Privacy Policy

Support conversations

After you sign in, we load Intercom in the background to prepare in-app support. For signed-out visitors, it loads when you open support. Intercom processes the messages, contact details, and attachments you choose to share, along with browser, current page URL and connection information, and uses cookies to maintain the conversation. We use this information to respond to your request. You can also contact hello@multisig.sh by email.

If you are signed in, we share your account ID, chosen display name, signup date, current workspace name and ID, and membership role to prepare support and help us understand your requests. These details refresh while you use the app. We also share predefined context about your app section and support request. We do not attach your email address, wallet addresses, transaction contents, signatures, or raw errors. The current page URL may contain a shared-link identifier. Account changes end the prior support session; browser storage records which account owns the Messenger cookies to keep conversations separate. Signed-out visitors remain anonymous. See Intercom’s privacy policy.

Product analytics

multisig.sh uses Vercel Web Analytics to measure page views and aggregate traffic, including referral sources, device and browser types, and countries. Vercel Web Analytics does not use cookies. We remove query parameters and URL fragments from tracked page URLs and replace share-link tokens, invite tokens, and Safe addresses with generic route names. Admin, authorization, and development pages are excluded.

We do not send transaction contents, signatures, custom events, session recordings, or application error reports to this service. We do not sell or share data with advertising networks. See Vercel's analytics privacy documentation.

Reliability monitoring

We use PostHog's EU service to monitor application errors, named warnings, feature usage, operation outcomes and performance. Reports contain generic route names, network IDs, counts, timings and code locations. We remove error-message text, transaction contents, signatures, wallet and account identifiers, query strings and link tokens. We do not record sessions or automatically collect clicks or form input.

PostHog runs without analytics cookies or browser storage. Its cookieless processing uses connection and browser information to calculate a temporary daily identifier. We disable location enrichment and remove the raw user-agent field after processing. See PostHog's privacy policy.

Browser-local data

The web app keeps browser-local coverage snapshots, execution outcomes, link-management authority, and interface state in localStorage.

Server-held workspace data

The web service stores the data needed to operate accounts and workspaces: account wallet identifiers, memberships, attached Safes, aliases, address-book entries, agent-connection metadata, subscriptions, share-link payloads and expiry, webhook deduplication records, and personal transaction and Message Drafts. A Draft can include target, calldata, provenance, an original message string or complete EIP-712 object, and an optional note. Connection tokens are stored only as hashes; the server never holds a plaintext token.

For signed-in accounts, we keep the latest time a visible app visit or interaction was observed, with updates limited to once a minute. Operators can view this timestamp alongside the account wallet to understand adoption and support the service. This is one timestamp, not a history of clicks or pages. It stays in our application database, is not sent to PostHog, and is removed if the account is deleted.

Historical operator records can include workspace acquisition sources, customer conversations, workflow needs, blockers, follow-ups, support and preparation effort, and recurring-price and payment references. We use these records with workspace activity to understand adoption and improve the service. They stay in our application database and are not sent to web analytics. Removing an observation from reporting retains an operator audit record; workspace deletion also removes these customer records.

The service also caches data read from public networks and Safe's transaction service, including Safe configuration, pending transactions, off-chain Safe messages, confirmations, and prepared signatures. These caches are shared by workspace members and expire or refresh as the product rechecks Safe state.

Safe messages and signatures

Message Draft content stays personal to its author until an eligible owner reviews and signs it. The first signature creates the message on Safe's transaction service; later direct or nested signatures are relayed there. A Shared Inbox Link can expose selected message content and signing progress to anyone who has the live link. multisig.sh checks completed signature blobs against the Safe through an RPC EIP-1271 call and exposes a prepared signature only after that check passes. Do not place confidential information in a message intended for Safe's service or a shared link.

No custody

multisig.sh does not hold private keys, seed phrases, signing credentials, or wallet secrets. The web app asks the user's wallet to sign, relays the resulting owner signature, and may assemble a Safe contract-signature blob from approved owner signatures. It cannot create an owner signature without wallet approval.

Network activity

The web service communicates with blockchain RPC providers, Safe's transaction service, the configured database, and Tenderly when transaction simulation is available. Server-only API keys stay on the multisig.sh server and are not included in the browser bundle.

Billing

Billing runs on Stripe. Your billing email, payment method, and invoices live with Stripe; we store your workspace's subscription status and may record invoice references and verified recurring amounts for internal reporting. See Stripe's privacy policy.

Removing data

Users can remove web app local data by clearing site data for multisig.sh. Personal Drafts can be deleted or withdrawn in the product, and workspace owners can delete a workspace. Data already submitted to Safe's transaction service, a blockchain, a dapp, or another third-party protocol is governed by that system and cannot be removed by multisig.sh.