sahiLegal
Privacy Policy
Last updated 12 November 2026
Sahi lets you sign PDFs on your iPhone and send them to other people for signature. To do that we handle your documents, your signature and the contact details of the people you invite. This policy explains what we collect, why, who helps us, how long we keep it and the choices you have.
1. Who we are
Sahi is made by One Byte Studio ("we", "us"). We are the data controller for the personal information described in this policy. This policy covers the Sahi app for iPhone and this website, sahi.onebyte.studio.
2. What we collect
Information you give us
- Account details. When you sign in with Apple, Google or your phone number we receive an account identifier and, depending on the method, your name, email address or phone number. You can also use Sahi as a guest without giving these details.
- Documents. PDFs you open in Sahi, the fields you place on them (signature, initials, date, text and tick) and the signed result.
- Your signature. The signature and initials you draw or type, with your chosen style and ink colour.
- Signer details. The name and phone number of each person you ask to sign, and any note you add to a request.
- Support messages. Anything you send us when you contact us.
Information collected automatically
- Signing activity. To give every document a trustworthy audit trail we record events such as created, sent, opened, signed, declined and completed, with the time, IP address and device or browser type of the person acting.
- Device information. A device identifier, app version, operating system version and, if you allow notifications, a push notification token.
- Subscription status. Whether you have an active Sahi Pro subscription, its plan and its renewal date. Apple handles payment. We never see your card or bank details.
- Product analytics. If you allow it, anonymous usage events, such as which screen was opened or whether a step finished. These events never include your documents, signature, name, email address or phone number.
What we do not do
- We do not sell your personal information or share it for advertising.
- We do not read your documents for any purpose other than providing the service you asked for, such as preparing, sealing and delivering a signed PDF.
3. How we use it
| Purpose | What it involves |
|---|---|
| Provide the service | Let you sign documents, send requests, notify signers, collect their signatures, seal the final PDF and deliver a copy to everyone involved. Basis: performance of our contract with you. |
| Keep a reliable record | Maintain the audit trail and completion certificate that show who signed what and when. Basis: legitimate interests and legal obligations. |
| Accounts and subscriptions | Sign you in, keep your sessions secure, sync your documents across your devices and apply the features of your plan. Basis: contract. |
| Security and abuse prevention | Rate-limit requests, detect fraud and protect signing links. Basis: legitimate interests. |
| Improve Sahi | Understand which features work using anonymous analytics. Basis: your consent, which you can withdraw. |
| Support | Answer your questions and fix problems. Basis: contract and legitimate interests. |
4. People you invite to sign
When you request a signature, we use the phone number you provide to send that person a WhatsApp message with a secure signing link and a one-time code. We also send them reminders you trigger and, when the document is complete, a copy of the signed PDF. We use their details only to run that signing request.
Before adding someone, please make sure you are allowed to share their contact details with us for this purpose. Anyone who receives a request can contact us to ask about their information.
5. Service providers
We use a small number of trusted providers who process data only on our instructions:
- Amazon Web Services: hosting, database and encrypted document storage.
- Google Firebase: sign-in (Firebase Authentication), anonymous analytics if you allow it, and push notifications on Android.
- Apple: Sign in with Apple, in-app purchases and push notifications on iPhone.
- RevenueCat: manages subscription status. It receives a random account ID, not your name or contact details.
- Meta (WhatsApp Business Platform): delivers signing invitations, reminders and one-time codes to phone numbers.
We may also disclose information if the law requires it, to protect people's rights and safety, or as part of a merger or acquisition. In that last case this policy will continue to apply.
6. How long we keep it
- Documents are kept while your account is active. A document you delete goes to Trash, where you can restore it for 30 days before it is removed.
- Deleted accounts. When you delete your account we stop processing it right away. We permanently erase your documents, signatures and personal details within 30 days.
- Audit records for documents that other people signed are kept, with your identifying details removed where possible, for up to 7 years. Those people may need to prove what they signed.
- Signature on your device. Unless you turn on sync, your signature stays on your device and is removed when you delete the app or your account.
7. Security
- Files on your iPhone are encrypted with AES-GCM and protected by iOS data protection.
- Your sign-in credentials are kept in the iOS Keychain on that device only.
- Every connection uses TLS. Stored data is encrypted at rest.
- Documents sit in private storage that can be reached only through short-lived, single-purpose links.
- Signing links are random, scoped to one signer and one document, and expire.
- One-time codes are stored hashed.
No system is perfectly secure, but we work to protect your information and will tell you and the relevant authorities about a breach where the law requires it.
8. Your choices and rights
- Access and export. You can request a copy of your data. You can download your documents from the app at any time.
- Correction. You can update your profile in Settings.
- Deletion. You can delete your account in Settings, under Delete account, or ask us to delete it.
- Analytics. You can switch anonymous analytics off at any time in Settings.
- Notifications. You can turn push notifications off in iOS Settings.
Depending on where you live, for example in the EU, the UK, India or California, you may also have the right to object to or restrict processing, to data portability, to nominate someone to act for you, and to complain to your data protection authority. We will not treat you differently for exercising these rights. To make a request, contact us using the details below. We may need to verify your identity first.
9. International transfers
Our providers may process information outside your country. Where that happens we rely on appropriate safeguards, such as standard contractual clauses, to keep your information protected to the standard the law requires.
10. Children
Sahi is not intended for children. You must be at least 18, or the age of majority where you live, to use it. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy as Sahi changes. We will post the new version here with a new date. If the changes are significant we will tell you in the app before they take effect.
12. Contact us
For questions or requests about your privacy, email support@onebyte.studio.
This policy describes how Sahi works today. It is not legal advice about your own documents.