PrivacyBearocratic OÜ
Almost nothing to police.
bearomark is built so your documents never reach us in readable form. This page lists everything that does reach us — and how long it lives.
PrivacyBearocratic OÜ
bearomark is built so your documents never reach us in readable form. This page lists everything that does reach us — and how long it lives.
§ 01
Your documentsReading, signing, and verifying run in your browser or your app. When an envelope travels through our relay, it is encrypted before upload with a key we never receive — the relay stores ciphertext it cannot open, and neither can we — a property of the released page and app code, which the security page shows you how to check.Your keysThe unlock key in a signing link rides in the fragment — the part after the # — which browsers never send to us. Whoever holds the complete link holds that key; the link deserves the care the document does. Signing keys are created and used on your device. We hold no keys and cannot sign as anyone.Your identity as a signerSigning and verifying need no account and no login. The names written into an envelope reach us only inside that ciphertext.The honest limitEverything above is a property of the released clients and pages — confidentiality rides on the integrity of the code you run. That is checkable: the security page explains the release manifest and the witness that compares what we actually serve against it. And like every internet service, our infrastructure processes network metadata — IP addresses, request timing, sizes — to deliver traffic; a sender's sending key links their credential issuances to each other and to the deliveries it paid for (never to a document's contents, never to a guest).§ 02
What our services store, in plain words.
Relay deliveriesWhen a sender shares an envelope by link, the encrypted envelope — and later the encrypted signed copy coming back — is stored on our relay so the two of you don't have to be online at once. Both are ciphertext to us. They are deleted when the sender accepts the signed copy or cancels, and at the latest when the delivery expires (14 days or sooner, as the sender chose).Delivery coordinationFor each delivery the relay keeps what routing and tamper checks need: hashed access tokens, the delivery's state, sizes, lifecycle timestamps, the sender's public sending key, and a digest of the encrypted envelope. No names, no email addresses, no document contents. This state remains as a tombstone until the delivery's expiry, then is deleted.Sending credentialsA sender's app holds a sending key it minted locally. To meter sending and stop replays, the credential service keeps issuance records: the key's public half, credential identifiers, timestamps, and byte quotas. Sending is free during the beta; if a record ever anchors a payment, it is retained as long as accounting law requires.TimestampsWhen you sign, a cryptographic hash of your signature is sent through our relay to a public timestamp authority (DigiCert). The hash carries no document bytes and no identity; the relay forwards it and keeps nothing.Sender email verification (optional)A sender may verify their email for the "email verified" badge. For this we process the email address and the sealing public key: a code goes out from verify@bearomark.io, codes are stored only as salted hashes and expire after ten minutes, and the verification state deletes itself once the flow completes. The resulting attestation is handed back to the key holder and lives in their envelopes — not on our servers.Abuse limitsOur services keep short-lived counters — per network (derived from the requesting IP address), per sending key, and service-wide — so they cannot be used for spam or free bulk storage. Counters cover rolling windows of at most a day, or a month for per-key sending quotas, and clean up as the windows pass.No content loggingOn the relay and credential routes, request logs that could capture bodies, headers, or URLs are switched off. That configuration is enforced at deploy and re-checked by a scheduled job; a regression is treated as an incident, not a bug.§ 03
No analytics, no cookiesThese pages set no cookies and run no analytics or trackers. Your theme choice is kept in your browser's local storage and never sent anywhere.InfrastructureThe site and the services above run on Cloudflare, which processes technical connection data (such as IP addresses) to deliver the pages, as any host does.§ 04
ControllerBearocratic OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia — hello@bearocratic.io. Our infrastructure processor is Cloudflare, under its data processing addendum; where data leaves the EU, Cloudflare's standard contractual mechanisms apply.Your rightsUnder the GDPR you may request access, correction, or deletion of personal data we hold. If you signed as a guest, the honest answer is that relay data contains no guest accounts and no cleartext identities — nothing we can look up you by. Your countersigned document lives with the sender and in your own copy, not with us. (Network metadata such as IP addresses is processed transiently by our infrastructure provider to deliver traffic, as for any website.) Senders: cancelling a delivery deletes its stored objects immediately. Write to the address above; complaints can also go to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).ChangesIf the above grows, this page changes first — the date below tells you when it last did. Last updated 2026-09-13.