SignPact Privacy Policy
On-device PDF form filling, signing, and scanning
Effective date: October 26, 2026
1. Who we are and what this policy covers
Sycana Health AI LLC (we, us, or our) publishes SignPact. We are located at Little Rock, Arkansas, United States.
This policy applies to the SignPact Android app and the SignPact iOS app, including on-device PDF processing, the encrypted signature vault, scanning, and backups. It does not apply to sycana.com, the Sycana healthcare referral platform, or services operated by Apple, Google, or other third parties.
2. Summary
SignPact processes your documents and signatures on your device. Sycana does not receive your PDFs, signatures, or form data. Signatures are encrypted at rest. If you enable iCloud Keychain, the encryption key may sync through your own Apple account; Sycana cannot access it. There are no SignPact accounts, no Sycana analytics, and no advertising or cross-app tracking SDKs.
3. Information you create
SignPact stores the PDFs you import or scan, form-field values, signatures and initials, quick-fill profile data (such as name, email, phone, and address), saved signatures, export records, and audit information. This information is used only to provide the app's document, signing, scanning, export, and backup features.
Sycana does not receive this content and does not sell it. Documents you export or share leave the app only when you choose to send them.
4. Encryption and biometrics
Signatures and initials are encrypted on device using AES-256-GCM and stored in the app's sandboxed storage. Optional biometric or device-credential authentication protects access to saved signatures. We do not receive or store your fingerprint, face data, or device passcode.
On iOS, the encryption key may be saved with iCloud Keychain synchronization when iCloud Keychain is enabled. Apple encrypts and manages iCloud Keychain; Sycana cannot access the key. If you prefer device-local storage, disable iCloud Keychain for the device or use the app's local-only option where available.
5. Scanning and OCR
SignPact can scan documents using Google ML Kit's document scanner on Android or Apple's VisionKit on iOS. Camera or photo access is requested only when you choose to scan or import. Scanning and text recognition happen on your device; Sycana does not receive your images or recognized text.
On Android, Google may collect limited diagnostic and usage data through ML Kit under its own terms and Google's Privacy Policy; see Google ML Kit Terms.
6. Backups and exports
On Android, SignPact can create a portable ZIP backup. Documents and manifest metadata inside the ZIP are not encrypted; saved signatures are re-encrypted with a random backup key that is wrapped by your passphrase. Anyone with the ZIP and passphrase may be able to read its contents. Choose a strong passphrase, store the backup securely, and delete old copies. SignPact does not upload backups automatically.
Exported PDFs and other files leave the app only when you choose to share or save them. The recipient and the app you use handle them under their own policies.
7. Purchases and subscriptions
SignPact Pro purchases and subscriptions are processed by Google Play Billing on Android and Apple In-App Purchase on iOS. On Android, SignPact currently offers a one-time lifetime unlock; on iOS, it may offer a lifetime purchase and monthly or yearly subscriptions. We receive the product identifier, purchase state, and the transaction or entitlement token needed to unlock and restore Pro features. We do not receive or store your payment card number or full billing address.
Google and Apple process payment and account data under their own privacy policies: Google's Privacy Policy and Apple's Privacy Policy. Purchase state may be cached locally so the app can work offline and restore purchases.
8. No sale, advertising, or tracking
We do not sell, rent, or share personal information for advertising. The app does not include Sycana-operated advertising, analytics, or cross-app tracking SDKs, and we do not use your content for advertising or eligibility decisions.
We do not request App Tracking Transparency permission because we do not track you across apps or websites owned by other companies.
9. Legal bases, rights, and choices
If the GDPR or UK GDPR applies, we process purchase and entitlement data to perform our contract with you, and for our legitimate interests in operating, securing, and supporting the app. We do not receive the content you create in the app. Apple and Google act as independent controllers for their store services.
Depending on where you live, you may have the right to access, correct, delete, port, object to, or restrict processing, and to withdraw consent. Because we do not hold your app content, most requests are fulfilled on your device or through your Apple or Google account. You may also contact privacy@sycana.com. You can complain to your local data-protection authority.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use personal information for cross-context behavioral advertising. You may contact privacy@sycana.com to exercise applicable rights.
India: where the Digital Personal Data Protection Act applies, you may contact our grievance contact at privacy@sycana.com to exercise rights of access, correction, and erasure.
10. Retention and deletion
Documents, signatures, and profile data remain on your device until you delete them in the app, clear the app's storage, or uninstall the app. Backups and exports you created remain wherever you saved them. If iCloud Keychain synchronization is enabled, the encryption key may remain in your Apple account until you remove it through Apple's settings. Sycana has no server-side copy to delete.
11. Security
App data is stored in the app's private sandbox and protected by your device operating system. Optional biometric unlock uses the operating system's authentication APIs; we do not receive or store your fingerprint, face data, or device passcode.
On iOS, SignPact can exclude its files from iCloud backup; this is a setting you control. Signatures are encrypted, but documents inside Android backup ZIPs are not.
No method of storage or transmission is completely secure. Keep your device protected with a passcode, current system updates, and a secure backup location.
12. Children
The app is a general-purpose utility and is not directed to children under 13 (or under 16 in the European Economic Area and the United Kingdom). We do not knowingly collect personal information from children. If you believe a child has provided information, contact privacy@sycana.com.
13. International transfers
Sycana is based in the United States. Apple and Google process store, payment, and sync data globally under their own policies and safeguards. We do not transfer the content you create in the app to Sycana servers because we do not receive it.
14. Changes to this policy
We may update this policy. The effective date at the top will change, and material changes will be presented in the app or store listing before they take effect. Continued use after the effective date means you accept the revised policy.
15. Contact
Privacy questions and requests: privacy@sycana.com.
Legal notices: legal@sycana.com. Support: contact@sycana.com.
Sycana Health AI LLC, Little Rock, Arkansas, United States.
Questions about this document?
Email privacy@sycana.com for privacy requests, legal@sycana.com for legal notices, or contact@sycana.com for support.