Privacy

Updated 24 September 2026

Sigora is by Paperfoot AI. This website introduces the product and collects requests for launch updates. It does not connect to a live shop or show customer records.

The waitlist

We collect your email address, the date you joined and a record of your consent to receive Sigora launch updates. We use these details only to manage the waitlist and contact you about Sigora’s availability.

Waitlist entries are encrypted before they are stored in a private Vercel Blob store. The website’s server can decrypt them; authorised operators can export them to send updates. This is not end-to-end encryption.

Every launch email will include a link to remove your email from the waitlist. You can also use that link to request deletion without signing in. We retain your entry until you unsubscribe or the waitlist closes, and do not sell it.

Visiting this website

We do not add advertising trackers, analytics scripts or tracking cookies. Fonts are served by this website. Vercel hosts the site and processes request information, such as IP addresses, to deliver and protect it. The waitlist uses a short-lived, hashed IP value in memory to limit repeated submissions.

When you run a shop

The shop software runs on hardware controlled by the shop owner. Signal encrypts messages in transit between customer and shop. Shop records are stored encrypted on the owner’s machine. The shop owner and software can access the records needed to fulfil orders.

The local AI receives the current message, catalogue and that customer’s cart context. Saved delivery details, other customers’ records and wallet keys are excluded. Text a customer puts in their current message may be read by the local model. While a customer is answering one of the shop’s checks, their replies go to the shop server’s rules instead, and the model never sees them.

Signal remains a separate service.

Payments

Each shop chooses the payment methods it offers, and the customer picks one at checkout. The shop server handles that choice; the local AI doesn’t choose a method or see payment details.

With payment instructions written by the owner, such as a bank transfer, the shop sends those instructions and the order code in Signal. The owner marks the order paid once the money arrives.

With card payments, the shop sends a Stripe payment link. Stripe sees the amount, the order code and the details the customer enters on its page, such as card details and an email address, and handles them under its own terms. It never sees the customer’s Signal account or delivery address. The owner’s Stripe key is kept in the macOS Keychain on the shop’s computer, not in shop records. After paying, Stripe sends the customer to sigora.dev/paid. That page receives no order details; like any page on this website, the visit is processed by Vercel.

With stablecoins, the customer sends USDC on Base, Ethereum, Arbitrum, Optimism, Polygon or BNB Smart Chain, or USDT on BNB Smart Chain. Transfers on these networks, including addresses and amounts, are public. Network providers may see the addresses queried by the shop.

Checks and documents

A shop can ask customers to confirm their age, agree to terms or share licence details before they buy. Customers answer as text in Signal. They cannot send photos or files to the shop; incoming attachments are ignored. A confirmation records what the customer said. It is not proof of age or identity.

Some shops use their own verification provider for age or identity checks. The shop sends the provider’s link, and the customer opens it on their own device. The provider receives what it collects under its own terms; the shop server does not contact it. The owner checks the result with the provider, then approves or declines in the app.

A shop that sells to US medical professionals can check an NPI number against the public NPI Registry run by the US Centers for Medicare & Medicaid Services. Only the NPI number, which is public, is sent to the register; the customer’s name and other answers are not. The register shows whether the licence is real and active and the name on record, which the shop server compares with the name the customer typed. It can’t prove the customer is that person. The register’s result is kept with the approval.

The shop keeps each check’s result with its date and any expiry, and deletes it 30 days after it expires. Results without an expiry are kept. Answers that need the owner’s review are kept until the owner decides, then deleted. The record of that decision is deleted after 30 days, and a link check the customer never finishes is removed after 7 days. If the owner reviews answers in the shop’s Signal chat instead of the app, those messages stay in that chat until the owner deletes them.

Owners can attach documents, such as lab certificates, product sheets and sourcing notes, as PDF, PNG or JPEG files of up to 10 MB each. Documents uploaded from the app travel over its private connection to the shop server. They are stored encrypted on the owner’s computer until the owner deletes them, and are sent in Signal only when a customer asks. When sending one, the shop server does not write an unencrypted copy to disk. The shop records which document went to which customer and when, keeping the latest 2,000 records. The local AI does not see check answers, documents or their names.

The companion app

The companion app connects to your shop server. This public website does not provide access to that server or its customer records. On the Mac that runs the shop, the app manages it directly on that computer.

The setup assistant drafts checks and shop profile text from a description you type, and products from a price list you pick or scan. It uses Apple’s on-device model through Apple Intelligence and sends nothing off the device. For checks it receives your description and your product names and codes; for profile text, only your description; for a price list, only that file or scan. CSV and JSON price lists are read without Apple Intelligence; PDFs, photos and scans only while Apple Intelligence is on for Sigora. It never sees customers, orders, answers or documents, and a draft changes nothing until you save it.

Agents

An agent is your own AI app, such as Claude, ChatGPT or Codex, filling in your shop from the computer that runs it, through the signal-shop command line tool or MCP server. Prices, new or removed products, shipping, discounts, payment methods, looser checks and opening the shop wait until you approve them in the companion app.

An agent reads your shop’s settings, products, profile, checks, documents and payment method settings, and order summaries with codes, statuses, items and totals. It sees customers’ delivery names, addresses and countries only if you turn on “Let agents see customer details” in the app’s settings, which is off until you do. It never sees customers’ Signal, WhatsApp or Telegram identities, their messages or their check answers. The Stripe key, wallet recovery words and Signal codes never pass through an agent.

The app collects no data for Paperfoot AI. An agent is your own tool, and its AI provider, such as Anthropic or OpenAI, is your choice; that provider processes what the agent reads, under your own account and terms.

The wallet

Wallets created or restored on iPhone or iPad keep their recovery phrase in the device’s Keychain, protected by device authentication and excluded from iCloud sync. Transfers are signed on the device. Sigora does not send recovery phrases or private keys to network providers or your shop server.

The app sends your public wallet address to Base’s public RPC service and Blockscout to check balances and activity. Reviewing a transfer sends Base the sender, recipient and amount to estimate fees, even if you later cancel. Confirming sends the signed transaction; status checks send its transaction hash. These services can see your IP address.

Opening a transaction link shares its public transaction hash with Basescan. The app stores wallet account details, cached balances and outgoing transfer records on your device, separately from shop records.

Signal

Sigora is independently developed by Paperfoot AI. Signal, the Signal logo, and all related names, designs, and slogans are registered trademarks of Signal Technology Foundation.