SecureSign Privacy Policy
This policy applies to SecureSign for Android, published by WEDEVIT PRIVATE LIMITED (Devit). It covers the Google Play versions of the app, including version 1.1.10's manual email-reporting flow.
Signing and files on your device
SecureSign accesses the PDF you select and the connected USB token with your permission. Local signing processes the document on your device. The hardware token performs private-key operations; SecureSign does not export the token's private key. A PIN you enter is used for the approved token operation, not sent to Devit as a support report.
The app reads public certificate details, which can include the holder's name, email, organisation, certificate identifiers and other identity information contained in the certificate. Signed PDFs and local compatibility reports may contain certificate details. Files stay on the device unless you choose a sharing, export or portal action.
Optional email reports
SecureSign's Google Play release does not automatically upload error reports to Firebase or run an analytics or advertising SDK. Selecting Email error report opens your email app with a draft addressed to workwithdevit@gmail.com. The draft contains the visible error or support-request summary and the app version. No PDF, full technical report, PIN, private key, USB serial or certificate attachment is automatically added.
You can review, edit or discard the draft. Nothing is emailed until you choose Send in your email app. If you send it, Devit receives the message, your sender email address, any sender name exposed by your email account, and any information or attachments you choose to add. We use that information to respond, investigate the reported problem and improve SecureSign. Reporting is optional and is not required for local signing.
Our support mailbox is hosted by Google. Your email provider and Google process the message according to their own terms and privacy policies. We do not sell support reports or use them for advertising. Do not include a token PIN, private key or confidential document in a support email.
Copy, share and third-party portals
The separate Copy and Share controls let you choose to disclose a more detailed local compatibility report. Review it before sharing: it can contain device and token compatibility details, public certificate details, code locations and error information. Sharing a signed PDF also shares its document contents and embedded signature/certificate information with the app or recipient you select.
If you use the optional browser or portal-signing functions, the website you visit receives normal web requests and may collect login information, cookies, identifiers and information you submit. An approved certificate or signing operation can return your public certificate and signature information to that website. Those services are independent of Devit and handle the data under their own privacy policies. You can use local PDF signing without visiting a portal.
SecureSign is an independent third-party application. It does not represent a government entity and is not affiliated with or endorsed by a government portal. Portal compatibility is not guaranteed.
Storage, retention and deletion
App-private files, settings, reports and browser data remain on the device until removed through applicable app or Android controls. Uninstalling or clearing app storage removes app-private data. Copies you exported to Downloads, another app, a recipient or a website are separate and must be removed there.
Support messages are retained to handle the request and related troubleshooting. To request deletion of support emails held by Devit, email workwithdevit@gmail.com from the address used to contact us and identify the messages. We may retain information required for legal obligations or resolving a dispute. We cannot delete copies held independently by your email provider, recipients or third-party portals.
SecureSign does not require a Devit account. This public release does not create a Firebase diagnostic identity. Earlier separately distributed internal diagnostic builds are not the Google Play release covered by the manual-reporting description above.
Security and website access
The app disables Android backup of app-private data and does not permit cleartext HTTP traffic. Device security, your email provider and any external portal also affect protection of the information you choose to share. When you open this policy, our website hosting provider receives normal web-request metadata, such as your IP address and browser information, to deliver the page. This policy page contains no advertising or analytics scripts.
Contact and changes
For privacy questions or support-data deletion requests, contact WEDEVIT PRIVATE LIMITED at workwithdevit@gmail.com. If the app's data practices change, we will update this page and the applicable in-app and Google Play disclosures.