6 kinds of account data · none on the answer path
What is stored.
Signing in is the only thing that creates a record of you, and it is a separate system from the one that answers questions.
The answer path holds nothing about you
The tools read public-domain federal records from object storage and return them. No answer returns or describes an individual person, and citature links no record to individually identifiable data — this is a guardrail the answer types enforce, not only a policy1.
What an account stores
- Email address, and a name if you gave one
Identifies the account and receives the verification and password-reset messages. Nothing else is sent to it.
- A password hash
Never the password. It is stored so a sign-in can be checked and for no other purpose.
- Sessions — a token, its expiry, and the IP address and user agent that created it
Keeps you signed in and lets a session be recognised and ended2.
- OAuth clients, consents, and issued access and refresh tokens
An agent acting for you holds a token issued for this resource. The consent record is what makes that grant reviewable and revocable rather than permanent.
- A Stripe customer identifier, where a billing identity was created
The metered tools are billed per served answer. The identifier links a call to the customer it bills; card details are held by Stripe and never reach citature.
- Rate-limit counters, keyed and timestamped
Protects a shared resource3.
Who else sees it
Two processors, both for the thing they are named for. Stripe holds the payment method and the billing record; citature stores only the customer identifier that points at it. Amazon Web Services hosts the database and sends the account email, in the United States.
citature does not sell account data, does not share it for advertising, and runs no third-party analytics or advertising scripts on this site.
How long it is kept
Account data is kept while the account exists. Deleting the account deletes the sessions, the OAuth grants and the tokens with it — they are declared to cascade, so there is no second step that can be forgotten.
Rate-limit counters are reaped once their window has closed. Server logs are kept for 30 days, which is long enough to investigate a billing dispute and short enough that logs are not an archive4.
Asking for it
You can ask for a copy of what is held about your account, ask for it to be corrected, or ask for the account and its data to be deleted. Reaching us is on the contact page.