dsigns · Bit Precision

Privacy policy

How Bit Precision Pty Ltd handles information when you use dsigns.

Updated 11 October 2026

This policy covers the hosted service at dsigns.bitprecision.com, its player applications, mobile companion and the integrations you choose to connect. Bit Precision Pty Ltd operates this service. Contact tickets@bitprecision.com about privacy, access, correction or deletion. If your organisation uses a separately operated dsigns server, ask that operator for its policy.

Information we collect

Accounts and organisations: your email address, account identifier, customer membership, role, invitations and any organisation name, address, website, contact details or logo you provide.
Content and settings: uploaded images and videos, exported Canva designs, filenames, media metadata and cached previews, playlists, schedules, layouts, custom HTML, sites, player names and screen settings.
Connections and activity: authorisations, permission scopes, token hashes, import and publication records, screen actions and their status. We retain records that let us identify which account connected an integration and what it was allowed to do.
Device and security information: player identifiers, platform and app version, display details, storage, uptime, playback reports, incidents and command results. Windows and Linux players can provide screenshots and diagnostics. Sign-in and hosting systems also process IP addresses, browser details and request logs; the application uses hashed identifiers for some abuse-limiting counters.
Billing and support: plan and subscription status, payment-provider references and information you send when requesting help. Where paid billing is enabled, payment details are entered with Stripe. The dsigns application does not store full payment-card numbers.

We receive information directly from you, from your organisation's authorised administrators, from connected players and from services you choose to connect. Avoid uploading personal or sensitive information that is unnecessary for signage. Content displayed on a public screen is visible to people near that screen.

Why we use it

We use this information to sign you in, manage access, store and deliver your content, run playlists and schedules, report device status, process billing, respond to support requests and investigate security or service problems. Some information is necessary to provide these functions: without an email address we cannot provide email sign-in; without a connection and assigned content, a player cannot receive your updates.

Connecting Canva

You choose whether to connect the dsigns app from your Canva account. Canva manages its own sign-in. dsigns receives an authorisation to access the customer destinations permitted by your dsigns account, and imports the design export you choose to send. The app does not request your Canva password or browse your entire Canva design library.

Customer connections are limited to their customer account. Customer owners can manage that customer's connections; screen managers can manage their own. The dsigns master administrator can manage all customers. The Canva app uses your destination names and selected content to show publishing choices and previews inside Canva.

Disconnect in Settings → Integrations → Canva → Disconnect, or use Disconnect within the Canva app. Disconnecting revokes future access through that connection. It does not delete imported media or undo publications and scheduled screen actions. Stop those actions and remove content separately if you no longer want them used. See the Canva guide.

When available, the optional social connection reads published posts from a Facebook Page you manage, an Instagram Business or Creator account, or a TikTok account you authorise. The selected provider handles sign-in and consent. dsigns receives account identifiers and names, permission information, an access token (and a refresh token for TikTok), and the published captions, dates, original-post links and media URLs returned by the provider. We encrypt tokens before storing them. We do not request your provider password, private messages, follower data or permission to publish social posts.

Connections belong to the selected dsigns customer and can supply widgets across that customer's sites. Provider tokens stay on the server. Preview browsers and players receive display content and load supported images, videos or embedded posts directly from the relevant provider; those requests can disclose their IP address and browser information to that provider. This connector does not use AI to rewrite captions or infer claims from footage.

Disconnect in Settings → Integrations → Social accounts to delete the saved credential and cached posts for that connection. Connected players normally clear them on the next successful refresh, within five minutes; offline display data expires within one hour of its last successful sync. Provider media is not downloaded for offline playback. To remove the whole app authorisation, also remove dsigns in the connected-app settings of Facebook, Instagram or TikTok, as applicable. Selected LinkedIn and TikTok embeds are removed by replacing or deleting the library item and publishing the affected screens; they are not an OAuth connection. Verified provider deauthorisation and data-deletion requests remove connections and cached posts associated with that provider user. Deletion confirmation receipts contain no post or account data and expire after 30 days. Operational records and backups have the separate retention described below. See the social connection guide.

AI tools and MCP

The optional layout assistant sends the prompt, current draft, selected widget and relevant customer media/playlist references to OpenAI using the account’s configured API key. Provider usage is billed to the project that owns the key. The key is encrypted on the server and is not sent to players. Disconnect it in Settings → Integrations → AI tools.

