Privacy Policy

Last updated: September 2026

This policy explains what personal information SignMe.lk collects, why, how it's used, who it's shared with, and the choices you have. It's written to reflect exactly what this platform actually does, not generic boilerplate.

1. Who we are

SignMe.lk is a petition platform for the Sri Lankan community. For questions about this policy or your data, use our Contact page.

2. Information we collect

If you create an account (needed only to start a petition, not to sign one): your email address, full name, district, and optionally a phone number. Your password is stored as a one-way cryptographic hash — we never store or can see your actual password.

If you sign a petition (no account required): your name, email address, and optionally a National ID number, a drawn signature, and a comment. We also record the date/time, your IP address, and a country derived from that IP.

If you start a petition: the petition content you write (title, background, call to action, targets, category), an optional cover image and video link, and optionally a separate contact phone/email for the petition (if you don't provide one, your account email is shown as the contact instead).

If you report a petition or contact us: the details you provide in that form, and optionally your email if you choose to give it.

Automatically: standard web server logs (IP address, browser type, pages visited) for security and abuse prevention.

3. How your drawn signature is stored

If you draw a signature when signing, it's saved as a compact set of coordinates (not an image file) and linked to your email address. If you sign more than one petition on SignMe.lk with the same email, your drawing is reused rather than stored again separately — drawing a new one updates it for future signatures too.

4. What's shown publicly vs. kept private

Public on a petition's page: your name, your comment (if you add one), and the date you signed. If the petition owner publishes a results report link, your drawn signature and IP-derived country (not your IP address) are also shown there.

Never shown publicly: your email address, National ID number, phone number, and IP address. These are visible only to the petition's owner (in their dashboard, for petitions you've signed) and to site administrators.

5. How we use your information

To operate the platform: creating and authenticating accounts, displaying petitions and signatures, sending verification codes, notifying petition owners about milestones or when their petition is closed, and responding to support requests or reports. We do not use your data for advertising, and we do not sell your personal information to anyone.

We share data with a small number of third-party services strictly needed to run the platform:

Email delivery — to send verification codes, notifications, and messages you submit via contact forms.
IP geolocation lookup — to show which country a signature came from. This is best-effort and never blocks or delays your signature if it fails.

A specific feature to be aware of: a petition owner can choose to email a copy of their petition's results — including public signer names, comments, and drawn signatures — to a recipient of their choosing (e.g. an official the petition is addressed to). This is owner-initiated, limited to information already public on the results page, allowed once per petition, and clearly discloses in the email itself that it was sent via SignMe.lk on the organiser's behalf.

We do not share your email address, National ID, phone number, or IP address with petition owners' target recipients, or with any other third party, except where required by law.

7. Cookies

We use only functional cookies: one to keep you logged in (session cookie) and one for security (CSRF protection). We don't use advertising or analytics/tracking cookies.

8. Security

Passwords are hashed, not stored in plain text. Email and phone verification uses one-time codes. Forms are protected against automated abuse with a custom maths captcha (no third-party captcha service sees your data) and rate limiting. The site is served over HTTPS.

9. Data retention

We keep account and signature data for as long as your account or the relevant petition exists. Petition owners can delete their own closed petitions at any time, which permanently removes that petition's signatures, comments, and cover image. We don't currently run an automatic data-expiry process beyond that — if you'd like your data removed sooner, contact us (see below).

10. Your rights and choices

You can update your account profile at any time once logged in. To request a copy of your data, ask us to correct it, or ask us to delete your account or a signature, contact us — we handle these requests manually rather than through automated self-service today.

11. Children's privacy

SignMe.lk is not directed at children, and we don't knowingly collect personal information from young children. If you believe a child has provided us with personal information, please contact us and we'll remove it.

12. Changes to this policy

We may update this policy as the platform changes. We'll update the "Last updated" date above when we do; significant changes will be noted on this page.

13. Contact us

Questions about this policy or your data can be sent via our Contact page.