stillmeasure. home
Shop

Privacy policy: Sign PDF: Fill & Scan Docs

Last updated: 14 October 2026

This privacy policy applies to the Android app Sign PDF: Fill & Scan Docs (Google Play package name signdoc.app, formerly published as "ScuraSign – Digital Signature"). It explains which data the app processes, why, on what legal basis, and what rights you have.

In short:

  • Signing, filling, scanning and the PDF tools work on your phone. Your documents, scans and signatures are not uploaded to us, and we don't run a document cloud. You don't need to sign up.
  • The app shows no ads and does not use the advertising ID.
  • For usage statistics the app uses Google Analytics for Firebase. Document content is never part of it.
  • Subscriptions (Premium, Business) are handled by Google Play. We never receive your payment details.

1. Controller

Tobias Marks
MarksFinanceGroup (sole proprietorship), brand "stillmeasure."
Sponheimer Str. 14
55595 Mandel
Germany

Email: contact@stillmeasure.com
Contact form: www.stillmeasure.com/contact/

We have not appointed a data protection officer because we are not legally required to (Section 38 German Federal Data Protection Act (BDSG), Art. 37 GDPR).

2. Your documents stay on your phone

The app opens, shows, fills, signs, converts, merges, splits, compresses and protects PDFs on your device. The same applies to scans: edge detection, cropping, straightening and contrast are calculated on the phone. Document content, scans, form entries, file names and signatures are not sent to us or to Google, and they are not used for advertising, statistics or training of machine learning models.

  • Files: You choose which files the app opens via Android's file picker. The app does not search your storage for documents on its own.
  • Camera: The document scanner needs the camera. You can refuse the permission; scanning then doesn't work, everything else does.
  • Location (Business only, optional): If you add a location to an on-site signing, the app asks for the location permission and reads your position once. Otherwise it does not access your location.

3. What is stored on your device

The app keeps on your device, in its private storage that other apps cannot access: open and completed documents, your signatures and initials, templates, settings and, depending on your plan, profile data (e.g. name, address, email, phone number) and company data (e.g. logo, stamp, seal). Particularly sensitive data is stored encrypted with keys held in the Android Keystore. If you turn on the app lock, the app opens only after unlocking with your screen lock or biometrics; this check is done by Android, and the app never receives biometric data.

There is no automatic cloud backup by us. If you uninstall the app or clear its data, the documents stored in the app are deleted – save important files first with "Save as" or "Share".

Legal basis: storing this data is necessary for the features you use (Section 25(2) no. 2 German Telecommunications Digital Services Data Protection Act (TDDDG); Art. 6(1)(b) GDPR).

4. On-site signing with other people (Business)

With the Business plan another person can sign a document directly on your device. Their name, role, signature, date and time, details about the document and, if you use these optional features, details from an identity document and a location are processed locally on your device. If you collect data of other people this way, you or your organisation may be the controller for that data under data protection law; the app only provides the technical function. The region setting (EU/EEA, USA, other) is chosen by you and is not derived from your location.

5. Sharing, printing and websites

  • Share, print, save as: The file is handed over to the app or Android function you choose. That app's own privacy policy applies.
  • Web page to PDF: If you turn a web page into a PDF, the page is loaded from the internet. The website operator receives technical data such as your IP address and the time of access, as with any website visit.

6. Google Analytics for Firebase

The app uses Google Analytics for Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA; as our processor) to understand which features are used and to improve the app. Firebase records usage events (e.g. which screens and features are opened), a random app instance ID, device model, Android version, app version, language and approximate region (derived from the IP address). Not collected: document content, file names, form entries, signatures, initials, identity documents. The app does not use the advertising ID.

Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR) or your consent where it is required (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Analytics data is kept for at most 2 months and then deleted automatically.

7. Subscriptions via Google Play

Premium and Business are offered as subscriptions. Purchases are handled entirely by Google Play (Google Play Billing); Google's terms and privacy policy apply to the payment. You manage or cancel subscriptions in Google Play.

  • We never receive payment details (no card number, no bank account, no billing address).
  • The app asks Google Play which subscriptions belong to your Google Account and unlocks them on your device, using the purchase token, product ID and subscription status.
  • In our developer console we see order information from Google (e.g. order number, product, date, price, country, status). We use it to handle requests and to meet tax obligations.

Legal bases: performance of a contract, Art. 6(1)(b) GDPR; statutory retention, Art. 6(1)(c) GDPR.

8. Other Google Play features

  • Rating dialog: The app can show Google Play's rating dialog. We do not learn whether or how you rate.
  • Statistics and crash reports in the Play Console: Google gives us aggregated statistics and crash reports from users who let Android share diagnostic data with Google. They contain technical details, no name, no email address and no document content (Art. 6(1)(f) GDPR).

9. Contacting us

If you write to us, we process your message, your email address and anything else you tell us. Please do not send us contracts or identity documents unless they are needed for your request. Legal basis: Art. 6(1)(b) GDPR (questions about a subscription), otherwise Art. 6(1)(f) GDPR.

10. Recipients and transfers to the USA

Recipients are Google (Google Ireland Limited; Google LLC) as our processor for Firebase and as an independent controller for Google Play; the apps and website operators you choose when sharing or loading a web page; our email provider Hostinger International Ltd. (Cyprus) for support messages; tax advisers and authorities where required by law. We do not sell personal data, and we cannot hand over documents that exist only on your device.

Google may transfer data to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); Google also uses the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). More: policies.google.com/privacy/frameworks

11. How long data is kept

Data Retention
Documents, signatures, profile and company data on your device until you delete them, clear the app data or uninstall the app
Analytics data (Firebase) 2 months, then deleted automatically
Order information from Google Play until the end of the statutory retention period (up to 10 years)
Support messages until your request is resolved, at the latest 3 years after the end of the year of the last message

12. Your rights and deletion requests

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw consent with effect for the future (Art. 7(3) GDPR).

Deletion: Documents and everything else stored on your device are removed when you delete them in the app, clear the app data or uninstall the app. To have analytics data deleted, write to contact@stillmeasure.com; we will arrange deletion of the analytics data linked to your app instance. Because the app has no user accounts we usually cannot identify you; we will tell you which details we need. We reply within one month.

Right to lodge a complaint: You can complain to a data protection supervisory authority, e.g. where you live, or to the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de

13. Children, automated decisions, US states

The app is not directed at children. Automatic functions such as form field detection or scan correction do not make decisions about people with legal effect (Art. 22 GDPR). We do not sell or share personal data for advertising; residents of US states with privacy laws (e.g. California) can send requests about their rights to contact@stillmeasure.com.

14. Changes

We update this policy when the app or the law changes. The current version is always available at www.stillmeasure.com/apps/tools/sign-pdf/privacy/. The German version is here. Back to the app: Sign PDF: Fill & Scan Docs.