When you connect an MCP client such as Claude or Codex, that client receives the content and account information permitted by the scopes you approve. Its provider’s own data practices apply. Customer access stays inside that customer; a master connection can operate across customers when authorised. Revoke API keys and MCP grants in Settings → Integrations → MCP & API. Revocation stops future access and does not undo actions already accepted.

Mobile companion

The mobile app stores its signed session in protected device storage and caches the account data it needs to show last-known status. Optional app lock uses the phone’s authentication system; dsigns does not receive a biometric template. Home-screen widgets can show a saved snapshot while the app is locked. Signing out clears the saved widget data; the operating system controls when it redraws.

If you enable notifications, dsigns stores an encrypted push token and your selected customers, sites, event types and delivery preferences. Expo and Apple or Google deliver the notification. Delivery records do not establish that a person saw it. Configure or disable notifications in the app’s Account settings and the phone’s system settings.

Release builds use EAS Observe for startup and update diagnostics and fixed screen names. The configured custom events exclude customer names, account identifiers, email addresses, content and API bodies. The mobile app’s error hooks are scrubbed before reporting. Expo supplies app builds and updates.

Who can access information

Your organisation's authorised users can access information allowed by their role. Bit Precision's platform administrators have broader access to operate and support the service. We use service providers to host the application, store data, deliver sign-in emails and process payments.

OpenAI Sites and Cloudflare: application hosting, database and file storage.
SMTP2GO: transactional emails such as sign-in links, codes and invitations.
Stripe: payment processing when you use paid billing.
Canva: its design platform and the app connection you choose to use.

Meta operates Facebook and Instagram and supplies authorised social posts and media when you choose those connections. Its own privacy practices apply to its services. TikTok supplies authorised account metadata, recent public videos, cover images and its hosted player when you use that connection. Selected LinkedIn and TikTok post embeds load directly from those providers, which receive normal browser requests and apply their own privacy practices.

These providers operate internationally, so information may be processed outside Australia, including in the United States and other countries where they operate. We do not offer an Australia-only data residency commitment. Contact us for information about the providers relevant to your account. We may also disclose information when legally required or when necessary to investigate misuse and protect the service.

Cookies and local storage

The dashboard uses necessary sign-in cookies and browser storage for preferences. Players keep assigned media, configuration and limited diagnostic state on the device so saved content can play offline. The dashboard does not include advertising trackers. The mobile companion’s operational diagnostics are described above. Canva and other service providers have their own data practices.

Retention and deletion

Customer content and configuration remain available until removed through the dashboard or an authorised deletion request. Disconnecting an integration is separate from deleting content or an account. Imports and publication history can remain after a connection is revoked.

The current service replaces a player's latest telemetry snapshot on check-in and removes incidents older than 30 days during subsequent check-ins. Temporary sign-in, pairing and rate-limit records expire under their respective security limits. These limits do not mean every record about an account is automatically erased at that time.

We retain support correspondence and operational records for as long as needed to handle the request, operate and secure the service, resolve disputes or meet legal obligations. Hosting logs, backups and payment-provider records have separate retention and deletion processes. Removal from the active application does not promise immediate erasure of every backup, log or third-party record.

Deleting a player revokes its server access and removes its player records. It does not remotely erase cached files on an offline device. Clear the player's local data or uninstall it to remove local copies. Removing a player or uninstalling its app does not automatically delete shared organisation media; an authorised administrator must remove that separately. Media still referenced by playlists or publications may need those references removed first.

Access, correction and complaints

Email tickets@bitprecision.com with your account email, organisation and the information you want to access, correct or delete. Do not send passwords, sign-in codes, tokens or payment-card details. We may need to verify your identity and authority before acting. If information must be retained or cannot be removed through your account, we will explain the reason and available next steps.

For a privacy complaint, tell us what happened and the outcome you seek. We will investigate and respond, and explain if further time or information is needed. If you are dissatisfied, you can contact the Office of the Australian Information Commissioner, which can explain whether it can consider your complaint.

Security and policy changes

We use HTTPS, authenticated access, customer permission checks and revocable credentials to protect information. No system or device is risk-free. Protect access to your email account and signage devices, keep applications current, and contact us promptly if you suspect unauthorised access.

We will update this page when the service's data practices change. The date above identifies this version.

Bit Precision Pty Ltd · ABN 57 136 711 816
Unit 2, 493 South Street, Harristown QLD 4350, Australia
+61 7 4646 4933 · tickets@bitprecision.com