Signature placement template (
parasign.placement.tpl.v1): where you last put a seal on a page, so the next document opens the same way - Seen signing fingerprints (
paramant_fp_…): a marker per signing key you have already been shown, so a known key is not flagged as new - Dismissed key-setup notice (
paramant.keysetup.dismissed.v1): that you closed the signing-key banner on your dashboard - A gift code you have not spent yet (
paramant.redeem.code): the code you typed on /redeem before you had an account. A code grants nothing on its own and is not a key to anything; it is kept only so that making an account, which finishes through a link in your email, does not cost you the code. It is deleted the moment the code is used. - Appearance (
paramant.theme.v1): whether you asked the app screens to follow your system, go light or stay dark. Dark without it. Nothing is sent to us; the choice lives in this browser and on this device only. - Passkey / WebAuthn credentials: your passkey’s private key is created and held by your device or password manager. PARAMANT only ever stores its public key, server-side; the private key never leaves your device.
- ParaSign signing vault (IndexedDB): if you sign documents, your post-quantum signing key (ML-DSA-65) is generated and kept in your browser’s IndexedDB, encrypted either with your passkey (WebAuthn-PRF → HKDF → AES-256-GCM) or, if your passkey provider cannot do that, with a passphrase (PBKDF2 → AES-256-GCM). The private key never leaves your device; only its public half is registered to your account.
You can delete all local data at any time: browser settings → paramant.app → Clear site data.
Your API key, and which pages hold it
Your account has an API key. It is stored on our servers; nothing in the list above keeps it in your browser, and no page writes it to local storage. Some pages do load it into memory for as long as their tab is open, and we would rather name them than leave you to guess.
- Sending a file (
/parashare) does not. It asks our server for a session token instead. That token lives fifteen minutes, the relay accepts it on the five requests a transfer makes and refuses it on everything else, and it is held in the page’s memory only, so closing the tab ends it. Revoking your API key revokes every token minted from it. On a self-hosted relay without our admin panel you can still type a key by hand on that page, and then it is in that browser for as long as the tab is open, which is why the page says so where it offers it. - Your account page (
/account) does, but only when you ask it to. Showing you your key is what that page is for, so it is the one page that still loads it. Opening Advanced account key is what fetches it; a visit that never opens that section never asks our server for the key at all, and nothing of it is on the page. - The pricing and dashboard pages (
/pricing,/dashboard) no longer do. They used to authenticate to the relay with the key itself, to start a checkout and to read your history. They now use the same kind of session token as the send page: a different token, minted for those pages, which the relay accepts on five requests (starting a checkout, spending a gift code on your own account, reading your own history, exporting your own signing audit, and reading the list of documents waiting for your signature) and refuses on everything else. It is not the send page’s token and cannot do what that one does, or the other way round.
Nothing on this list survives the tab. Closing the page ends it, and a later visit starts again from the server.
Servers & jurisdiction
All relay servers run on Hetzner infrastructure in Nuremberg, Germany (EU/DE). There is no infrastructure in the United States or outside the EU. No CLOUD Act exposure. All data is subject to EU/GDPR jurisdiction only.
Network edge
TLS is terminated by our own edge (Caddy), running on the same Hetzner infrastructure in Germany, with post-quantum key exchange. There is no third-party reverse proxy or CDN in front of the site: your connection reaches our server and nowhere else. Short-lived connection metadata (IP, timestamp) is processed transiently for security and abuse-prevention as described above, never for analytics.
Logs that hold an address
One log holds a full client address, and it is not bounded by a timer. We name it rather than let the word “transient” do work it cannot do.
- Edge access log. Our own edge writes a server access log with the client address, the timestamp, the path and the user agent. We read it to tell real visitors apart from scanners, never to build a profile of a person, and it is not exported to anyone. The nginx configuration in this repository logs nothing; the edge in front of it does.
- Account audit log. Every audit entry keeps the network part of the address and drops the host part, so a full address is never written: 1.2.x.x for IPv4 and the first two groups for IPv6. Entries are bounded twice, by age and by count: nothing older than 400 days survives, and an account keeps at most its last 1000 entries. The 400 days is a default an operator can change.
- Admin service log, for contrast. Three operational lines write about a signup attempt, a pending signup and a rate-limited request to reset a second factor. They used to carry the full address, and one of them the account email in plain text. They no longer do: an address is truncated to its network before it is written (203.0.113.x for IPv4, the first three groups for IPv6) and an email keeps one character and its domain (d***@example.com). What lands in the container log is what is left after that.
None of these is used for analytics, profiling or advertising, and none is shared with a third party.
Subprocessors
A few operational providers are needed to run the service. None is loaded into the site, and none is used for tracking:
- Hetzner (Germany, EU): hosting and infrastructure.
- Bunny.net (Slovenia, EU): DNS hosting for paramant.app. It answers the lookup for our name; it is not a CDN or a proxy, and no request for a page or a file passes through it.
- Resend: transactional email only (account verification, optional signing invites, billing notices). For a signing invite it receives the recipient address, message and complete personal link. Opening the encrypted document additionally requires the invited Paramant account. Resend does not receive document plaintext and is never used for marketing.
- Mollie (a Dutch company, EU jurisdiction, GDPR-native): payment processing for paid plans. Checkout runs through Mollie today. Every payment is a one-off for the term you buy; there are no subscriptions, because the recurring layer stays switched off until an operator sets it. The relay sends Mollie the amount, a plan description and payment metadata (accountId, product, plan, interval), and no email address while the recurring layer is off. Card data is entered on Mollie’s own pages; PARAMANT never sees or stores card numbers, only your plan and an anonymised reference.
- Moneybird (a Dutch company, EU jurisdiction): bookkeeping, and only when the operator of this deployment has connected an administration. It then receives the invoice or credit note itself: the document number, date, description, amounts and VAT, the billing details you entered (company name, invoice address, VAT number) and your email address, together with the PDF of the document. It receives nothing about your files, your transfers or your signatures.
GDPR / AVG
We process the minimum personal data needed to run your account, on a lawful basis (performing the service you request, and our legitimate interest in keeping it secure). You can request access to, or deletion of, your account data by emailing us. The standard Data Processing Agreement (DPA) is published at /dpa and applies to all plans; anyone can sign it electronically, with no account and no paid tier required.
Temporary relay data is never retained longer than the applicable TTL (1 hour for Community, 24 hours for Firm, 7 days for Enterprise). In practice it is destroyed much earlier on download.
Children
PARAMANT is not directed at children under 13. We do not knowingly collect data from minors.
Changes to this policy
We may update this policy. Material changes will be noted via the "Last updated" date above. Continued use of the service after a change constitutes acceptance.
Contact
Questions about this Privacy Policy? Email info@paramant.app.