Your document stays here.
Files selected or dropped into the editor are processed on your device. Inkdesk does not upload their contents, filename, typed name or pen strokes to the sealing service.
What leaves your browser
When you request a seal, a SHA-256 fingerprint, a random nonce and verification-code control information are sent to the timestamp relay. Public log entries contain cryptographic fingerprints, codes and timestamps.
What is stored on your device
If you choose Remember names, up to three signer profiles (names, initials and chosen handwriting) are stored in localStorage. Preferences are also stored locally. Forget me removes both. Documents are not stored in localStorage, IndexedDB or the service-worker cache.
The copy you share
Your exported PDF includes your declared name, placements, recorded ink, consent wording and signing metadata. Anyone with that file can read and replay that record.
Operating-system sharing
An installed, active service worker opens shared PDFs locally in memory. If the browser has removed that worker, an operating-system share can send the file in a POST request to the fallback endpoint. That endpoint does not read or store the body and redirects you to choose the PDF locally instead. Use the file picker or drag and drop for a strictly local document input path.
Hosting and requests
Hosting infrastructure processes network metadata needed to serve the site. The application uses no advertising, tracking pixels or product analytics. Timestamp providers and public log services receive the bounded cryptographic requests described above.
Last updated October 2026.