Privacy

1Who we are

SignalGood is a hosted website chat at signalgood.com. The operator’s legal name and address will be added here before launch.

2What we store about you

• Your Telegram account’s id, first name and username, from the moment you sign in with Telegram.
• Your websites: their addresses, and the name, welcome and colours you set.
• Only if you turn on your photo: a copy of your Telegram profile photo, shown in your chat. We delete it when you turn it off or remove the website.
• Only if you turn on AI replies: your visitors’ messages are sent to the AI provider you chose, using your key, to write the reply.
• Only if you use the AI add-on (AI replies without a key of your own): your visitors’ messages, your name and website’s name as shown in the chat, and the AI instructions you wrote are sent to Anthropic, the AI provider, under SignalGood’s own account and key, not yours, to write the reply. We count the replies used each month so the allowance can be kept.
• Only if you list pages for the AI to read: the addresses, and the text we read from those pages of your own website when you press the button (at most 20,000 characters). It is sent to the AI provider with each AI reply. We delete it when you remove the pages or the website.
• Only if you turn on AI replies: the AI key you paste, kept encrypted, with the provider and model you chose. We delete it when you remove the key or the website.
• Your plan: whether a website is on trial or paid, and the subscription and customer ids Dodo Payments gives us. We never see or store your card number.
• Your sign-in sessions, stored as a scrambled form of the session’s secret.
• For each address you add, a keyed hash of it with your Telegram account and the end of its free trial, so removing a website and adding it again does not start a second trial. It can’t be turned back into the address, and it stays after the website or the account is deleted.

3What we store about your visitors

• The messages they send and your replies.
• The page they wrote from, so you know what they were looking at.
• A scrambled form (a keyed hash) of their network address, used only to stop spam and abuse. We don’t store the address itself.
• A scrambled form of the random key their browser keeps, so they can come back to the same chat.
• An email address, only if the visitor chooses to leave one so your replies to that chat are also sent there. We first send that address one email asking its owner to confirm it; until they do, nothing else is sent and you do not see it. Once confirmed it is stored with their chat, you see it in Telegram, and it is used only to send them your replies to that chat.
• A scrambled form of that address, kept on a list of addresses that must not be emailed once the visitor has stopped, and counted for a day so one address gets at most a few emails.

We don’t ask your visitors for a name or an account. An email is optional, and a visitor can stop it at any time with the Stop link in the chat or in any email we send.

4How long we keep it

• A visitor’s chat lasts 7 days from their last visit, and each visit starts the 7 days again.
• After that it is deleted, with its messages, 90 days later: in all, 97 days after their last visit.
• A visitor’s email address is deleted with their chat, and at once when they stop it in the chat. An address nobody confirmed is deleted after 3 days. Stopping from an email deletes it from every chat and keeps only its scrambled form, so it is not emailed again.
• Spam counters, and the count of emails sent to an address, are deleted after 2 days.
• Expired sign-ins and sessions are deleted; payment event ids after 90 days.
• Removing a website deletes its chats at once. Deleting your account deletes every website and chat with it.

5Who else handles it

• Telegram carries your visitors’ messages to you and your replies back. It is a separate company outside the EU, with its own privacy policy.
• Anthropic writes the AI replies of the AI add-on, from the messages we send it. It is a separate company, with its own privacy policy. It is used only for websites that use the add-on; your own AI key’s provider is the one you chose.
• Resend sends the emails a visitor asked for. It is a separate company, with its own privacy policy.
• Vercel runs the service and serves its pages.
• Neon hosts the database.
• Upstash keeps a short-lived marker that a reply is waiting, so the database can sleep.
• Cloudflare Turnstile runs the invisible human check when a visitor starts a chat.
• Dodo Payments is the Merchant of Record for your subscription: it takes the payment, handles tax and sends your receipts.

6Your rights and how to use them

You can see, correct, export or delete what we hold about you. Most of it is in your dashboard; deleting your account deletes everything. For anything else, contact us (below). If your visitors ask you about their chat, you can remove the website, or ask us to delete one chat.

7Cookies

Our cookies are only for signing in to the dashboard: __Host-sg_session keeps you signed in (30 days from your last visit, and never more than 90 days from signing in), __Host-sg_login holds a sign-in while you tap Yes in Telegram (10 minutes), and sg_signed_in tells our public pages to show “Your websites” (it holds no secret).

Your visitors get no cookies. Nothing is stored in their browser until they send a message; then the chat keeps its key in their own browser’s storage, so they can come back to it. Your theme choice on this site is kept in your browser too.

8Changes

If this policy changes, we update this page and its date, and tell you in Telegram first.

9Contact

Ask in the chat on this site. A postal and email address will be added before launch.